Grok SRE bot: investigate alerts and auto-generate fix branches

Availability: preview — the guide is ready to try; end-to-end validation on a live Grok account is still pending.

Mendry Bot turns Grok into an on-call AI SRE assistant. When an alert fires, Grok reads the logs and the relevant code, explains the root cause with evidence, and, once you authorize it, writes the fix in an isolated workspace, runs the tests, and pushes a review branch. You do not deploy Mendry or install anything; Grok uses its own tools. Your Grok subscription and connected tools may still incur costs.

This page covers Grok only. For Claude cloud sessions or Meta Muse.ai, see Try Mendry with your existing bot.

What the Grok SRE bot does

• Alert investigation: queries the logs you connect, correlates errors with recent deploys and commits, and separates direct evidence from correlation.
• Root-cause report: delivers an incident report with a conclusion, evidence, open hypotheses, and a fix plan before it touches any code.
• Auto-generated fix branch: after you authorize it, adds a reproducing test, changes the code, runs the tests, and pushes a branch for review.
• Alert-triggered runs: a saved Grok Automation with a signed Webhook can start an investigation without someone opening a chat.

It does not merge, deploy, or roll back production. Review, merge, and deployment stay with you.

Set up Grok in three steps

1. Send Grok the guide. Paste the sentence below into Grok. Grok reads the complete guide itself.

   Read https://www.mendry.net/mendry-bot.md and follow it as your Mendry Bot instructions. Reply in English. Check which tools you can use in this host, then guide me through investigating one alert.

2. Connect logs and Git, then describe one alert. Name the service, where its logs live, and the repository. Connect credentials through Grok’s secure connection settings, never in chat. Start with a test service or a past incident.

3. Read the report, then authorize the fix. Grok reports first. Only after you say so does it change code, run the tests, and push a review branch.

Grok checks which tools your account actually has before each step. Without log or Git access, paste redacted alerts and logs and the result is labeled sample analysis. Without write access, you get a patch instead of a branch.

Trigger investigations from alerts automatically

Complete at least one manual investigation before you automate.

1. Save an Automation. Store the full guide and your service configuration in a Grok Automation so that every new run starts with the same rules.
2. Add a Webhook trigger. Grok generates the endpoint. Requests are signed with HMAC-SHA256 following Standard Webhooks; keep the signing secret in your alert source’s secret storage. See the official Webhook Triggers documentation.
3. Send a test event. HTTP 202 means Grok accepted the delivery, not that the investigation finished. Open the new task and confirm it used the event, the right configuration, and the expected log and repository access.

If your alert source cannot sign the raw request body as Grok requires, keep starting runs manually or adapt it with an automation platform you already run. The guide does not create a server.

Unattended branch pushes need more than a working trigger: duplicate events must not write twice, concurrent runs on the same service must be coordinated, and an uncertain push must be checkable. Until those hold, let alerts start investigations and authorize each fix branch yourself. Write down how to pause the Automation, revoke access, and inspect tasks that are still running.

What to verify on your account

Grok’s documentation describes the Automation and Webhook features; it does not prove your account is set up for them. Check:

• which log and Git tools your account can actually use;
• how alert fields map into the event Grok receives;
• where tests run and which branches Grok may push to;
• how you read results, and how concurrent runs and cancellation behave.

FAQ

Can Grok auto-fix production incidents?

Grok can generate and test a fix and push it as a review branch once you authorize it. It does not merge or deploy; a pushed branch is not production recovery.

Do I need to deploy Mendry to use Grok as an SRE bot?

No. Mendry Bot is a single guide that Grok follows with its own tools. Deploying the full Mendry incident app is a separate path.

Is the incident report trustworthy?

Every finding in a report should point to a real log query, deployed commit, or test result, and anything inferred is labeled as such. Read the example report to see the format.