Zervox

Autonomous AIOps Incident Remediation Engine in Rust

Zervox bridges the gap between raw observability alerts and safe, automated Kubernetes incident resolution.
Ingest Prometheus/Grafana alerts securely, correlate metrics with pod logs using LLMs, enforce strict OPA safety policy guardrails, and execute remediation safely.

🌐 Visit Website  •  ⚡ Quick Install  •  🎬 Watch Demo  •  🛡️ Security Guardrails  •  📖 Architecture RFC

---

🎬 Product Demo

Watch Zervox in action: 3 AM Grafana alert ingestion → LLM root cause analysis → OPA policy guardrails → One-click Kubernetes remediation.

---

⚡ Quick 1-Line Install

Install the pre-compiled native Rust binary instantly on Linux or macOS:

curl -sSL https://raw.githubusercontent.com/ziuus/Zervox/main/scripts/install.sh | bash

Or run directly via Docker:

docker run -d -p 8080:8080 -e ZERVOX_API_SECRET=your_secret ghcr.io/ziuus/zervox:latest

---

🌟 Key Features & Capabilities

🔐 Webhook & API Authentication Enforces Bearer Token and x-api-key headers on all HTTP endpoints (/api/analyze, /api/grafana_webhook). Unauthenticated payloads return HTTP 401.	🛡️ Strict OPA Policy Guardrails Absolute safety blocks prevent namespace deletions, secret reads, RBAC modifications, and container shell exec before any command reaches Kubernetes.
🙋‍♂️ Human-in-the-Loop Gateway Toggle ZERVOX_REQUIRE_APPROVAL=true to transition non-read-only cluster actions to PENDING_APPROVAL in SQLite instead of auto-executing.	🗄️ Resilient SQLite WAL Storage SQLite operating in WAL mode with 5-second busy timeout connection pools guarantees zero lock contention or crashed background tasks.
🔄 Resilient Retries & Backoff Built-in exponential backoff and 10s timeout wrappers for LLM API calls and kube-rs cluster patch operations.	📦 Multi-Arch Binary Distribution Cross-compiled native binaries for Linux (x86_64, aarch64) and macOS (Intel, Apple Silicon) generated on tag push.

---

🛡️ Security & Policy Guardrails

Zervox acts as an unbypassable safety firewall between AI recommendations and your live cluster:

┌───────────────────────────────┐     ┌───────────────────────────────┐
│     AI Proposed Action        │ ──> │     OPA Rego Policy Engine    │
│  "kubectl delete namespace"   │     │   Evaluates Security Rules    │
└───────────────────────────────┘     └───────────────┬───────────────┘
                                                      │
                                    ┌─────────────────┴─────────────────┐
                                    │                                   │
                                    ▼                                   ▼
                      [ 🛑 ABSOLUTE BLOCK ]               [ ✅ APPROVED REMEDIATION ]
                      Namespace deletion prohibited        Rollout restart / scale limits

Absolute Blocks Enforced:

• 🚫 Prohibited Namespace Deletion: kubectl delete namespace or delete ns
• 🚫 Prohibited Container Shell Exec: kubectl exec -it arbitrary shell execution
• 🚫 Prohibited RBAC Modification: ClusterRole, RoleBinding, or ServiceAccount edits
• 🚫 Prohibited Secret Inspection: Direct reading of Kubernetes Secret resources
• 📏 Replica Boundary Cap: Hard cap of maximum 10 replicas on scaling operations

---

🏗️ Architecture & Remediation Pipeline

Data flows through a structured, non-blocking asynchronous pipeline:

graph LR
    subgraph 1. Ingestion Layer
        A[Grafana / Prometheus Alert] -->|Bearer Auth / API Key| B[Axum Webhook Server]
    end

    subgraph 2. Intelligence Engine
        B --> C[(SQLite WAL Database)]
        C --> D[Anomaly Correlator]
        D -->|Metrics + Logs| E[LLM Root Cause Analyzer]
    end

    subgraph 3. Safety & Execution
        E --> F{OPA Policy Engine}
        F -->|Prohibited Command| G[Absolute Block & Alert]
        F -->|Approved Action| H[kube-rs K8s Client]
        H -->|Rollout / Scale| I[Kubernetes Cluster]
    end

Loading

---

💻 CLI Quick Reference

# Start the Web Ingestion Server & Dashboard
zervox web --port 8080

# List monitored processes & status
zervox list

# Analyze an incident manually
zervox analyze --logs ./logs/api.log --metrics ./metrics.json

# Check policy evaluation for a command
zervox policy check "kubectl rollout restart deployment/api-gateway"

---

🧪 Testing & Quality Gates

Run unit and integration tests covering security, policy guardrails, SQLite WAL mode, and failure retries:

cargo test

Verify release compilation:

cargo check --release

---

📄 License

Distributed under the MIT License. See LICENSE for details.