# Security and Compliance
Source: https://docs.antimetal.com/admin/security
How Antimetal handles security, privacy, and access
Antimetal operates on your production infrastructure. This page covers how we handle security, privacy, and data access.
## Security
All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Credentials are stored using AWS KMS. Infrastructure is hosted on AWS and provisioned via Infrastructure-as-Code with least-privilege IAM roles. Access to production systems is controlled, logged, and protected with MFA.
* Background checks are conducted for all employees
* Employees receive regular security training
* Endpoint protection and device management enforced via MDM
* Regular penetration testing and third-party audits
* Customer data is never entered into external AI tools by employees
Antimetal is SOC 2 Type II certified. Our controls and procedures have been independently audited and validated to meet industry standards for security, availability, and confidentiality.
Contact [security@antimetal.com](mailto:security@antimetal.com) for a copy of the report.
Antimetal is HIPAA compliant. Protected health information is handled in accordance with HIPAA requirements. Contact [security@antimetal.com](mailto:security@antimetal.com) for details.
Report security concerns to [security@antimetal.com](mailto:security@antimetal.com).
## Privacy and Data
All tenant data runs in isolated environments with strict separation boundaries. There is no cross-contamination between customers. Lightweight metadata such as alert identifiers and investigation status may be temporarily retained for tracking purposes.
Antimetal uses third-party AI APIs from Anthropic, OpenAI, and Google. All providers are configured with no-data-retention policies. Customer data is never used to train shared or generalized models. Each customer's data is handled in a segregated environment with multi-tenant isolation controls.
AI accelerates root cause analysis and generates remediation recommendations tied to evidence. All AI outputs are linked to underlying data so customers can validate results independently. Audit logs capture all AI-assisted activity. AI augments investigation quality but never operates outside customer visibility.
## Integration Permissions
Each integration requests only the minimum permissions needed. See the individual integration pages for details on specific scopes and access levels.
Minimal OAuth scopes, no message persistence
Repository access, pull requests, CI/CD monitoring
Read-only IAM Role via CloudFormation
Read-only service account across projects
Read-only API and Application keys
Read-only service account or access policy token
Read-only internal integration token
Read-only User API Token
Read-only API key
## Best Practices
Antimetal surfaces recommendations tied to evidence. Review them before acting. All recommendations include links to the underlying data so you can verify independently.
Use the [Antimetal dashboard](https://overlook.antimetal.com) to store integration credentials. Do not share API keys over Slack or email.
When possible, scope integration permissions to specific projects, repositories, or environments. Each integration page documents the minimum required permissions.
# Retrieve artifacts by IDs
Source: https://docs.antimetal.com/api-reference/artifacts/retrieve-artifacts-by-ids
/assets/openapi.mintlify.json get /artifacts
Fetches multiple evidential artifacts by their IDs. Supports up to 100 IDs per request.
# Create a new issue
Source: https://docs.antimetal.com/api-reference/issues/create-a-new-issue
/assets/openapi.mintlify.json post /issues
Creates a new issue and optionally starts an automated investigation. The issue is created from the provided details, with a seed generated internally. Investigation runs asynchronously - poll GET /issues/{id} to check status.
# Delete an issue
Source: https://docs.antimetal.com/api-reference/issues/delete-an-issue
/assets/openapi.mintlify.json delete /issues/{id}
Permanently deletes an issue and all associated data
# Fetch an issue by ID (UUID)
Source: https://docs.antimetal.com/api-reference/issues/fetch-an-issue-by-id-uuid
/assets/openapi.mintlify.json get /issues/{id}
Retrieves detailed information about a specific issue by its ID (UUID)
# Fetch investigation results by ID (UUID)
Source: https://docs.antimetal.com/api-reference/issues/fetch-investigation-results-by-id-uuid
/assets/openapi.mintlify.json get /issues/{id}/results
Retrieves detailed investigation results including root cause analysis and remediation steps
# Fetch issue by number
Source: https://docs.antimetal.com/api-reference/issues/fetch-issue-by-number
/assets/openapi.mintlify.json get /issues/by_number/{number}
Lightweight endpoint to retrieve basic issue information by issue number
# Fetch issues for an organization
Source: https://docs.antimetal.com/api-reference/issues/fetch-issues-for-an-organization
/assets/openapi.mintlify.json get /issues
Returns a paginated list of issues for the authenticated organization
# Update issue status by ID (UUID)
Source: https://docs.antimetal.com/api-reference/issues/update-issue-status-by-id-uuid
/assets/openapi.mintlify.json patch /issues/{id}
Updates the status of an existing issue by its ID (UUID)
# Ask Antimetal's AI agent a question
Source: https://docs.antimetal.com/api-reference/query/ask-antimetals-ai-agent-a-question
/assets/openapi.mintlify.json post /query
Sends a question to Antimetal's AI agent and returns a natural language answer. Pass the returned conversation_id in subsequent requests to continue the conversation. Set stream: true (and Accept: text/event-stream) to receive a Server-Sent Events stream.
# MCP
Source: https://docs.antimetal.com/connect
Connect to Antimetal's MCP server from your AI tools
Antimetal exposes a remote MCP server at `https://mcp.antimetal.com` that any MCP-compatible client can connect to. This gives your AI tools direct access to Antimetal's investigation, root cause analysis, and remediation capabilities.
Before connecting, make sure you've [set up your integrations](/integrations/overview) so Antimetal has access to your infrastructure and observability data.
For Claude Code and Cursor, install the [Antimetal Skills plugin](/product/skills) instead — it bundles the MCP server with pre-built investigation and fix workflows.
For other clients, add the server using the configuration below. All of these clients support OAuth for remote MCP and will prompt you to log in on first use. You can also generate an API key from the [Antimetal dashboard](https://overlook.antimetal.com/settings/api-keys) and use it as a bearer token if you prefer.
Add the following to your VS Code settings (`settings.json`):
```json theme={null}
{
"mcp": {
"inputs": [
{
"type": "promptString",
"id": "antimetal-api-key",
"description": "Antimetal API Key",
"password": true
}
],
"servers": {
"antimetal": {
"type": "http",
"url": "https://mcp.antimetal.com",
"headers": {
"Authorization": "Bearer ${input:antimetal-api-key}"
}
}
}
}
}
```
Add the following to your Claude Desktop config:
* macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
* Windows: `%APPDATA%\Claude\claude_desktop_config.json`
```json theme={null}
{
"mcpServers": {
"antimetal": {
"type": "http",
"url": "https://mcp.antimetal.com",
"headers": {
"Authorization": "Bearer YOUR_ANTIMETAL_API_KEY"
}
}
}
}
```
Replace `YOUR_ANTIMETAL_API_KEY` with your actual API key.
Add the following to your Windsurf MCP config (`~/.codeium/windsurf/mcp_config.json`):
```json theme={null}
{
"mcpServers": {
"antimetal": {
"type": "http",
"url": "https://mcp.antimetal.com",
"headers": {
"Authorization": "Bearer YOUR_ANTIMETAL_API_KEY"
}
}
}
}
```
```bash theme={null}
codex mcp add antimetal --transport http https://mcp.antimetal.com -- --header "Authorization: Bearer $ANTIMETAL_API_KEY"
```
# Antimetal Overview
Source: https://docs.antimetal.com/index
Learn how to set up and use Antimetal
Antimetal handles everything that happens after you deploy. It investigates, fixes, and prevents issues by connecting your cloud platforms, observability tools, and code.
* **Diagnose** - When an alert fires, Antimetal pulls together data from your logs, metrics, traces, code, and incident history to identify the root cause.
* **Fix** - Antimetal generates production-ready fixes tied to evidence, so your team can review, validate, and ship.
* **Prevent** - Antimetal surfaces blind spots and inefficiencies before they become incidents.
## Get Started
Connect your monitoring, observability, and infrastructure tools to Antimetal.
How issues move from alert to root cause to resolution.
Connect to Antimetal from Claude Code, Cursor, VS Code, and other AI tools.
SOC 2 Type II certified. How we handle security, privacy, and data access.
# Azure
Source: https://docs.antimetal.com/integrations/azure
Create an Entra service principal for Antimetal monitoring
## Overview
This guide walks you through creating a Microsoft Entra service principal to enable the Antimetal integration for Azure. Once connected, Antimetal can investigate incidents across App Service, Azure SQL (Database, Elastic Pool, and Managed Instance), Storage, Service Bus, Function Apps, AKS, Container Apps, Cosmos DB, MySQL, PostgreSQL, Redis, Event Hubs, Data Explorer, and Application Insights. It queries Log Analytics (KQL), Azure Monitor metrics, Resource Health, and the Activity Log to correlate symptoms with configuration changes and deployment events.
Go to the Azure integration setup in the Antimetal dashboard.
## Prerequisites
* An Azure subscription you want to monitor
* Permission to register applications in Microsoft Entra ID
* Permission to assign roles on the target subscription (Owner or User Access Administrator)
## Setup
1. Go to the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID > App registrations**
3. Click **+ New registration**
4. Fill in:
* **Name:** `antimetal-monitoring`
* **Supported account types:** Accounts in this organizational directory only
5. Click **Register**
6. On the overview page, copy the **Application (client) ID** and **Directory (tenant) ID**
1. In the app registration, go to **Certificates & secrets**
2. Click **+ New client secret**, set a description and expiration
3. Click **Add**
4. Copy the secret **Value** immediately
The secret value is only shown once. Copy it before leaving the page.
For each subscription you want to monitor:
1. Navigate to **Subscriptions** and open the target subscription
2. Go to **Access control (IAM)**
3. Click **+ Add > Add role assignment**
4. Select the **Reader** role, then click **Next**
5. Under **Members**, select **User, group, or service principal**, click **+ Select members**
6. Search for `antimetal-monitoring`, select it, click **Select**
7. Click **Review + assign**, then **Review + assign** again to confirm
8. Copy the **Subscription ID** from the subscription overview
```bash theme={null}
az ad sp create-for-rbac \
--name antimetal-monitoring \
--role Reader \
--scopes /subscriptions/
```
Output includes `appId` (client ID), `password` (client secret), and `tenant`. Save these values.
```bash theme={null}
az role assignment create \
--assignee \
--role Reader \
--scope /subscriptions/
```
### Configure the Antimetal integration
1. Navigate to the Antimetal Azure integration page
2. Paste the **Tenant ID**, **Client ID**, **Client Secret**, and (optional) default **Subscription ID**
3. Click **Connect**
## Permissions and Access
Antimetal uses a read-only service principal scoped to the subscriptions you select. No write, delete, or configuration changes are performed in your Azure environment.
| Role | Scope | Access |
| --------------------------------------------------------------------------------------------------------- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Reader](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general#reader) | Selected subscriptions | Standard Azure built-in role. Grants `*/read` across the subscription — view all resources and their configuration, but no data-plane access (no Key Vault secrets, no Storage blob contents, no database rows) and no mutations. |
Antimetal uses this access to list resources, read configuration and deployment state, query Azure Monitor metrics and Log Analytics (KQL), and read the Activity Log. Queries against databases (SQL, Cosmos, MySQL, PostgreSQL, Data Explorer) and Storage blob contents are only available if you separately grant the corresponding data-plane roles — Reader alone does not enable them.
If a Log Analytics workspace uses [workspace-level access control mode](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access#access-control-mode) (default for workspaces created before March 2019), additionally assign the **Log Analytics Reader** role at the workspace level. Workspaces created after March 2019 default to resource-context mode and do not require this.
Credentials are stored encrypted and rotated per your Entra app's secret expiration policy. Revoke access at any time by deleting the `antimetal-monitoring` app registration or removing its role assignments.
# Azure DevOps
Source: https://docs.antimetal.com/integrations/azure-devops
Create a read-only Personal Access Token for Antimetal
## Overview
This guide walks you through creating an Azure DevOps Personal Access Token (PAT) to enable the Antimetal integration for inspecting repositories, pull requests, work items, pipelines, wikis, and test plans.
Only connect this integration if your team uses Azure DevOps for source control, work items, or pipelines. It is not required for the [Azure](/integrations/azure) cloud integration.
Go to the Azure DevOps integration setup in the Antimetal dashboard.
## Prerequisites
* An Azure DevOps organization
* Permission to create Personal Access Tokens
* Access to the projects you want Antimetal to inspect
## Setup
In Azure DevOps, click your profile icon (top right) and select **User Settings > Personal Access Tokens**.
1. Click **+ New Token**
2. Fill in:
* **Name:** `Antimetal`
* **Organization:** the organization you want to connect
* **Expiration:** set according to your org's rotation policy
3. Under **Scopes**, select **Custom defined**
Select **Read** access only for each of the following scopes. See Microsoft's [Personal Access Tokens guide](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops) for full details.
* **Code** (Read)
* **Work items** (Read)
* **Build** (Read)
* **Test Management** (Read)
* **Wiki** (Read)
* **Project and team** (Read)
Do not enable any write, manage, or execute scopes.
Click **Create**, then copy the token value.
The token is only shown once. Copy it before leaving the page.
In the Antimetal UI, paste:
* **Organization URL:** `https://dev.azure.com/`
* **Personal Access Token:** the token you just created
Click **Connect**.
## Permissions and Access
Antimetal uses a read-only PAT scoped to the permissions below. No write operations are performed in your Azure DevOps organization.
| Scope | Access |
| ---------------- | ------------------------------------------------------------------ |
| Code | Read repositories, branches, pull requests, commits, file contents |
| Work items | Read work items, queries, iterations |
| Build | Read build definitions, runs, logs, artifacts |
| Test Management | Read test plans, suites, and results |
| Wiki | Read wiki pages and search |
| Project and team | Read project and team metadata |
Tokens are stored encrypted. Azure DevOps PATs have a maximum 1-year lifetime — rotate before expiration by creating a new token and updating the credential in Antimetal. Revoke access at any time by deleting the token from **User Settings > Personal Access Tokens**.
# CloudWatch
Source: https://docs.antimetal.com/integrations/cloudwatch
Set up an IAM Role with CloudWatch access for Antimetal
## Overview
This guide walks you through setting up an IAM Role with CloudWatch access to enable the Antimetal integration.
Go to the CloudWatch integration setup in the Antimetal dashboard.
## Prerequisites
* An AWS account
* A user account with permissions to create cross-account IAM Roles
## Setup
Navigate to **Integrations > CloudWatch > Connect** in the Antimetal dashboard, or use the link above. Antimetal generates a unique External ID for your organization automatically.
Click **Deploy Stack in AWS**. This opens the [CloudFormation quick-create page](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?stackName=AntimetalCloudWatchIntegration\&templateURL=https://antimetal-cloudformation-templates.s3.amazonaws.com/antimetal-cloudwatch-role.yaml\¶m_TrustedAccountId=379240662884) with the External ID and Trusted Account ID pre-filled in the template parameters.
To prevent Antimetal from accessing certain log groups, paste comma-separated log group ARNs in the **ExcludedLogGroups** field.
You can find ARNs in **CloudWatch Console > Log groups > \[select group] > Copy ARN**.
Scroll to the bottom and check the box confirming that the stack may create IAM resources.
Click **Create stack** and wait until the status shows `CREATE_COMPLETE`. Then go to the **Outputs** tab and copy the **Value** next to **RoleArn** — this is the Role ARN you'll paste into Antimetal.
Back in the Antimetal dashboard, paste the Role ARN, select your AWS region, and click **Add**. The External ID is pre-filled automatically.
## Update an existing integration
When Antimetal asks you to update your permissions, follow these steps:
1. Open [CloudFormation](https://console.aws.amazon.com/cloudformation/) in the AWS account and region where you created the Antimetal stack, then select that stack.
2. Choose **Update**, then **Replace existing template**. Select **Amazon S3 URL** and enter:
`https://antimetal-cloudformation-templates.s3.amazonaws.com/antimetal-cloudwatch-role.yaml`
3. Keep your existing **TrustedAccountId**, **RoleName**, and **ExcludedLogGroups** values. For **ExternalId**, select **Use existing value**.
4. Keep the remaining stack options, acknowledge IAM resource changes, review the proposed update, and choose **Update stack**.
5. Wait for `UPDATE_COMPLETE`. Your Role ARN stays the same, so you do not need to reconnect the integration in Antimetal.
## Resources
* [Video walkthrough](https://www.loom.com/share/d90db9a046374bcbbb9d13df0d105cdb?sid=67d3cfe4-dcff-4de7-a31d-5bcde43c68cf)
## Permissions and Access
Antimetal uses a read-only cross-account IAM Role provisioned via CloudFormation. No write operations are performed in your AWS environment.
# Datadog
Source: https://docs.antimetal.com/integrations/datadog
Generate API and application keys in Datadog for Antimetal
## Overview
This guide walks you through generating the necessary API and application keys in Datadog to enable the Antimetal integration.
Go to the Datadog integration setup in the Antimetal dashboard.
## Prerequisites
* A Datadog account with permissions to generate API keys
* Access to Organization Settings in Datadog
## Setup
Go to [Datadog](https://app.datadoghq.com), click on your user icon (bottom left), and select **Organization Settings**.
Click **API Keys** in the left sidebar, then select **New Key**. Name it `Antimetal`.
Save the secret API key securely — it won't be shown again.
Click **Application Keys** in the left sidebar, then click **New Key**. Name it `Antimetal`.
By default, the app key inherits the owner's permissions. To limit access, click **Edit Scopes** and grant read access to:
* APM
* Case and Incident Management
* Compliance
* Dashboards
* Error Tracking
* Events
* Log Management
* Metrics
* Monitors
* Service Level Objectives
* Synthetics
See the [full list of permissions](https://docs.datadoghq.com/account_management/rbac/permissions/).
Paste the keys and select your region in the Antimetal UI.
You can find your region by looking at your Datadog URL (e.g., `app.datadoghq.eu` for EU).
## Resources
* [Video walkthrough](https://www.loom.com/share/49f8c7ceb68e461db82d26f8bc21e40a?sid=0e1374cc-1e36-46b2-b9f1-ac5883412545)
## Permissions and Access
Antimetal uses read-only API and Application keys. No write operations are performed in your Datadog environment. Required scopes: APM, Metrics, Logs, Events, Monitors, Case & Incident Management.
# GCP
Source: https://docs.antimetal.com/integrations/gcp
Create a GCP service account for Antimetal monitoring
## Overview
This guide explains how to connect GCP to Antimetal for traces, logs, and metrics, and add optional permissions for cost optimization.
Go to the GCP integration setup in the Antimetal dashboard.
## Prerequisites
* A GCP account with permissions to create service accounts
* Access to IAM & Admin settings
* Admin access to the projects you want to monitor
## Setup
1. Go to [Google Cloud Console](https://console.cloud.google.com)
2. Navigate to the project where you do your monitoring/observability work
3. Go to **IAM & Admin > Service Accounts**
4. Click **+ CREATE SERVICE ACCOUNT**
5. Fill in the details:
* **Name:** `antimetal-monitoring`
* **ID:** `antimetal-monitoring`
* **Description:** `Service account for Antimetal monitoring integration`
6. Click **CREATE AND CONTINUE**
7. Copy the created service account email address
For each project you want to monitor (including the one where you created the service account):
1. Navigate to the target project
2. Go to **IAM & Admin > IAM**
3. Click **+ GRANT ACCESS**
4. In **New principals**, enter the service account email:
```
antimetal-monitoring@[YOUR-PROJECT-ID].iam.gserviceaccount.com
```
5. Assign these roles:
* `Monitoring Viewer` (roles/monitoring.viewer)
* `Logs Viewer` (roles/logging.viewer)
* `Cloud Trace User` (roles/cloudtrace.user)
* `Error Reporting Viewer` (roles/errorreporting.viewer)
* `Cloud Asset Viewer` (roles/cloudasset.viewer)
6. Click **Save**
7. Repeat for all projects you want to monitor
1. Go to **IAM & Admin > Service Accounts**
2. Click on your `antimetal-monitoring` service account
3. Go to the **Keys** tab
4. Click **ADD KEY > Create new key** with JSON format
Create the service account in your monitoring/observability project and add IAM bindings for each project you want to monitor, granting these roles:
* `roles/cloudasset.viewer`
* `roles/errorreporting.viewer`
* `roles/monitoring.viewer`
* `roles/logging.viewer`
* `roles/cloudtrace.user`
Create a JSON key for the service account. This can be done through IaC output or manually through the console.
### Configure the Antimetal integration
1. Navigate to the Antimetal GCP integration page
2. Upload or paste the contents of the downloaded JSON key file
3. Specify the project IDs you granted permissions to
### Required permissions summary
The service account will have these read-only permissions across your specified projects:
| Role | Access |
| ---------------------- | --------------------------------------------------------- |
| Monitoring Viewer | Read access to metrics and monitoring data |
| Logs Viewer | Read access to Cloud Logging data |
| Cloud Trace User | Read access to distributed tracing data |
| Error Reporting Viewer | Read access to error groups and events |
| Cloud Asset Viewer | Read access to cloud resource metadata and configurations |
## Cost optimization permissions (Beta)
These permissions help Antimetal identify unused or oversized infrastructure, assess existing commitments, and estimate potential savings using your resource usage and pricing.
To let Antimetal assess your GCP resources for cost-saving opportunities, add the permissions below to the service account created above or already connected to Antimetal. Reuse its existing JSON key and keep its current permissions.
### Project access
This role provides read-only access. It does not permit changing or deleting infrastructure.
Open **IAM & Admin > IAM** in each relevant project. Find the existing service-account email and click **Edit principal**, or select **Grant access** if it is not listed. Add the role below:
| Role | Where to grant it | What it enables |
| ----------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------- |
| Recommender Viewer (`roles/recommender.viewer`) | Projects included in the cost assessment | Read Google's optimization recommendations and supporting insights. |
Include projects that purchased resource-based commitments, even if they are outside the workload projects.
### Billing account access
Billing account access adds the commitment and pricing information that project access alone cannot provide:
* **Existing API-visible supported spend-based and flexible commitment orders:** the amount purchased, commitment term, and expiry. This helps estimate future commitment costs and account for commitments you already own where coverage is available.
* **Resource-based committed use discount (CUD) recommendations and insights:** Google's assessment of additional commitment opportunities across the billing account.
* **Customer-specific prices:** discover available SKUs and their current account-specific rates to estimate savings using your pricing rather than public list prices.
This supports commitment planning and estimated savings. It does not provide historical billed spend or a forecast of your total cloud bill.
A billing account administrator must grant the following roles to your existing Antimetal service account on each billing account included in the assessment.
Using an account with permission to create organization-level custom roles, open **IAM & Admin > Roles** and select the organization that owns the billing account. Create a custom role named **Antimetal Cost Viewer** with these permissions:
| Permission | What it enables |
| ----------------------------------- | ------------------------------------------------------------------------------------------------ |
| `consumerprocurement.orders.list` | List API-visible orders, including supported spend-based and flexible commitment orders. |
| `consumerprocurement.orders.get` | Read commitment amounts, terms, and expiry details for a supported API-visible commitment order. |
| `billing.billingAccountPrice.get` | Read the current account-specific price for an identified supported usage-rate SKU. |
| `billing.billingAccountSkus.list` | List account-visible SKUs and their metadata. |
| `billing.billingAccountPrices.list` | List current account-specific SKU prices in bulk. |
Create the role at **organization scope**, not project scope. Project-defined custom roles cannot be assigned to billing accounts. [Google's custom-role instructions](https://docs.cloud.google.com/billing/docs/how-to/custom-roles)
For each billing account, open **Billing**, select the account, and go to **Account management**. Add the existing service-account email as a principal and assign the applicable roles below. If it is already listed, edit its access without removing existing roles.
| Role | What it enables | Where to grant it |
| ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Antimetal Cost Viewer** (created above) | Read supported commitment orders, discover SKUs, and retrieve customer-specific prices. | Relevant billing account. |
| **Spend Based Commitment Recommender Viewer** (`roles/recommender.ucsViewer`, Beta) | Read spend-based CUD recommendations and supporting insights. | Relevant billing account. |
| **Billing Account Usage Commitment Recommender Viewer** (`roles/recommender.billingAccountCudViewer`, Beta) | Read resource-based CUD recommendations and supporting insights. | Billing account when commitment discounts are shared across projects. If discounts apply only to the purchasing project, use `roles/recommender.viewer` on that project instead, as described under Project access. |
Order access covers the billing account and can include other Marketplace purchases, not only CUDs. Account-price reads expose customer pricing through Google's Preview Pricing API.
In **APIs & Services > Library**, check that the following APIs are enabled. Enable only those that are missing.
* **Recommender API** (`recommender.googleapis.com`) for recommendations and insights
* **Cloud Commerce Consumer Procurement API** (`cloudcommerceconsumerprocurement.googleapis.com`) for existing commitment orders
* **Cloud Billing API** (`cloudbilling.googleapis.com`) for pricing
Provide Antimetal with the project IDs and billing account IDs accessible to this service account.
## Permissions and Access
The cost optimization roles add read-only resource, commitment, and pricing access to the monitoring integration. Antimetal does not use these permissions to change infrastructure or purchase commitments.
# GitHub
Source: https://docs.antimetal.com/integrations/github
Connect your GitHub repositories to Antimetal
## Overview
This guide walks you through connecting your GitHub repositories to enable the Antimetal integration.
Go to the GitHub integration setup in the Antimetal dashboard.
## Prerequisites
* A GitHub account with admin access to the repositories you want to connect
* Permission to install GitHub Apps in your organization
## Setup
Navigate to the Antimetal UI and click **Connect GitHub**. This will redirect you to GitHub to install the Antimetal app.
Choose whether to grant access to all repositories or select specific ones.
Review the requested permissions and click **Install & Authorize**.
You'll be redirected back to the Antimetal UI. Verify that your repositories appear in the integrations page.
## Permissions and Access
The Antimetal GitHub App pulls CI status, deploys, security alerts, and PR activity into investigations. Antimetal only opens a pull request when an engineer asks for one. See [Fixes](/product/fixes) for how that works.
### Repository
| Permission | Access |
| ---------------------- | -------------- |
| Actions | Read |
| Checks | Read and write |
| Code scanning alerts | Read |
| Commit statuses | Read |
| Contents | Read and write |
| Dependabot alerts | Read |
| Deployments | Read |
| Discussions | Read |
| Environments | Read |
| Issues | Read and write |
| Merge queues | Read |
| Metadata | Read |
| Pull requests | Read and write |
| Secret scanning alerts | Read |
### Organization
| Permission | Access |
| ------------------------------ | ------ |
| Members | Read |
| Organization custom properties | Read |
# Grafana
Source: https://docs.antimetal.com/integrations/grafana
Connect Grafana Cloud or a self-hosted Grafana instance to Antimetal
## Overview
This guide walks you through connecting Grafana to Antimetal. Antimetal queries Grafana and the data sources wired into it, including Prometheus, Loki, Tempo, and Pyroscope, so you do not need a separate connection for each data source.
Go to the Grafana integration setup in the Antimetal dashboard.
## Setup
Choose the tab that matches your Grafana deployment.
### Prerequisites
* A Grafana Cloud account with access to Loki, Tempo, or Prometheus
* Permissions to view data sources and create access policies
Go to [grafana.com/profile/org](https://grafana.com/profile/org) and select your organization.
From the left sidebar, go to **Connections > Data Sources** and click on your Loki, Tempo, or Prometheus instance.
* Copy the **URL** under Connection (e.g., `https://logs-prod-036.grafana.net`)
* Copy the **User** under Authentication (a numeric ID, e.g., `1264142`)
1. Scroll down to the **Access Policies** section
2. Click **Create Access Policy**
3. Enter a name (e.g., `Antimetal`)
4. Under Permissions, enable all read permissions
5. Click **Create Token**
Copy the token. It is shown only once.
Provide the following in the Antimetal UI:
| Field | Value |
| ------------ | ----------------------- |
| **URL** | The full URL you copied |
| **Username** | The numeric user ID |
| **Password** | The access policy token |
A self-hosted instance usually lives inside your own network. Before connecting, review [Self-Hosted Observability](/integrations/self-hosted-observability) to make it reachable by Antimetal.
### Prerequisites
* A self-hosted Grafana instance, reachable over HTTPS from Antimetal
* Permission to create a service account and token in Grafana
Note the base URL of your Grafana instance, for example `https://grafana.internal.example.com`.
In Grafana, go to **Administration > Service Accounts > Add service account**. Assign the **Viewer** role for read-only access, then add a token.
Copy the token when it is shown. It cannot be retrieved later.
Provide the following in the Antimetal UI:
| Field | Value |
| ------------------------- | ----------------------------- |
| **Grafana URL** | The base URL of your instance |
| **Service Account Token** | The Viewer-scoped token |
## Permissions and Access
Antimetal uses read-only access: a Viewer-scoped service account token for self-hosted instances, or a read-only access policy token for Grafana Cloud. No write operations are performed.
# Honeycomb
Source: https://docs.antimetal.com/integrations/honeycomb
Create a Honeycomb Management API key for Antimetal
## Overview
This guide walks you through creating a Honeycomb Management API key to enable the Antimetal integration. Antimetal uses the key to query your datasets, traces, and triggers through Honeycomb's MCP server.
Go to the Honeycomb integration setup in the Antimetal dashboard.
## Prerequisites
* A Honeycomb team with [Honeycomb Intelligence](https://docs.honeycomb.io/security-compliance/honeycomb-intelligence/) enabled
* Team owner permission, which is required to create a Management API key
## Setup
Log in to Honeycomb and go to **Account > Team Settings > API Keys**.
Click **Create Management API Key** and name it `Antimetal`.
Select the **Model Context Protocol** and **Environments** scopes, and grant **Read** on both. No write scopes are needed.
Copy both the **Key ID** and the **Key Secret**.
The secret is shown only once. Save it securely.
Provide the key in the Antimetal UI in `KEY_ID:KEY_SECRET` format.
Antimetal selects the US (`mcp.honeycomb.io`) or EU (`mcp.eu1.honeycomb.io`) endpoint automatically based on your account.
## Permissions and Access
Antimetal uses a read-only Management API key scoped to Model Context Protocol and Environments. It is restricted to listing and reading datasets, running queries, and analyzing columns. No write operations are performed.
# Incident.io
Source: https://docs.antimetal.com/integrations/incident-io
Create an API key in Incident.io for Antimetal
## Overview
This guide walks you through creating an API key in Incident.io to enable the Antimetal integration.
Go to the Incident.io integration setup in the Antimetal dashboard.
## Prerequisites
* An Incident.io account with a Team subscription
* Permission to generate API keys
## Setup
Navigate to **Settings > API Keys**.
Click **Add New** and name the key `Antimetal`.
Enable the following permissions:
* View data, like public incidents and organisation settings
* View all incident data, including private incidents
* View catalog types and entries
* View all incident data, including private incidents, and manage incident memberships
* Read schedules
Click **Create**. On the next page, copy the API key.
This will only be shown once. Save it securely.
Paste the token in the Antimetal UI.
## Permissions and Access
Antimetal uses a read-only API key scoped to incidents, catalog entries, schedules, and organization data.
# Integrations Overview
Source: https://docs.antimetal.com/integrations/overview
Connect Antimetal to your existing tools and workflows
Connect Antimetal to the platforms your team already relies on. Antimetal pulls data from your cloud providers, monitoring tools, and source control to investigate, fix, and prevent production issues.
## How Integrations Work
All integrations are set up in the [Antimetal dashboard](https://overlook.antimetal.com/integrations). Some integrations require additional configuration in the third-party tool. Those have dedicated setup guides linked below.
## Monitoring and Observability
Metrics, logs, and incident data.
Dashboards, alerting, and data sources. Cloud or self-hosted.
Error and event data.
Logs, metrics, traces, and synthetics.
Distributed tracing and telemetry.
Log search and analysis.
Log aggregation and querying.
Metrics collection and alerting.
Log querying with LogsQL.
Prometheus-compatible metrics. Self-hosted or Cloud.
Distributed tracing.
Uptime monitoring and telemetry.
Product analytics and feature flags.
Search and analyze indices and clusters.
Error monitoring and stability tracking.
Application performance monitoring.
Product analytics and user behavior.
Log management and analytics.
Cloud-native observability.
Log analytics and monitoring.
Full-stack observability.
Logging and observability.
Log management and analysis.
## Cloud and Infrastructure
AWS CloudWatch logs and metrics.
Google Cloud traces, logs, and metrics.
Azure resources, Monitor metrics, and Log Analytics.
Analytics, monitoring, and observability.
AI Gateway logs, prompts, and responses.
DNS performance analysis and configuration.
Log streaming and analytics.
Deployments and hosting.
Cloud application hosting.
GitOps continuous delivery for Kubernetes.
## Incident Management
Incidents, services, and on-call schedules.
Incident data and schedules.
Incident management and response.
Alerting and incident management.
Monitoring and incident management.
## CI/CD
Pipelines, builds, and deployments.
Continuous integration and delivery.
Repos, pull requests, pipelines, work items, wikis, and test plans.
Feature flags and experimentation.
## Project Management
Issue tracking and project management.
Task management and project tracking.
Jira issues and project management.
Tasks, docs, and project management.
Project management for software teams.
## Security
Endpoint security and threat intelligence.
## Databases
Queries, schemas, and aggregations.
Database management, migrations, and auth.
Search and analyze indices.
MySQL database queries.
Serverless Postgres.
Serverless Redis and Kafka.
Managed PostgreSQL, Kafka, and ClickHouse.
Kafka topics, connectors, and schemas.
## Source Control
Repositories, pull requests, and CI/CD pipelines.
## Chat
Investigate alerts in real time via the Antimetal Slackbot.
Customer support tickets and conversations.
## Developer Tools
Pages, databases, and content.
Enterprise knowledge base.
Debug recordings with video and logs.
Meeting transcripts and summaries.
Service catalog and scorecards.
Service ownership and maturity.
Customer messaging and campaigns.
## All Integrations
For the full list, visit [antimetal.com/integrations](https://antimetal.com/integrations).
# PagerDuty
Source: https://docs.antimetal.com/integrations/pagerduty
Connect PagerDuty to Antimetal
## Overview
This guide walks you through connecting PagerDuty to Antimetal using a User API Token.
Go to the PagerDuty integration setup in the Antimetal dashboard.
## Prerequisites
* A PagerDuty account
* Permission to generate User API Tokens
## Setup
In PagerDuty, click your user profile icon, then select **My Profile** and **User Settings**.
In the **API Access** section, click **Create API User Token** and follow the prompts.
Copy the token and store it securely. It will only be shown once.
Paste the token in the Antimetal UI.
## Permissions and Access
Antimetal connects to PagerDuty with read-only access. No write operations are performed in your PagerDuty environment. Antimetal reads incidents, services, schedules, on-call data, and log entries to support investigation and root cause analysis.
# Self-Hosted Observability
Source: https://docs.antimetal.com/integrations/self-hosted-observability
Connect Antimetal to observability tools you host yourself, such as Grafana, Victoria Logs, Victoria Metrics, Prometheus, and Pyroscope
## Overview
Most observability vendors are SaaS, so Antimetal reaches them directly over their public API. Tools you host yourself are different: they usually live inside your own network or VPC and are not reachable from the public internet.
For these, Antimetal runs a dedicated, read-only connector for your organization. You provide the instance URL and a read-only token, and the connector queries that instance on your behalf. This page covers what the connectors need and how to make a private instance reachable.
It applies to:
* [Grafana (self-hosted)](/integrations/grafana)
* [Victoria Logs](/integrations/victoria-logs)
* [Victoria Metrics](/integrations/victoria-metrics)
* Prometheus and Pyroscope, when accessed as Grafana data sources
If you use a managed version of any of these (for example Grafana Cloud), follow the [Grafana](/integrations/grafana) guide instead. Managed instances are reached over their public endpoint and need no reachability setup.
## What the connector needs
Every self-hosted connector requires two things:
| Requirement | Detail |
| ------------------- | ------------------------------------------------------------------------------------ |
| **Instance URL** | The HTTPS endpoint of your instance, reachable from the Antimetal connector. |
| **Read-only token** | A bearer token or service account scoped to read only. Antimetal performs no writes. |
The connector only ever issues read queries. The specific tools it can call are restricted to a read-only allowlist per integration.
## Making a private instance reachable
If your instance is not exposed to the public internet, choose one of the following. You can start narrow and expand later.
Expose the instance over HTTPS, require the read-only token on every request, and restrict inbound access to Antimetal's egress IP. Traffic is encrypted in transit and authenticated, and only Antimetal's address can reach the endpoint.
Allowlist Antimetal's egress IP: `44.195.180.21/32`. This is a single static address, so it is safe to pin in your firewall rules.
To keep traffic off the public internet entirely, contact us at [support@antimetal.com](mailto:support@antimetal.com) to discuss private networking options such as a VPN or a private link between your network and the Antimetal connector.
## Permissions and Access
The connector uses a read-only token and is restricted to a read-only tool allowlist. No write or ingestion operations are performed. See each tool's page for the exact scope.
# Sentry
Source: https://docs.antimetal.com/integrations/sentry
Set up an internal integration in Sentry for Antimetal
## Overview
This guide walks you through setting up an internal integration in Sentry to enable the Antimetal integration.
Go to the Sentry integration setup in the Antimetal dashboard.
## Prerequisites
* A Sentry account with access to your organization's Settings
* Permission to create Internal Integrations
## Setup
Log in to [Sentry](https://sentry.io), click **Settings** in the navigation bar. Under **Integrations**, click **Create New Integration**, select **Internal Integration**, and click **Next**.
Name it `Antimetal` and grant read access to the following scopes:
* `project:read`
* `team:read`
* `issue & event:read`
* `organization:read`
* `member:read`
* `alerts:read`
Click **Save Changes**.
On the **Edit Internal Integration** page, scroll down to the authentication token section and click **Create New Token**.
Save the token securely — it won't be shown again.
Paste the token and your organization slug in the Antimetal UI.
You can find your organization slug in your general organization settings.
## Permissions and Access
Antimetal uses a read-only internal integration token scoped to projects, teams, issues, events, organization info, members, and alerts.
# Slack
Source: https://docs.antimetal.com/integrations/slack
Investigate alerts and get weekly digests, directly in Slack
## Overview
The Antimetal Slackbot connects to your Slack workspace and works in two ways:
* **Investigations** — when an alert fires in a connected channel, Antimetal posts a root cause analysis automatically or on demand, with suggested fixes
* **Weekly digest** — every Monday, Antimetal posts a plain-language recap of last week's alerts to a channel of your choice
AI-generated responses may occasionally be inaccurate or incomplete. Always verify suggested actions before applying them to production systems.
## Setup
**Prerequisites:** A Slack workspace where you have permission to install apps, and at least one alert channel where the bot should operate.
From the Antimetal dashboard, navigate to **Settings > Integrations** and click **Connect Slack**. You'll be redirected to Slack to authorize the app in your workspace.
Connect your Slack workspace from the Antimetal dashboard.
Invite `@Antimetal` to your alerts channel:
```bash theme={null}
/invite @Antimetal
```
You can also invite it from the channel's member settings.
Once added, the bot will post a welcome message in the channel confirming it's active and ready to investigate alerts.
## Investigations
### Auto-investigations
Auto-investigations run automatically when an alert fires in a channel where `@Antimetal` is present. You enable them per alert, not per channel.
In the Antimetal dashboard, navigate to **Settings > Issues** and select the alert you want to automate.
Toggle on **Auto-investigate** for that alert.
When the alert fires, Antimetal will automatically trigger an investigation and post the results in the thread.
### Manual investigations
Reply to any alert thread with `@Antimetal` to trigger an on-demand investigation. The bot detects the mention and runs a root cause analysis on that alert.
```
@Antimetal
```
## Weekly digest
Antimetal turns a week of noisy alerts into a short, prioritized list of what actually broke, delivered to your chosen channel every Monday at 9 AM Eastern.
Most monitoring fires hundreds of alerts a week. Flapping monitors, staging failures, P3 infrastructure warnings, and third-party analytics make up most of them. The digest suppresses that noise and groups the rest by root cause, so security incidents, broken auth, and complete feature failures surface first. Group names and vocabulary adapt to your product using your org's own rules, so the digest reads in terms of what your users were doing instead of the stack that failed underneath.
The digest is driven by the `/digest` slash command. Run it from any channel in your workspace.
### Enabling the digest
In the channel where you want digests delivered, run:
```
/digest setup
```
Antimetal confirms the delivery channel and the recurring schedule. The first digest posts on the next scheduled Monday. Run `/digest run` if you want a preview immediately.
### Commands
| Command | What it does |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `/digest` | Shows whether the digest is configured and, when it is, lists the commands available to you. |
| `/digest setup` | Sets the current channel as the delivery destination and turns on the weekly schedule. Run again in a different channel to move the destination. |
| `/digest run` | Triggers an immediate one-off digest for the past 7 days. Posts to the configured delivery channel. |
| `/digest off` | Stops the weekly schedule and removes the delivery channel. Run `/digest setup` in any channel to re-enable. |
All responses are ephemeral. Only the user who ran the command sees the acknowledgement. The digest itself posts publicly to the configured delivery channel.
## Permissions
The Antimetal Slackbot requests the following OAuth scopes:
| Scope | Purpose |
| ------------------- | ---------------------------------------------------------------------------------- |
| `app_mentions:read` | Respond when mentioned in channels |
| `channels:history` | Read alert messages in public channels |
| `channels:join` | Join public channels when invited |
| `channels:read` | List available channels |
| `chat:write` | Post investigation results and remediation steps |
| `commands` | Register the `/digest` slash command for configuring and triggering weekly digests |
| `files:read` | Read files shared in conversations |
| `groups:history` | Read messages in private channels the bot is in |
| `groups:read` | List private channels the bot is invited to |
| `groups:write` | Manage private channels the bot is in |
| `im:history` | Read direct messages with the bot |
| `im:read` | View direct message conversations |
| `im:write` | Send direct messages (for onboarding DMs when a user opens the Messages tab) |
| `mpim:read` | View multi-party direct message metadata |
| `reactions:read` | Read message reactions |
| `reactions:write` | Add reactions to messages |
| `usergroups:read` | View user groups |
| `users:read` | View user profiles |
| `users:read.email` | View user email addresses |
The bot has no access to channels it hasn't been explicitly invited to. Slack message content is not persisted — lightweight metadata (alert identifiers, investigation status) may be temporarily retained for tracking purposes.
## Support
If you run into any issues with the Antimetal Slack integration, contact us directly at [support@antimetal.com](mailto:support@antimetal.com). We're here to help with installation, configuration, or anything else.
# Vercel
Source: https://docs.antimetal.com/integrations/vercel
Connect your Vercel account to Antimetal for deployment monitoring and runtime log analysis
## Overview
This guide walks you through connecting your Vercel account to Antimetal. Once connected, Antimetal can monitor your deployments, analyze build logs, and investigate runtime errors across all your Vercel projects.
Go to the Vercel integration setup in the Antimetal dashboard.
## Prerequisites
* A Vercel account with permissions to create access tokens
* If using Vercel Teams, your team slug (found in your team's URL: `vercel.com/`)
## Setup
Go to [Vercel Access Tokens](https://vercel.com/account/settings/tokens) and click **Create**.
* **Token Name**: `Antimetal`
* **Scope**: Select **Full Account** to allow Antimetal to access all teams and projects, or scope to a specific team
* **Expiration**: Choose an expiration that fits your security policy
Save the token securely — it won't be shown again.
Paste your access token in the Antimetal dashboard integration page.
We recommend entering your Vercel team slug to scope queries to the right team. This is the value in your team's URL: `vercel.com/`.
## What Antimetal Can Access
Once connected, Antimetal can:
* **List teams** — Discover all Vercel teams associated with your account
* **List projects** — Browse projects within a team
* **Get project details** — View project configuration and settings
* **List deployments** — Track deployment history and find failures
* **Get deployment details** — Investigate individual deployment status and metadata
* **Retrieve build logs** — Debug why deployments failed during the build step
* **Query runtime logs** — Search and filter production runtime logs by status code, source, time range, and more
## Permissions and Access
Antimetal uses your access token for **read-only** operations. No deployments are triggered, no settings are modified, and no data is written to your Vercel account.
# Victoria Logs
Source: https://docs.antimetal.com/integrations/victoria-logs
Connect your VictoriaLogs instance to Antimetal
## Overview
This guide walks you through connecting a VictoriaLogs instance to Antimetal. Antimetal runs a dedicated read-only connector that queries your instance using LogsQL.
Go to the Victoria Logs integration setup in the Antimetal dashboard.
VictoriaLogs is self-hosted only today (Cloud support is on the VictoriaMetrics roadmap). It usually lives inside your own network, so before connecting, review [Self-Hosted Observability](/integrations/self-hosted-observability) to make it reachable by Antimetal.
## Prerequisites
* A running VictoriaLogs instance, reachable over HTTPS from Antimetal
* A read-only bearer token if your instance requires authentication
## Setup
Note the base URL of your VictoriaLogs instance, for example `https://vmlogs.internal.example.com`.
If your instance is protected, provision a bearer token scoped to read-only query access.
| Field | Value |
| -------------------- | ------------------------------------------------------------- |
| **VictoriaLogs URL** | The base URL of your instance |
| **Bearer Token** | Read-only token (optional if the instance is unauthenticated) |
## Permissions and Access
Antimetal uses a read-only connector restricted to query and exploration tools (`query`, `hits`, `facets`, field and stream listings, and `stats_query`). VictoriaLogs exposes no write or ingestion tools, and none are enabled.
# Victoria Metrics
Source: https://docs.antimetal.com/integrations/victoria-metrics
Connect VictoriaMetrics (self-hosted or Cloud) to Antimetal
## Overview
This guide walks you through connecting VictoriaMetrics to Antimetal. Antimetal runs a dedicated read-only connector that queries your instance using PromQL and MetricsQL.
Go to the Victoria Metrics integration setup in the Antimetal dashboard.
## Setup
Choose the tab that matches your deployment.
A self-hosted instance usually lives inside your own network. Before connecting, review [Self-Hosted Observability](/integrations/self-hosted-observability) to make it reachable by Antimetal.
### Prerequisites
* A running VictoriaMetrics instance, reachable over HTTPS from Antimetal
* Whether your deployment is single-node or cluster
* A read-only bearer token if your instance requires authentication
Note the base URL of your instance, for example `https://vm.internal.example.com`, and whether it runs as `single` or `cluster`.
| Field | Value |
| ----------------------- | ------------------------------------------------------------- |
| **VictoriaMetrics URL** | The base URL of your instance |
| **Instance Type** | `single` or `cluster` |
| **Bearer Token** | Read-only token (optional if the instance is unauthenticated) |
### Prerequisites
* A VictoriaMetrics Cloud account
* An API key with read access
In the VictoriaMetrics Cloud console, create an API key with read access.
Provide the **Cloud API Key** in the Antimetal UI. No instance URL is required in Cloud mode.
VictoriaMetrics is Prometheus-compatible, so existing Prometheus queries work directly.
## Permissions and Access
Antimetal uses a read-only connector restricted to query and inspection tools (`query`, `query_range`, `labels`, `series`, `rules`, `alerts`, TSDB status, and, in Cloud, deployment and region inspection). No write operations are performed.
# Fixes
Source: https://docs.antimetal.com/product/fixes
Review a proposed fix, run it yourself, or open a PR straight from Antimetal
When an investigation finishes, Antimetal proposes one or more fixes on the **Fixes** tab of the issue. Antimetal does not apply fixes on your behalf. Every fix is reviewed and shipped by an engineer.
![Fixes tab on an issue]()
## What a fix looks like
A fix is one or more steps with rationale — a CLI command, a config change, a code change, or a mix of these.
Every issue produces both an immediate and a comprehensive fix:
| Category | What it solves |
| ----------------- | -------------------------------------------------------------------------------------------- |
| **Immediate** | The active symptom. Stops the bleeding so the issue isn't compounding while you investigate. |
| **Comprehensive** | The root cause. Prevents the issue from recurring. |
![Fix detail with rationale, numbered steps, and a CLI snippet]()
## Executing a fix yourself
Use the copy button on a code block to grab a snippet and run it from your terminal, admin console, or pipeline. The **Open in** menu at the top of the fix sends the full plan to your coding agent of choice. Antimetal does not run CLI commands or hit provider APIs for you.
## Opening a PR
🧪 **PR creation is experimental.** Engineers are responsible for validating every change before merging. Antimetal will never merge for you.
When a fix includes a code change, you can ship it as a PR directly from Antimetal. Before generating the change, Antimetal reads your `AGENTS.md`, `CLAUDE.md`, and any Cursor or Copilot rules files in the repo, alongside its memory of your system and past incidents — so the change follows your team's code style and conventions.
Antimetal does not run your tests or builds against the fix. Validate the change locally or in CI before merging.
![Side-by-side diff viewer]()
The action menu gives you two paths: ship the PR (or a draft) straight from Antimetal, or take the diff to your own editor or coding agent.
![Create PR action menu with Codex, Cursor, Devin, and GitHub Copilot options]()
**Ship from Antimetal**
* **Create PR** opens a pull request on your repo, branching from the default branch. Requires the [GitHub integration](/integrations/github). Once it's open, treat it like any other PR: push more commits, rebase, or rewrite the diff.
* **Create draft PR** does the same as a draft, so reviewers aren't pinged while you tighten things up. Mark it ready when it's where you want it.
**Take it to your editor**
* **Open in Codex / Cursor / Devin / GitHub Copilot** hands the fix and its context off directly so you can keep iterating in your editor.
* **Copy fix as prompt** copies the fix and surrounding context as a prompt you can paste into any IDE or coding agent.
### What an Antimetal PR looks like
* The PR is authored by `antimetal[bot]`, so reviewers can tell at a glance that the change came from an agent.
* Antimetal tags matching `CODEOWNERS` and assigns a directly responsible engineer for the change, picked by scoring each contributor's history with the affected code paths.
![Example Antimetal PR authored by antimetal[bot]]()
### How to respond to an Antimetal PR
When an Antimetal PR lands in your queue, you have four paths:
* **Approve and merge** if the diff is correct as-is.
* **Take it over the line** by adding commits, rebasing, or rewriting parts of the diff before merging.
* **Request changes** if the approach is right but the diff isn't. Leave inline review comments and add any context you have — feedback on what's off or what the agent missed helps Antimetal learn.
* **Close as not relevant** if the underlying issue no longer applies or the agent misread the situation.
# Issue Lifecycle
Source: https://docs.antimetal.com/product/issue-lifecycle
How issues move from alert to resolution in Antimetal
Issues are the core unit of work in Antimetal. Each issue represents something worth investigating: an alert from your monitoring stack, something Antimetal surfaced on its own, or a question you asked directly.
## How issues get created
**From alerts.** When an alert fires in a connected platform (Datadog, Sentry, PagerDuty, CloudWatch, etc.), Antimetal creates an issue and begins investigating automatically.
**From search.** Ask anything about your infrastructure, services, or systems and kick off an investigation from what you find.
**From chat.** Describe a problem directly in Antimetal to create an issue and start an investigation.
Multiple alerts can map to the same issue. Antimetal groups related signals together.
## Issue statuses
| Status | What it means |
| ----------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Investigating** | Antimetal is actively gathering evidence and building a root cause analysis. Default state when an issue is created. |
| **Ready to fix** | Investigation complete. Root cause, findings, and remediation steps are available. |
| **Resolved** | Marked as fixed by your team. |
| **Muted** | Acknowledged but deprioritized. If a new alert fires for a muted issue, it will reopen. |
Antimetal automatically moves issues from **Investigating** to **Ready to fix** when the investigation completes. Resolved and Muted are set manually.
## Managing issues
The [issues board](https://overlook.antimetal.com/issues) is your control plane for managing all issues in one place. Issues are organized by status in a kanban view, and you can search and filter by status or environment.
## The investigation
Antimetal runs an automated investigation:
1. **Evidence collection.** Queries your connected platforms for logs, metrics, traces, events, and code relevant to the incident.
2. **Causal analysis.** Analyzes collected evidence, builds hypotheses, and tests them against the data.
3. **Root cause report.** Produces a summary of what's happening, why, and the supporting findings.
4. **Remediation.** Generates immediate fixes to get your systems back up, long-term root cause fixes, and preventative recommendations.
5. **Causal tree.** Builds a visual graph showing how issues propagate through your system.
You can follow the entire investigation live on the **Steps** tab, watching agent actions, queries, and proposed fixes as they happen in real time.
## Chat
Chat is always available on any issue. You can ask Antimetal questions about the issue, how it relates to other issues, provide additional context, or direct the investigation.
## Answers
The primary view once an investigation completes.
* **What's happening.** Plain-language summary of the incident.
* **Root cause.** The identified cause with an explanation of why it's happening.
* **Findings.** Individual pieces of evidence discovered during the investigation. Each finding links to the underlying data in your provider. Findings are categorized as cause, symptom, or ruled out.
The investigation also shows how many potential causes were ruled out.
## Fixes
Remediation actions surfaced once the investigation completes. **Immediate** fixes are step-by-step suggestions you run yourself (monitor or alert tweaks, CLI commands). **Comprehensive** fixes propose a code change with a diff you can ship as a PR or hand off to a coding agent. See [Fixes](/product/fixes) for what's supported today.
## Steps
A live view of the investigation's chain of thought. Each step is expandable, showing the full input and output: what Antimetal queried, what data came back, and how it reasoned about the evidence.
## Causal Tree
A visual graph showing how issues propagate through your system. Maps out which symptoms led to which causes, what was ruled out, and how everything connects.
## Versions
Each time an investigation is regenerated or new evidence meaningfully changes the analysis, Antimetal creates a new version with a summary of what changed. You can switch between versions to see how the analysis evolved.
# Search
Source: https://docs.antimetal.com/product/search
Ask anything about your infrastructure, services, and systems
Search is how you ask questions and explore your infrastructure in Antimetal. Instead of switching between monitoring tools, run a natural-language query and get answers grounded in real data from your connected platforms.
## How it works
Go to [Search](https://overlook.antimetal.com/chats/new) and type a question about your infrastructure. Antimetal queries your connected platforms, including logs, metrics, traces, events, and code, and returns an answer with supporting evidence.
Examples of things you can search:
* "What's the p99 latency for the payments service?"
* "Are there any errors in the auth service logs from the last hour?"
* "What changed in the checkout service since yesterday?"
* "How much CPU is the API gateway using?"
## Starting an investigation from search
If search surfaces something that needs attention, you can create an issue directly from the results. This kicks off a full [investigation](/product/issue-lifecycle#the-investigation) with root cause analysis and remediation steps.
## Data sources
Search pulls from every platform you've connected to Antimetal. The more [integrations](/integrations/overview) you have, the more complete your results will be.
# Skills
Source: https://docs.antimetal.com/product/skills
Use Antimetal directly from your AI coding tools
Antimetal's plugin lets you interact with your infrastructure investigations, search, and issue management without leaving your AI coding tools. Any MCP-compatible client can connect.
## What you can do
With the Skills integration, your AI tools can:
* **Search your infrastructure.** Run natural-language queries across all connected platforms, the same way [Search](/product/search) works in the Antimetal dashboard.
* **Investigate issues.** Trigger and follow investigations with root cause analysis and remediation steps.
* **Manage issues.** Create, view, and update [issues](/product/issue-lifecycle) directly from your editor or terminal.
* **Query your data.** Pull logs, metrics, traces, and events from your connected integrations.
### Skills
* **`/investigate`** — Entry point for any software problem. Searches issues, queries Antimetal's AI, reads investigative reports and causal graphs, and routes to fix.
* **`/fix`** — Apply Antimetal's remediation to your codebase, adapted for your local environment.
* **`/antimetal-mcp-setup`** — Configure the MCP connection (OAuth or API key).
## Getting set up
Make sure you've connected the platforms you want Antimetal to query. See [Integrations](/integrations/overview) for the full list.
Within a Claude Code session, add the Antimetal marketplace and install the plugin:
```bash theme={null}
/plugin marketplace add antimetal/skills
/plugin install antimetal
```
The first time you use an Antimetal tool or skill, Claude Code will open a browser window to log in to your Antimetal account via OAuth. Tokens are stored securely and refreshed automatically.
Install from the [Cursor Marketplace](https://cursor.com/marketplace) by searching for **Antimetal**, or use the command palette:
```bash theme={null}
/add-plugin antimetal/skills
```
Cursor uses an API key for authentication:
1. Generate an API key from [API Keys Settings](https://overlook.antimetal.com/settings/api-keys).
2. Set the environment variable in your shell profile (`~/.zshrc`, `~/.bashrc`, etc.) so it persists:
```bash theme={null}
export ANTIMETAL_API_KEY="your-api-key-here"
```
3. Restart Cursor to pick up the environment variable.
Antimetal's MCP server is available at `https://mcp.antimetal.com`. See the [setup instructions](/connect) for configuration specific to your client:
* [VS Code](/connect#vs-code)
* [Claude Desktop](/connect#claude-desktop)
* [Windsurf](/connect#windsurf)
* [Codex](/connect#codex)
## Example prompts
```
Investigate the login latency spike from this morning
What are the open high severity issues?
Apply the remediation for the Redis connection timeout issue
What services had the most errors last week?
Triage my current incidents
```
# Quick Start
Source: https://docs.antimetal.com/quick-start
Get up and running with Antimetal
## Prerequisites
* You have connected all your [integrations](/integrations/overview).
## Search with Antimetal
You can ask Antimetal broad questions related to your infrastructure and architecture. Antimetal will leverage the rich understanding it has about your system to give you an answer.
![Search]()
## Investigate an Issue
In order for a new issue to show up on the issues page, kick off an investigation against an alert in [Slack](/integrations/slack).
### Live View
As the investigation is on-going, you will be presented with Antimetal's live chain of thought, giving you clear insight into its reasoning.
![Investigation chain of thought]()
The inputs and outputs to all tool calls are directly accessible, enabling you to understand exactly what data Antimetal is pulling in.
![Tool call inputs and outputs]()
### Answers
Once the investigation is complete, you will be directed to the Answers tab, where you will be given clear insight into what happened, the root cause (with an Antimetal confidence score) and a Causal Graph, to highlight the reasoning pathway that Antimetal took to arrive at its conclusion.
![Answers tab with root cause and causal graph]()
Antimetal also presents findings, which directly support its root cause diagnosis. Once again, these findings are completely auditable. They represent the data deemed most relevant to the root cause, and is only a small portion of the data that Antimetal looked over.
![Findings]()
### Fixes
The fixes tab contains remediations proposed by Antimetal to address the root cause.
![Fixes tab]()
Each fix contains a detailed explanation, as well the ability to copy it as a prompt or open it in your IDE.
![Fix detail with IDE options]()
### Chat
If you want to ask a question about the report, or add more context, you can do so through the chat experience. You can also choose add more context for Antimetal to use to regenerate the investigation.
![Chat interaction]()