ecko
Alert triage and incident summarisation
A single binary drops onto a host with no Python environment to maintain and no dependency drift.
The problem
On-call receives a wall of alerts. A summariser groups related firings, pulls recent deploys, and drafts a timeline. Ops teams have been burned by "just run this small Python script on the bastion" that broke when someone upgraded pip six months later.
Why Ecko
- Static binary
- Copy one file, set env vars, run under systemd. Uninstall is delete the file.
- Mock mode for runbooks
- Test summarisation logic against recorded alert JSON in CI. On-call changes do not ship untested.
- HTTP and JSON stdlib
- Fetch dashboards and post to Slack without importing half of PyPI.
In practice
fn summarise(alerts: list(Alert)) -> str {
ai "Group and timeline these alerts" from json_encode(alerts)
}
# scp oncall.ecko bastion:/usr/local/bin/
# ECKO_API_KEY=... oncall.ecko /var/alerts/current.json
Try it on your workload.