Production alerts investigated before you wake

An agent that watches the monitoring alerts in Slack, finds the team that owns the code, investigates the root cause from tickets, builds and logs, and offers a pull request for an engineer to review, as Carvana runs it with Claude Tag

The problem

A small software team or an agency that runs systems for clients gets alerts from its monitoring tools at all hours, and every one starts the same way: someone opens the logs, finds the last deploy, and works out who owns the code. The first thirty minutes of each incident are detective work that nobody wants to do at 2 am.

How the agent works

1. It starts

   The agent watches the alert channels in Slack.

2. The agent works

   When an alert lands it identifies the team that owns the affected code and tags them, then investigates on its own with read access to work tickets, build history, the code and the data warehouse, through an identity scoped to that team. For a release it compares errors, warnings and log volume against a baseline from the hour before the release, a comparison that lives as a skill in the team's repo next to the runbooks and alert notes. It posts a root cause analysis in the thread in the team's preferred format. In the same thread an engineer can ask it to open a pull request from the analysis; the engineer reviews the pull request before anything reaches production, and sometimes the right outcome is a filed ticket or no fix at all.

3. The result

   Some teams also schedule it to run hourly checks on pipelines and feature flags.

Worked example

Anthropic's case study on Carvana describes Claude Tag, which replaced two homegrown Slackbots. The wholesale platform team tested it for two weeks in its intake and alert channels across five cases, with read only access to tickets, build history and code, and reports that it reduced the time to reach an answer by 65%. In the retail science team's channel, alert volume declined 56% after Claude Tag began resolving root causes. In one weekend case it opened a pull request to add logging because the existing logs could not explain a deployment. Claude Tag defaults to Opus 5, per the study. Carvana is a large company; the pattern itself needs only a Slack channel, a repo and scoped read access.

Sources

• https://claude.com/customers/carvana