The AI that investigates your stack, from inside it

Most AI features in observability connect to your telemetry through APIs and send it to an external LLM, meaning your production logs, traces, prompts, and often cloud credentials are shared with multiple third parties. groundcover Agent Mode is different. It runs on the LLM service in your own cloud account and analyzes telemetry where it already resides. Nothing leaves your environment because that's how the product is architected, not an optional deployment model. The result is AI that fits existing security and compliance requirements without introducing another vendor into your trust chain.

An AI agent is only as good as the data it can see. Tools built on OpenTelemetry can only answer questions about services that were manually instrumented, which is never the complete picture. groundcover deploys an eBPF sensor at the kernel, capturing automatic telemetry across every service, database connection, and network call without any developer instrumentation. This lets the agent answer questions that manual instrumentation makes impossible: which services are talking to each other, what databases are running, what changed in the last hour. The data advantage is structural and no competitor can replicate it without rebuilding their instrumentation layer from scratch.

Yes. Most AI agents in observability are incident-triggered and only activate when an alert fires. groundcover's agent supports open-ended investigation: questions without a pre-existing monitor, incident ticket, or known failure state. This covers the majority of day-to-day engineering work, from exploring unusual patterns and validating a deployment to understanding why a specific service is slow for one customer but not others. The agent is designed for daily use, not just on-call firefighting.

Every signal groundcover collects, including logs, traces, metrics, and events, is enriched with a cross-signal identifier at ingest. The agent walks through them and connects the dots automatically. It sees container images, environment variables, DNS usage, traffic patterns, and inter-service connections. From that data alone it infers what each service does, who it talks to, and what normal behavior looks like. No one needs to document the topology manually. The agent builds it from data it already has and refines it over time. One customer recently described spending weeks building a manual topology map so their SRE agent could function. groundcover generates that automatically.

‍

GCQL is groundcover's unified query language, a single interface for querying logs, metrics, traces, events, entities, and monitors. Most observability platforms accumulate a different query model for each data type, which means an AI agent has to know which interface to use, translate between them, and reassemble the results. groundcover's agent learns one language, not seven. Every query it runs is visible in the relevant product page and can be modified, saved as a monitor, or turned into a dashboard widget. The agent teaches you to do what it did. Nothing is a black box.

Agent Mode output creates first-class groundcover assets: dashboards, monitors, gcQL queries, and OTTL pipelines. Everything Agent Mode builds uses the same schema as the rest of the platform, so outputs are immediately usable and not exports that need to be reformatted or re-entered. Every tool call is visible in the relevant product page. Agent Mode can also run background jobs during off-hours, auto-generating service topology maps, daily incident summaries, and suggested configuration changes, all surfaced for review before anything is applied.

The groundcover Agent Mode is included in Pro, Enterprise, and OnPrem plans with no AI surcharge. You pay your own LLM token costs directly at cost with no groundcover markup. Quota budgets can be set per user or team to keep usage predictable. Visit our pricing page for more information.

‍