What it does
Horus connects runtime evidence with source-code intelligence. Runtime evidence includes logs, metrics, queue state and database snapshots. The command horus init checks prerequisites, registers the project, indexes the repository and builds the queue map. Runtime connectors are optional, and they add evidence coverage. The command horus investigate runs a deterministic investigation for an incident hint such as "checkout latency spike". The structured report contains ranked suspected causes, hypotheses, evidence, evidence gaps, next actions and a reconstructed timeline. The command horus replay re-renders a saved report. A postmortem command drafts Markdown. Connectors are read-only and project-scoped. The optional --ai flag adds an Anthropic narrative on top of the deterministic output.
Capabilities
- Sixteen connector types cover logs, metrics, errors, databases and queues, including Elasticsearch, Grafana, Prometheus, Sentry, MongoDB, PostgreSQL, Redis/BullMQ, Kafka and CloudWatch.
- Source intelligence parses TypeScript, JavaScript, Python, Go, Java and Rust into one code graph.
- Investigation reports can be replayed, and postmortem drafts can be generated as Markdown.
- Every investigation is saved as local project memory, and Horus shows up to three related past incidents when a new investigation starts.
- Horus Cloud syncs investigations, evidence and agent runs from the CLI, while the CLI runs locally inside the repository.
When to use it
- Investigating an incident such as a checkout latency spike by correlating evidence across logs, metrics, queues and git changes.
- Giving AI coding agents evidence-backed causes and gaps from a Horus report as grounded project context.
- Drafting a postmortem in Markdown from a saved investigation.
