Grepr AI agents

A Grepr AI agent is a configured investigator that Grepr runs for you. You give it instructions, a model to reason with, an identity to act as, and a set of capabilities. It then runs investigations: in each one the agent works in an isolated sandbox, uses the capabilities you granted to examine your logs, pipelines, and connected systems, records the changes it made outside the sandbox that Grepr recognizes, and writes up what it found.

You decide when an agent runs. Start an investigation yourself and give it the context to work from, or connect the agent to a source so it investigates on its own whenever that source reports something. When an investigation finishes, you can carry it forward into a new one that starts from the earlier conversation.

An agent is not a chat assistant. It runs unattended and finishes with a written conclusion you read afterwards. If it concludes that a pipeline should change, what happens next depends on the agent’s change approval mode: it either records the change as a suggestion for you to review, or applies it directly.

What an agent can do

Every agent works inside its own sandbox, where it can always run shell commands, Python, and DuckDB, and read and write its own files. What it can reach beyond that sandbox is entirely what you grant it:

• Search the logs and spans in your data lake.
• Read the configuration of your pipelines, datasets, templates, and integrations.
• Propose and apply changes to a pipeline’s Grok parsers and SQL transforms.
• Call the tools published by an MCP server you connect.
• Read its own past investigations and the conclusions it recorded from them.

An agent acts as a Grepr service account that you choose. The roles on that service account cap what the agent can reach, whatever tools you enable, so the service account is the outer boundary and the tool grants narrow it further. To learn more, see Control what an AI agent can do.

The parts of an AI agent

How an investigation runs

1. An investigation is queued, either because you started one and gave it context, or because a source the agent is connected to reported something. If the agent is already running as many investigations as you allow, the new one waits or is dropped, depending on the agent’s queueing setting.
2. The agent starts in a fresh sandbox, reads its instructions and whatever it was given to start from, and searches its memory for investigations that reached a similar conclusion.
3. The agent works through as many turns as you allow, calling the tools you granted. Grepr records each turn, each tool call, and each change it recognizes the agent making outside the sandbox.
4. The agent writes a summary and, when it has one, records a conclusion in its memory. If it wants to change a pipeline, it submits the change as a suggestion, or applies it directly when you configured the agent to do so.

An investigation ends on its own, or you can stop it to add guidance and resume it, cancel it outright, or continue it in a fresh investigation seeded from it. To learn more, see Run and review investigations.

What you need before you start

Before you create your first agent, you need:

• An LLM integration that provides the model the agent reasons with. See Configure LLM provider connections with a Grepr integration.
• A Grepr service account for the agent to act as. See Manage Grepr service accounts.

That is enough to create an agent and run investigations yourself. Three further capabilities each need their own setup:

• To have an agent investigate on its own, connect it to a signal source, which is either a pipeline or a Grepr Agent integration. See Subscribe an agent to signal sources.
• To let an agent call an external system’s tools, create an MCP integration. See Configure MCP server connections with a Grepr integration.
• To let an agent keep and search conclusions from past investigations, create a vector index integration and an embedding integration. See Remember past investigations.

Create an agent

Create an agent in a six-step wizard that collects its instructions, its model, its capabilities, its memory settings, and its subscriptions. The same settings are editable afterwards on the agent’s page. See Create an AI agent.

Control what an agent can do

An agent’s reach is set by the service account it acts as, the tools you enable, the skills you give it, and the MCP servers you connect. This also covers whether the pipeline changes it proposes need your approval. See Control what an AI agent can do.

Extend agents with skills

A skill is a directory of instructions that an agent loads only when it is relevant, and which can grant the tools it needs. Grepr ships a set of skills, and you can write your own. See Extend agents with skills.

Have an agent investigate on its own

Connect an agent to a pipeline or a Grepr Agent integration so that source’s events start investigations without you. See Subscribe an agent to signal sources.

Run and review investigations

Start an investigation yourself, follow the ones a source triggered, read their transcripts, guide one that is running, and review the pipeline changes an agent proposes. See Run and review investigations.

Remember past investigations

With memory turned on, an agent records what it concluded, counts how often the same conclusion recurs, and searches those records during later investigations. See Remember past investigations.