Every capability below detects, diagnoses, and proposes a fix — and every one of them stops at a hard approval step before anything touches your infrastructure. Detection is automatic. Action never is, unless you say so.
Detects a failed pipeline run, surfaces the root-cause step from the logs, and proposes the exact config or code fix — before you’ve finished reading the Slack alert.
Separates the pod restart that self-healed from the one that needs a human, and proposes the scale-up, rollback, or config patch for the ones that matter.
Reads a pull request the way a senior engineer would: flags security patterns, architectural drift, and the stuff a linter can’t catch, as a real review comment.
Takes a file or module you name — a Flask route, a Terraform 0.12 module, a Python 2.7 script — and drafts the migrated version with a step-by-step plan attached.
Diffs what a role actually used against what it’s allowed to do, and proposes the tightened policy — the least-privilege cleanup nobody has time to do by hand.
Reads your actual billing export, finds the idle resources and the waste, and ranks fixes by real monthly savings — not a generic "right-size everything" report.
Turns a written runbook into an executable, step-gated workflow — each step runs, reports back, and waits before the next one fires.
Compares live state against Terraform, CloudFormation, or a Kubernetes manifest, and proposes the correction — never applies IaC changes without a PR to review.
Answers "how does this actually work" and "what do I do about this page" using your real runbooks and incident history — not a generic wiki search.
Scans your manifest (npm, pip, go, maven, ruby, or cargo) against OSV.dev, and proposes the patched manifest with a severity-ranked vulnerability summary.
Catches a resource going down, a threshold breach, or a security finding the moment your cloud provider fires the alert — the runtime counterpart to CI/CD triage and drift detection.
CI/CD triage, Kubernetes alerts, and PR review ship on every plan. The other eight — migration, IAM, FinOps, runbooks, drift, on-call knowledge, dependency patching, and resource health monitoring — come with Growth and Enterprise.