Open-source incident management for Slack

What it does

When something breaks in production, Halon figures out why and helps you fix it.

• It finds the cause. An alert or a question in Slack gets it started. Halon checks what changed recently, the logs, the metrics and your code, like an engineer on call would. It posts what it's checking as it goes.
• It shows its work. Every answer says how sure Halon is and links to the log line, graph or commit behind it. If it couldn't check something, it says so.
• It fixes it, with your say. Halon can roll back, restart, or open a pull request with the fix. Reading never needs permission. Small changes just happen and can be undone. Anything risky asks the right person in Slack first. Everything it does is logged.
• It runs the incident too. FireFight opens the Slack channel, assigns roles, pages whoever is on call, updates your status page and drafts the postmortem.

Run it on your own servers, or use FireFight Cloud.

What Halon knows

Halon starts every run from your team's context: the resource map of what runs where, read live from your connected tools, the service catalog with owners, the handbook your team writes and approves, memory of past incidents that a person confirms, and every past incident and postmortem. How context works.

Get started

Sign up at app.firefight.app with Slack, Google or email.

To self-host, you need a machine with Docker, a hostname and a Slack workspace.

1. Create the Slack app from config/slack_manifests/template.yml, with your address in place of <base-url>.
2. Fill in .env from .env.selfhost.example: your hostname, a Postgres password, the Slack app's three keys, and the secrets these print.

   docker run --rm ghcr.io/firefightlabs/firefight:latest bin/rails secret
   docker run --rm ghcr.io/firefightlabs/firefight:latest bin/rails db:encryption:init
   

3. Start it with docker compose up -d. Sign in with Slack at your address and run /ff new.

SELF_HOSTING.md covers AI keys, code sandboxes, upgrades and backups.

We ship fast

In the last 30 days we merged more than 400 pull requests and tagged 49 releases. Every version is published to ghcr.io/firefightlabs/firefight, the same image FireFight Cloud runs. The changelog has the details.

Learn more

• Halon and investigations
• Permissions and approvals and what reaches the AI
• Integrations, plus any MCP server
• REST API and FireFight's MCP server

Contributions are welcome. Start with CONTRIBUTING.md, and report vulnerabilities as SECURITY.md describes.

License

AGPL-3.0. Run it, host it and change it. If you offer a changed version as a service, publish your changes under the same license.