Skip to content
Nodrik docs

Start here

Nodrik is a read-only incident investigator for teams on Google Cloud. When a Cloud Monitoring alert fires, Nodrik reads your logs, metrics, deploys and commits — inside your own project, using an identity you grant — and posts a likely cause to Slack with the evidence behind it.

What you need

Section titled “What you need”

Nodrik works alongside three things you almost certainly already run. Two of them are required, and it is worth knowing which before you start.

  • Google Cloud — required. This is where the alerts come from and where the investigation happens. Nodrik reads Cloud Run and your managed services inside your own project, read-only, on four viewer roles you grant. If your logs and metrics live in Datadog, Honeycomb or New Relic, Nodrik is not the right tool.
  • Slack — required. A workspace you can install an app into, and a channel for reports. Slack is the only place Nodrik delivers a finding today, so until one is connected Nodrik declines alerts rather than investigating them and posting nowhere — nothing is charged for an alert it turns away, and the console says why (ADR-0059). There is no email or Teams delivery, and none is planned until customers ask for one.
  • GitHub — optional. It answers “what changed?” by naming the commit behind a deploy. Skipping it is a first-class choice, not a failure state — see Connect GitHub.

Anything else your incidents depend on — a queue depth, a feature-flag state, a figure only your own service knows — you can expose to Nodrik yourself, through an MCP server or a single endpoint you host. That is the one way the list above grows, and it is yours to open: see Connect your own tools.

What it does

Section titled “What it does”

An alert fires. Somebody would otherwise open six console tabs and start correlating logs, metrics and the last deploy by hand — usually at the worst possible time. Nodrik does that correlation instead, and posts one answer to the thread: the culprit, the evidence, a suggested fix, and how confident it is.

Nodrik cuts investigation time. It does not solve incidents. That is a deliberate line, not modesty. Every investigation ends with a card, whether Nodrik found the culprit or ran out of road — an honest “I don’t know, here is what I checked” is a good outcome, not a failure. See Reading the card for what that looks like.

What it reads

Section titled “What it reads”

Nodrik reads your telemetry transiently, at the moment an alert fires, through your own Google Cloud APIs:

  • Log entries (Cloud Logging), including the Admin Activity audit log — the IAM change or config update behind an incident nobody committed
  • Metric time series (Cloud Monitoring)
  • Error groups (Error Reporting)
  • Cloud Run revisions and their configuration
  • What else is firing in the project, and the alerting policies it has configured (Cloud Monitoring)
  • Commit and diff metadata, if you connect GitHub

For eleven kinds of service — Cloud Run, Cloud SQL, GKE, Pub/Sub and the rest — Nodrik also knows what that kind of thing tends to fail on, and five of them have a purpose-built read of their own. What Nodrik investigates is the whole catalogue, tool by tool, and what happens to an alert that is none of them.

That list is what Nodrik reaches for by itself, and it does not grow casually. The one way to widen it is yours to open: read-only tools you host and declare, which Nodrik calls at your invitation and under your own credentials — see Connect your own tools.

Every one of the reads above happens under a service account you create and grant — see Connect a Google Cloud project for the exact roles.

What it never stores

Section titled “What it never stores”

This is the honest privacy claim, stated precisely because the people reading it are technical:

We never copy out or index your telemetry or code wholesale. What persists outside your Google Cloud project is the investigation report and a redacted transcript of the excerpts it read — never a copy of your logs, metrics or code.

Not “we can’t read it” — we transiently can, while serving an investigation. What Nodrik keeps, in europe-west1, is the report Nodrik posted and the transcript that produced it, both redacted before they are written and each tool result capped at 4,000 characters. Full detail: Security and trust.

Where to go next

Section titled “Where to go next”