Rootpath

The alert is never where the bug is.

Rootpath gives your AI agent a FalkorDB graph of your services, deploys, feature flags, owners and past incidents. It follows a failure to where it starts, fixes it, checks the fix, and remembers.

Install GitHub
T+00:00
readyLoading the recording.

Live health · last 8s

Agent steps

Waiting for the alert.

The agent's report

Recordings of real runs against the demo stack. The Live tab reads the graph on FalkorDB Cloud.

How it works

The service that alerts is rarely the one that is broken, and a deploy only matters if it is on the failing path. Each step is a graph query.

1

Find where it starts

Walk the call graph down from the alerting service. The deepest unhealthy service with healthy dependencies is the origin. Changes outside that subgraph are ruled out.

MATCH p = (s:Service {name: $alerting})-[:CALLS*0..6]->(d:Service)
RETURN d.name, min(length(p)) AS hops

// a flag reaches services it was never deployed to
MATCH (x:FlagChange)-[:TOGGLED]->(:Flag)-[:AFFECTS]->(d:Service)
WHERE d.name IN $candidates AND x.at >= $since
RETURN d.name, x
2

Check logs and memory

Read the logs of that one service, and find past incidents with the same cause and what fixed them.

CALL db.idx.fulltext.queryNodes('Incident', 'checkout|timeout|fraud')
YIELD node, score
MATCH (i:Incident) WHERE i.id IN $ids
OPTIONAL MATCH (i)-[:ROOT_CAUSE]->(rc)
OPTIONAL MATCH (i)-[:RESOLVED_BY]->(a:Action)
RETURN i, collect(rc), collect(a)
3

Act, dry run first

Roll back, restart or turn off a flag. A hook refuses any real action that has no matching dry run in the graph.

MATCH (a:Action {kind: $kind, target: $target, dry_run: true})
WHERE a.at >= $fifteen_minutes_ago
RETURN count(a)
4

Verify

Wait until the alerting service is healthy twice in a row. If it is not, rank again.

verify_recovery(frontend)
  t=4s   degraded  error 6.7%
  t=7s   healthy   error 0.0%   p95 112 ms
  t=10s  healthy   error 0.0%   p95 110 ms   recovered
5

Page and remember

Page whoever is on call, and store the incident with a ROOT_CAUSE edge to the change that caused it.

MATCH (t:Team)-[:OWNS]->(:Service {name: $s})
OPTIONAL MATCH (p:Person)-[:ON_CALL_FOR]->(t)
RETURN t.name, p.handle

(:Incident)-[:ROOT_CAUSE]->(:Change)-[:CHANGED]->(:Service)

With and without the graph

Six injected failures, the same agent and the same remediation tools. Baseline gets only health, logs and a flat list of changes.

Install


          

        

      

      

        
Runs locally
The MCP server is a local process your agent starts. There is no Rootpath server.

        
Your FalkorDB
Local Docker or FalkorDB Cloud. Topology, changes, incidents and agent steps all live there.

        
Rootpath Cloud coming soon
A hosted graph per workspace, a remote MCP endpoint, and webhooks for deploys and alerts.

      

    

  


  

    

      
The graph

      
The agent reads it with read-only queries. Only validated tools write to it.


// topology and ownership
(:Team)-[:OWNS]->(:Service)-[:CALLS]->(:Service)
(:Person)-[:ON_CALL_FOR]->(:Team)-[:ESCALATES_TO]->(:Team)
(:Runbook)-[:FOR]->(:Service)   (:Flag)-[:AFFECTS]->(:Service)

// what changed
(:Change:Deploy)-[:CHANGED]->(:Service)
(:Change:FlagChange)-[:TOGGLED]->(:Flag)
(:Deploy)-[:ROLLED_BACK]->(:Deploy)

// incident memory
(:Incident)-[:IMPACTED]->(:Service)
(:Incident)-[:ROOT_CAUSE]->(:Change | :Service)
(:Incident)-[:RESOLVED_BY]->(:Action)-[:BECAUSE]->(:Evidence)
(:Investigation)-[:STEP {n, tool}]->(any node the agent read)