Show HN: A agentic nervous system for all DevOps tools

Anway, an open-source platform that connects DevOps tools like GitHub, Datadog, and Kubernetes into a single intelligence surface, launched in beta. The platform allows teams to query and act across the entire software lifecycle through one orchestrator, with connectors that add intelligence for the whole organization. Anway is available on GitHub under the anway-dev organization.

The central nervous system of a software organisation. Beta — actively developed; APIs and schemas may change. Connects GitHub, Datadog, Linear, K8s, Loki, Prometheus, Jira, ArgoCD, PagerDuty, Terraform, and any cloud provider into a single intelligence surface. Every person in the org — SRE, PM, BA, Dev — queries, acts, and governs the entire software lifecycle through one orchestrator. Not a devtool. The connective tissue between Product, Eng and SRE.Every connector added = more intelligence for the entire org. Ask once, see everything across every tool, act with confidence behind a governed write path. 🌐 Website: www.anway.dev https://www.anway.dev · 🎬 Demo: watch the 90-second walkthrough below. https://github.com/anway-dev/anway/releases/download/v0.1.0-beta/anway-demo.mp4 https://github.com/anway-dev/anway/releases/download/v0.1.0-beta/anway-demo.mp4 If the player above doesn't load, — or click the thumbnail: ▶ watch the 90-second demo on anway.dev A signal fires → ask once → agents trace the root cause across every tool → gated action, then a tour of services, pipelines, connectors and the audit trail. Anway is split across repositories under the anway-dev https://github.com/anway-dev org: | Repo | What it is | |---|---| this repo | The platform — web UI, gateway, agent harness, agent-service, CLI, connectors, and infra. | | Cloud / e2e test environment — Terraform, k8s manifests, runners, service defs. | The product demo video and its capture harness live in this repo under apps/web/demo/ /anway-dev/anway/blob/main/apps/web/demo . Architecture architecture Prerequisites prerequisites Local Development local-development Demo Mode demo-mode Configuration Reference configuration-reference Running Tests running-tests Production Deployment production-deployment Troubleshooting troubleshooting apps/ web/ Next.js UI port 3000 gateway/ Fastify BFF — auth, RBAC, audit, connector proxy port 4000 agent-service/ Python FastAPI — LLM inference, episodic graph port 8000 cli/ anway CLI packages/ agent/ Orchestrator harness, specialist agents, IModelProvider k8s/ Cluster client ui/ Shared components types/ Shared TypeScript types infra/ docker-compose.yml Dev dependencies Postgres, Redis, Neo4j docker-compose.dev.yml Extended dev stack Prometheus, Grafana, OTEL helm/anway/ Production Helm chart terraform/ AWS / GCP / Azure Terraform modules Storage: | Layer | Technology | |---|---| | Primary DB | PostgreSQL 16 + pgvector + Apache AGE | | Session memory | Redis TTL = session lifetime | | Episodic graph | Neo4j 5 via Graphiti library | | Job queue | BullMQ Redis-backed | | SSE fan-out | Redis Pub/Sub | | Dependency | Min version | Notes | |---|---|---| | Node.js | 20 LTS | | | pnpm | 9 | npm i -g pnpm | | Docker + Compose | 24 | For local infra | | Python | 3.11 | Only if running agent-service locally | git clone <repo cd anway pnpm install docker compose -f infra/docker-compose.yml up -d This starts: Postgres 5432 , Redis 6379 , Neo4j 7474/7687 . Verify: docker compose -f infra/docker-compose.yml ps All services should show healthy . cp apps/gateway/.env.example apps/gateway/.env The defaults work out of the box for local dev. The only value you may want to set immediately: Pick any one LLM provider ANTHROPIC API KEY=sk-ant-... or OPENAI API KEY=sk-... or leave both blank — runs Ollama locally if installed If no LLM key is set, the chat endpoint returns { error: "No LLM provider configured", code: "NO PROVIDER" } with status 200 and the UI shows an inline prompt to configure one. No crash. cd apps/gateway pnpm prisma migrate deploy pnpm prisma db seed populates demo tenant with 22 services, alerts, incidents, pipelines cd ../.. The seed is idempotent — safe to re-run. Two terminals: Terminal 1 — gateway http://localhost:4000 cd apps/gateway && pnpm dev Terminal 2 — web UI http://localhost:3000 cd apps/web && pnpm dev Open http://localhost:3000 http://localhost:3000 . Demo mode provisions a single pre-seeded tenant and lets anyone log in without credentials. Intended for live demos and internal reviews — never enable in production. apps/gateway/.env DEMO MODE=true curl -X POST http://localhost:4000/api/auth/demo → { "token": "<jwt ", "expiresIn": "24h" } The web UI shows a Try Demo button on the login page when DEMO MODE=true . The demo tenant ID 00000000-0000-0000-0000-000000000001 is populated by the seed script with: - 22 services across 3 environments staging / preprod / prod - 5 namespaces - 10+ alerts mix of severities - 10+ incidents mix of active / resolved - 10+ deploys - 3 pipelines with stage runs and gate events Required for production: | Variable | Example | Purpose | |---|---|---| DATABASE URL | postgresql://anway:pass@host:5432/anway | Postgres connection | JWT SECRET | 64 random chars | HS256 signing secret dev only | JWT PRIVATE KEY | RSA PEM | RS256 private key production — use instead of JWT SECRET | JWT PUBLIC KEY | RSA PEM | RS256 public key | REDIS URL | redis://host:6379 | Redis connection | LLM provider one required for chat : | Variable | Notes | |---|---| ANTHROPIC API KEY | Claude — recommended | OPENAI API KEY | GPT-4o | GROQ API KEY | Groq fast, cheap | MISTRAL API KEY | Mistral | OLLAMA ENDPOINT | Local Ollama — default http://localhost:11434/v1 | OPENAI BASE URL + key | Any OpenAI-compatible endpoint | Optional services: | Variable | Default | Purpose | |---|---|---| DEMO MODE | false | Enable demo login endpoint | SENTRY DSN | — | Error tracking | OTEL EXPORTER OTLP ENDPOINT | — | Traces OTEL collector | NEO4J URI | — | Episodic graph agent-service | NEO4J USER / NEO4J PASSWORD | — | Neo4j credentials | OIDC ISSUER URL | — | SSO via OIDC Azure AD, Dex, Okta | OIDC CLIENT ID / OIDC CLIENT SECRET | — | OIDC app credentials | SLACK SIGNING SECRET | — | ChatOps slash commands | GITHUB WEBHOOK SECRET | — | Webhook HMAC verification | DD WEBHOOK SECRET | — | Datadog webhook HMAC | ANWAY WEBHOOK TOKEN | — | Static bearer token for Alertmanager / CI | ALLOW DEV TOKEN | false | Accept dev-token header e2e tests only | Connector API keys: Format: name:tenantId,name2:tenantId2 CONNECTOR API KEYS=e2e-key:00000000-0000-0000-0000-000000000001 GATEWAY URL=http://127.0.0.1:4000 gateway base URL server-side only All other config LLM keys, connector tokens lives in the gateway — never in the web app. cd apps/gateway && npx tsc --noEmit cd apps/web && npx tsc --noEmit Both must return 0 errors before any merge. pnpm test run all workspace tests cd apps/gateway && pnpm test gateway only Requires the full stack running gateway + web + infra : Start infra + app first see Local Development above Then: cd apps/web && pnpm exec playwright test Run a specific spec: pnpm exec playwright test e2e/99-certification.spec.ts The certification spec 99-certification.spec.ts is the gate — it verifies all 37 acceptance criteria across every wave. Build images docker build -t anway-gateway:latest apps/gateway docker build -t anway-web:latest apps/web Configure cp apps/gateway/.env.example apps/gateway/.env.prod Edit apps/gateway/.env.prod — set DATABASE URL, REDIS URL, JWT PRIVATE KEY, etc. Start docker compose -f infra/docker-compose.yml \ -f infra/prod/docker-compose.override.yml \ up -d The Helm chart at infra/helm/anway/ includes: gateway deployment, web deployment, HPA 2–10 pods, CPU 70% , PDB minAvailable: 1 , NetworkPolicy, Ingress nginx , ServiceAccount with IRSA annotations. 1. Create namespace kubectl create namespace anway 2. Create secrets kubectl create secret generic anway-secrets \ --namespace anway \ --from-literal=database-url="postgresql://..." \ --from-literal=redis-url="redis://..." \ --from-literal=jwt-private-key="$ cat jwt.key " \ --from-literal=jwt-public-key="$ cat jwt.key.pub " 3. Install chart helm install anway infra/helm/anway \ --namespace anway \ --set gateway.image.tag=<version \ --set web.image.tag=<version \ --set ingress.host=anway.yourdomain.com 4. Run migrations Job kubectl apply -f infra/k8s/migrate-job.yaml -n anway cd infra/terraform/environments/aws Configure cp terraform.tfvars.example terraform.tfvars Edit: aws region, cluster name, db password, etc. terraform init terraform plan terraform apply This provisions: EKS cluster, RDS PostgreSQL Multi-AZ in prod , ElastiCache Redis, ECR repositories, IAM roles IRSA , S3 bucket for TF state. GCP environments/gcp and Azure environments/azure modules follow the same pattern. DATABASE URL + REDIS URL reachable from pods JWT PRIVATE KEY + JWT PUBLIC KEY set RS256, not HS256 secret DEMO MODE absent or set to false ALLOW DEV TOKEN absent never set in prod Postgres migrations applied prisma migrate deploy Seed run if using demo tenant Health check responding: GET /health/live → 200, GET /health/ready → 200 SENTRY DSN configured for error tracking OTEL collector reachable if telemetry required Connector API keys rotated from dev defaults ANWAY WEBHOOK TOKEN set and matches alertmanager/CI config RDS automated backups enabled Terraform does this automatically | Endpoint | Purpose | |---|---| GET /health/live | Liveness — always returns 200 if process is up | GET /health/ready | Readiness — checks Postgres + Redis connectivity | Configure Kubernetes probes to use /health/ready . | Role | Capabilities | |---|---| admin | All operations | sre | Approve gates, create incidents, trigger deploys | dev | Create pipelines, run stages on non-prod envs | pm / ba | Read only | Roles are set at user provisioning time via the Access view or API. Anway supports any OIDC-compliant provider Azure AD, Okta, Google Workspace, Keycloak, Dex . OIDC ISSUER URL=https://login.microsoftonline.com/<tenant /v2.0 OIDC CLIENT ID=<app-id OIDC CLIENT SECRET=<secret OIDC REDIRECT URI=https://anway.yourdomain.com/auth/oidc/callback OIDC TENANT ID=<anway-tenant-uuid For local testing, the demo compose stack includes Dex infra/demo/dex/ as a mock OIDC provider. Chat shows "No AI model configured" Set at least one LLM provider key in apps/gateway/.env . Restart the gateway. Seed fails with "relation does not exist" Migrations haven't run. Run cd apps/gateway && pnpm prisma migrate deploy first. GET /health/ready returns 503 Either Postgres or Redis is unreachable. Check DATABASE URL and REDIS URL . Confirm infra containers are healthy: docker compose ps . TypeScript errors after pulling Run pnpm install at the repo root to pick up any new dependencies, then npx tsc --noEmit again. Playwright tests fail with "demo user not found" Re-run the seed: cd apps/gateway && pnpm prisma db seed . SSE streams drop under load Redis is required for SSE fan-out across multiple gateway pods. Ensure REDIS URL is set. Single-pod deployments work without Redis but cannot fan-out. Contributions are welcome — see CONTRIBUTING.md /anway-dev/anway/blob/main/CONTRIBUTING.md for setup, workflow and guidelines, and . /anway-dev/anway/blob/main/CODE OF CONDUCT.md CODE OF CONDUCT.md Found a vulnerability? Please report it privately — see SECURITY.md /anway-dev/anway/blob/main/SECURITY.md . Do not open a public issue for anything exploitable. Note the non-production defaults table there before deploying. MIT /anway-dev/anway/blob/main/LICENSE © Anway.