Agentic AI operators for IT operations
NEUTHAR gathers technical context from monitoring, hosts, logs, runbooks and past tickets, delivers an evidence-based diagnosis and prepares the next action. Your team approves — everything is audited.
The problem
Repetitive — yet impossible without knowing the customer, the system and its history.
How the operator works
From alert to approved action — every step visible and traceable, and every confirmed resolution kept for the next time.
A Nagios alert, a ticket or a live session starts the investigation — automatically or with one click.
Your signalsAllowlisted checks on the host, filtered logs, runbooks and similar past incidents.
No free shellCause, confidence, impact and evidence — structured, not free text.
ExplainableOne next action with reasoning, risk and procedure.
One actionPolicies outside the model decide: allow, require approval or deny. Every step lands in the audit log.
Human gateResolutions your engineers confirm are kept and reused in the next investigation.
Human-confirmedWatch the operator work
The AI operator investigates with a fixed set of validated tools — monitoring, host checks, logs, documentation, incident history — and finishes with a structured assessment your team can approve.
Capabilities
A clearly bounded toolset instead of unrestricted access. Capabilities and guardrails are designed together.
From alert to evidence-based diagnosis with exactly one recommended action.
Allow, require approval or deny per action, with per-customer overrides. Decided outside the model.
Health checks for Solaris and Linux through the Node Agent — findings, not raw output.
Logs are filtered on the host and secrets redacted before anything leaves it.
$ export DB_PASS=S3cr3t!42•••••••••
redacted locally · [redacted]
Every tool call and decision is logged immutably, each entry chained to the one before.
Works alongside your engineer in authorized sessions. Explicit, scoped and pausable at any moment.
Strict separation per customer: data, policies, knowledge and history.
row-level security on every table
Coverage, time to diagnosis, accuracy and technician time saved.
Operational memory starts with a resolution your engineer confirmed, never with an AI guess — and it stays inside your tenant.
Suggested
by NEUTHAR
Reviewed
by an engineer
Confirmed
it fixed the issue
Reused
next time it appears
Architecture
Three parts: the operator that investigates and recommends; the Node Agent that checks hosts read-only; and the platform where your team approves, follows up and reports.
Security and control first
An AI operator with access to your infrastructure needs clear boundaries. They are part of the architecture, not of the configuration.
# NEUTHAR operator · enforced by architecture
[operator]
shell = none # catalogued, read-only checks only
policy_engine = outside_model # the model can only add caution
unknown_action = deny
state_change = require_approval # your team decides
audit = append_only # every tool call and decision
tenancy = row_level_security # one customer never sees another
hosting = eu-central (Frankfurt)
secrets = redacted_locally # before anything leaves the host
memory = human_confirmed_only
The Node Agent only runs catalogued, read-only checks with fixed arguments, timeouts and output limits. There is no endpoint that accepts a command.
Whether an action is allowed is decided by the policy engine — not by the language model. Unknown actions are denied.
Every state-changing action needs approval from your team. The model can only ask for more caution, never for less.
Tool calls, decisions and approvals are logged immutably — every investigation can be reconstructed.
Row-level security on every table. One customer's context is never used for another.
Hosting in Frankfurt. Logs are filtered locally and secrets redacted before transfer. DPA on request.
Runs close to your infrastructure, e.g. on a bastion host, authenticates with a token and only runs the checks of the approved capability pack. You stay in control of which hosts and log sources it sees.
Integrations
We do not replace your tools. NEUTHAR connects to the monitoring, ticketing and documentation your team already uses.
Your own systems — an in-house ticketing tool, for example — send events through an authenticated API with one token per integration. NEUTHAR reports ticket requests, approvals and results back through signed webhooks.
# send an event from any systemcurl -X POST $NEUTHAR_API/v1/events \-H "Authorization: Bearer $INTEGRATION_TOKEN" \-H "Content-Type: application/json" \-d '{"host": "sparc-db01","service": "ORACLE_LISTENER","severity": "critical","title": "Oracle listener not responding","external_id": "HD-48213"}'# results come back as signed webhooks (HMAC-SHA256)signature: t=1760530931,v1=9f2c…Solutions
Built for MSPs, IT service providers and internal IT teams with many systems and little time.
The same nucleus for project managers: schedules, Gantt charts, dependencies and risks, connected to support informed delivery decisions.
How a pilot works
Then decide. We work with a few MSPs and IT service providers as design partners: one workflow, your systems, shadow mode without risk.
Your systems, one concrete workflow and measurable success criteria.
Connect monitoring and the Node Agent. The operator investigates alongside your team — no changes to your systems.
Your engineers rate every diagnosis. Then we decide on the next step together.
We work closely with a few MSPs and IT service providers: one workflow, your systems, shadow mode to start, a joint review after every step.
We measure success in technician time saved and faster diagnoses — not in buzzwords.
Autonomy only grows where policies, approvals and audit back it up.
Every workflow is built together with a team that uses it every day.
Frequently asked questions
What the operator does, what it never does, and where the line sits between the two.
Start a pilot
Bring one real workflow. Define the scope. Keep your team in control.