Full-Stack Incident Investigation

For an engineer on-call during a production incident. Stitches an Intercom support thread + Datadog APM + recent GitHub deploys into a cohesive incident narrative, drafts the customer-facing Slack update and a PR description for the fix.

Datadog logoDatadog
Intercom logoIntercom
GitHub logoGitHub
Slack logoSlack
THE GRIND

On-call is a five-tab scramble

Here's what doing this by hand looks like today — and why it doesn't scale.

A customer reports a bug and you're cross-referencing Datadog, Intercom, and GitHub deploys all at once

The Slack update lags behind the actual investigation

By the time the PR is drafted, you've forgotten what you found in the first trace

Composio collapses all of this into one prompt — here's what that looks like.

THE FLOW
9 steps · 4 toolkits

Your agent runs it end-to-end.

  1. 01
    Inspect the affected Datadog dashboard — extract each widget's metric query
    datadog logo
  2. 02
    Run each metric query over the investigation window; flag anomalies
    datadog logo
  3. 03
    Search error logs, cluster by signature, surface the top 5
    datadog logo
  4. 04
    Search slow traces, rank by duration
    datadog logo
  5. 05
    In parallel, pull customer signal from Intercom for the same window
    intercom logo
  6. 06
    List recent deploys; correlate any that land inside the window
    github logo
  7. 07
    Synthesize a one-page incident briefDashboard anomalies, top 5 errors, top 10 slow endpoints, customer complaint count, recommended actions.
  8. 08
    Draft the customer-facing Slack update
    slack logo
  9. 09
    Draft the GitHub PR — branch, patch, and PR body
    github logo
THE PAYOFF

Incident to fix in one thread

Customer signal, metric anomalies, recent deploys, and the draft fix PR — all stitched into a single investigation narrative.

Paste this into Claude, Cursor, or Codex. It'll install the CLI, connect your apps, and run the task — end to end.