Anthropic published on August 18, 2026, a feedback report on the use of Claude as the first responder during CI/CD incidents. The company reports that initial reports are generally produced in less than fifteen minutes. Beyond the numbers, the case is interesting because it describes a reproducible architecture: read-only access, controlled tools, versioned memory, and human validation before any modification.
1. What the feedback asserts
Anthropic describes an agent named Claude Tag used as a first responder for incidents related to continuous integration and deployment. According to published internal data, the agent produced the first situation report in each recent incident that had one, usually within fifteen minutes. The reported median for evidence-based analysis is fourteen minutes and, in the fastest cases, a root cause was identified in four minutes.
These results come from Anthropic's environment and do not constitute an independent benchmark. They nevertheless show that part of the initial on-call work can be structured: gathering signals, formulating hypotheses, citing observed elements, and preparing a handover.
2. The right role for an on-call agent
The first goal is not to replace the on-call engineer. It is to reduce the time wasted opening multiple tools, cross-referencing schedules, and reconstructing the context of a change.
A well-designed agent can retrieve alerts, recent deployments, errors, traces, and associated discussions. It can then suggest a timeline, the affected services, hypotheses, and the next checks. The human retains the decision, especially when an action could worsen the incident.
This distribution is consistent with the principle of human validation of AI systems : automate the collection and synthesis, but maintain clear accountability for high-impact actions.
3. A two-phase architecture
The described model separates deterministic triggering from agentic investigation. Alerts and classic rules detect a known state: pipeline failure, error rate, delay, or saturation. They then launch the agent with a scope and an incident identifier.
An orchestrator can delegate several tracks to sub-agents: analyze metrics, examine Git changes, read Kubernetes events, or find similar incidents. Each result must retain the references that allow the engineer to verify it.
This separation is essential. The monitoring system remains responsible for detection and thresholds. The model is involved in research, interpretation, and communication, where rigid rules reach their limits.
4. Why start in read-only mode
Anthropic provides a starter kit creating an initial read-only role. This is the right approach for an initial deployment. An agent capable of consulting metrics and logs already brings value without being able to stop a service or change a configuration.
The public kit is presented without self-remediation: humans decide on actions and deploy them. The internal system described by Anthropic also includes a separate agent capable of handling gradual deployments behind feature flags; this capability should not be confused with the initial scope of the kit.
Rights must be assigned by tool and by environment. Reading events from a test cluster does not justify access to production secrets. Viewing a pull request does not require the right to merge it.
Each request must be logged with the agent's identity, the incident, the tool, the scope, and the result. Temporary identifiers and short-lived tokens limit the impact of a leak.
5. Access to tools via MCP
The feedback mentions access to Datadog or Grafana, PagerDuty, GitHub, Kubernetes, and Slack via MCP. The protocol facilitates a common interface, but it does not constitute a security control in itself.
Each MCP server must expose an explicit subset of actions, validate parameters, and enforce service-side permissions. Generic tools like 'execute an arbitrary command' or 'make a free request' should be avoided when a narrower function is sufficient.
The responses from the tools must be considered unreliable data. A Slack message or a branch name may contain text designed to mislead the agent. The model must never turn an instruction found in a source into authorization to act.
6. Memory, instructions and learning
Anthropic describes a memory powered by Slack, permanent instructions in Markdown versioned in Git, and a file of lessons learned from previous incidents. This organization is preferable to an opaque prompt modified in an interface.
The instructions must specify the order of checks, reliable sources, the report format, escalation thresholds, and prohibited actions. Any modification goes through a code review and can be linked to a specific incident.
Memory must be filtered. A postmortem sometimes contains secrets, personal data, or hypotheses that have become false. Keep validated summaries and an expiration date rather than unlimited access to all historical conversations.
7. The safeguards before an action
When a read-only driver is mastered, certain reversible actions can be proposed: opening a ticket, preparing a pull request, relaunching a non-destructive job, or generating a command to be validated.
The correction described by Anthropic is still reviewed, merged, and deployed by the on-call engineer. This boundary must be explicit in the interface. A validation button is not enough if the user does not precisely understand the effects.
For an automatic action, require at minimum a deterministic policy, limited scope, a signed log, a delay, a rollback condition, and proof of verification after execution.
8. A four-phase deployment plan
Phase 1 is offline: replay closed incidents and compare the agent's report to the postmortem. Phase 2 is real-time observation, without operational notification. Phase 3 opens the report to on-call staff, still in read-only mode. Phase 4 allows some preparatory or reversible actions.
At each stage, define passing criteria: rate of correct citations, absence of out-of-scope access, response time, quality of hypotheses, and human verification workload.
Do not jump directly to automatic remediation. The incident is precisely the moment when the context is incomplete, systems are degraded, and errors are costly.
9. The indicators to monitor
Measure the time to the first useful report, the time to the root cause, the accuracy of the facts, the number of hypotheses refuted, and the time for human review. Also track incidents where the agent provided no value.
A good system must reduce the time needed for understanding without increasing risk. The rate of 'correct diagnosis' alone is insufficient: a correct analysis but unsourced may be impossible to use under pressure.
The experiment published by Anthropic shows a credible direction for outsourcing and SRE. Its transposition, however, requires a permissions architecture, narrowly focused tools, and measured progression.
Partitech can support the implementation of an on-call assistant: integration with tools, read-only roles, replay sets, dashboards, human validation, and rollback procedure.