DEV Community

Labish Bardiya
Labish Bardiya

Posted on

I built an AI SRE agent that joins GitHub + Sentry + Slack + PagerDuty in one SQL query

#webdev #opensource #hackathon #ai

The Problem Every Engineer Knows

It's 3am. PagerDuty fires. You're half-asleep, scrambling between tabs:

  • GitHub: "Which PR went out last?"
  • Sentry: "What's the stack trace?"
  • Slack: "Did anyone else notice this?"
  • PagerDuty: "How long has this been firing?"

You spend 60+ minutes context-switching between tools before you find root cause. The fix itself? 5 minutes.

What if you could find root cause in one query?

Introducing NexusOps

NexusOps is an AI-powered SRE investigator that diagnoses production incidents in seconds. It joins data across GitHub, Sentry, Slack, and PagerDuty in a single SQL query — powered by Coral.

🔗 Live Demo: nexus-ops-seven.vercel.app
📂 Source Code: github.com/labishbardiya/nexus-ops

What is Coral?

Coral is an open-source data retrieval layer that turns any API into a SQL table. Instead of writing custom integrations for each tool, you just write SQL:

SELECT s.title, s.level, g.title as pr_title, g.user__login as author
FROM sentry.issues s
JOIN github.pulls g
  ON g.merged_at >= datetime(s.first_seen, '-24 hours')
  AND g.merged_at <= s.first_seen
WHERE s.level = 'fatal'
ORDER BY s.first_seen DESC
Enter fullscreen mode Exit fullscreen mode

That single query:

  • Hits GitHub's API for recent PRs
  • Hits Sentry's API for fatal errors
  • Correlates them by timestamp
  • Returns the PR that likely caused each error

No ETL. No data warehouse. No glue code. Coral handles auth, pagination, rate limits, and caching transparently.

Architecture 

┌─────────────────────────────────────────────┐
│                  NexusOps                     │
├─────────────────────────────────────────────┤
│  Next.js 15 + TypeScript + Tailwind CSS      │
├─────────────────────────────────────────────┤
│  Groq AI (Natural Language → SQL)             │
├─────────────────────────────────────────────┤
│  Coral CLI (SQL execution layer)             │
├──────────┬──────────┬──────────┬────────────┤
│  GitHub  │  Sentry  │  Slack   │ PagerDuty  │
└──────────┴──────────┴──────────┴────────────┘
Enter fullscreen mode Exit fullscreen mode

How it works:

  1. User asks: "What caused last night's fatal error?"
  2. Groq AI converts the question to a Coral SQL query
  3. Coral executes the query across multiple sources simultaneously
  4. NexusOps renders the results + a Root Cause Timeline + AI explanation

The Root Cause Timeline

This is the feature I'm most proud of. It's an SVG visualization that shows the causal chain across sources:

GitHub:    ●──── PR #342 merged ────────────────────────────
Sentry:         ●── TypeError ──── ●── Redis pool exhausted
PagerDuty:              ●── High urgency alert ─────────────
Slack:                       ●── "seeing errors" ── ●── "rolled back"
           ────────────────────────────────────────────────→ time
Enter fullscreen mode Exit fullscreen mode

The gap between the PR merge and the first error is the blast radius window. You can see causality at a glance instead of mentally correlating timestamps across four different tools.

Key Coral Features Used

1. Cross-Source JOINs 

SELECT 'github' as source, g.title as event, g.merged_at as timestamp
FROM github.pulls g
WHERE g.merged_at >= datetime('now', '-48 hours')
UNION ALL
SELECT 'sentry' as source, s.title as event, s.first_seen as timestamp
FROM sentry.issues s
WHERE s.first_seen >= datetime('now', '-48 hours')
UNION ALL
SELECT 'pagerduty' as source, p.title as event, p.created_at as timestamp
FROM pagerduty.incidents p
WHERE p.created_at >= datetime('now', '-48 hours')
ORDER BY timestamp DESC
Enter fullscreen mode Exit fullscreen mode

One query. Four sources. Correlated by time.

2. Schema Learning

Coral automatically discovers the schema of each source. I didn't have to manually map GitHub's API response fields — Coral figured out that github.pulls has columns like number, title, state, user__login, merged_at, etc.

3. 100% Local

All credentials stay on my machine. Data never leaves my laptop. This is huge for enterprise use cases where you can't send production incident data to third-party services.

4. CLI Integration

NexusOps calls coral sql "..." via Node.js child_process. Simple, reliable, no SDK lock-in.

The NL-to-SQL Pipeline

I used Groq with Llama 3.3 70B for the natural language to SQL conversion — it's free, fast (500+ tokens/sec), and excellent at structured SQL generation. The system prompt includes the full Coral schema, and the model generates valid SQL with the right table names, column names, and JOIN conditions.

Example:

  • Input: "What PRs were merged in the last 24 hours?"
  • Output: SELECT number, title, user__login, merged_at FROM github.pulls WHERE owner = 'withcoral' AND repo = 'coral' AND merged_at >= datetime('now', '-24 hours') ORDER BY merged_at DESC LIMIT 20

The key insight: SQL is a much better intermediate representation than JSON or function calls for multi-source queries. It's composable, debuggable, and Coral handles the execution.

Tech Stack

Layer Choice Why
Frontend Next.js 15 + Tailwind CSS Fast, TypeScript-native
AI Groq (Llama 3.3 70B) Free, 500+ tokens/sec, great at structured SQL
Data Coral CLI Cross-source SQL, local-first
Deploy Vercel One-command deployment

What I Learned

  1. SQL is an underrated agent interface. Most AI agent frameworks use function calling or tool chains. SQL is more powerful for data correlation because you get JOINs, aggregations, and filtering for free.

  2. Cross-source correlation is the hard problem. Getting data from one API is easy. Correlating events across four APIs by timestamp, with different time zones and formats, is where the real engineering happens. Coral abstracts this entirely.

  3. Local-first is a feature. For SRE tools that handle production data, sending everything to a cloud service is a non-starter. Coral's local-first architecture isn't a limitation — it's a selling point.

  4. Demo mode is essential. Not everyone has Sentry + PagerDuty + Slack configured. Having realistic mock data lets people experience the product without setup.

Try It Yourself 

# Install Coral
brew install withcoral/tap/coral

# Add GitHub source
coral source add github --interactive

# Query live data
coral sql "SELECT number, title, state FROM github.pulls WHERE owner = 'withcoral' AND repo = 'coral' LIMIT 5"
Enter fullscreen mode Exit fullscreen mode

Star Coral on GitHub: github.com/withcoral/coral

Links

Built for the WeMakeDevs "Pirates of the Coral-bean" Hackathon 2026.

Top comments (0)