Monitoring tells you something is wrong. root tells you why.
Live health, metric history, one log stream, alerts and an assistant that can actually investigate,
across 31 kinds of infrastructure, from one window. Open source. Desktop or server.
Website · What it does · Films · Run it · 31 kinds · How it fits together · Status · Reference
| kinds of infrastructure, polled read-only | places it reads config and logs: this machine, a container, SSH, a pod | tests in CI on Linux and macOS, with a real TimescaleDB on Linux | models required. Add Anthropic, any OpenAI-compatible endpoint or Ollama if you want the assistant |
| ways to run one engine: the desktop app, or a server with a browser client | containers to deploy it: root-server and Postgres. No broker, no cache, no sidecar | days of history an alert rule replays against before you save it | actions the assistant takes without your approval |
Watching tells you a thing is wrong. Reading the configuration that governs it tells you why, and which number to change.
A Redis at 1.8 GB of a 2 GB maxmemory with maxmemory-policy noeviction is not a memory graph to keep an eye on. It is a decision that starts refusing writes in about three hours, and neither the metric nor the config file says so alone. root reads both, and says:
Writes will start failing in about 3 hours. Memory is at 1.8 GB of a 2.0 GB ceiling and rising.
maxmemory-policyisnoeviction, so when it arrives Redis does not evict anything: it returns OOM on every write and keeps serving reads.redis-cli CONFIG SET maxmemory-policy allkeys-lru # cache semantics: evict rather than refuse
| One incident, not a list of alerts | Alerts group by onset time, declared dependencies and observed changes, with no model involved. You see what failed first, what changed and how far it spread. |
| It reads your config | You declare the paths: on this machine, inside a Docker container, over SSH or inside a Kubernetes pod. Secrets are redacted in the reader, and findings come from rules that always fire on the same input. |
| An estate graph | Every connection, container, outside service, team and file as one graph you can walk. Every link says how root knows it: declared, reported, observed or inferred. |
| Grafana dashboards, imported | Paste an export and its PromQL panels run. Explore PromQL, LogQL and traces. Alert rules replay the last week before you save them. |
| An assistant with real access and deliberate limits | Read-only by default. With actions allowed, every call stops for approval. No shell tool and no arbitrary SQL. Bring Anthropic, any OpenAI-compatible endpoint, or Ollama, where nothing leaves the machine. |
| It keeps score | A Scorecard of which findings were right, which were noise and which problems it missed. |
Each one is the real app, filmed with its built-in demo data. Click through to watch with sound.
 The launch film · 0:25 The whole idea, from the splash to the end card. |
 From first alert to root cause · 0:34 Alerts, how it spread, the analysis, the assistant, the record. |
 Monitoring is half of it · 0:32 A finding, the fix, the evidence, redaction, where files live. |
 What is this connected to? · 0:24 The service map and the estate graph. |
 Bring your Grafana dashboards · 0:28 Import, Explore, a trace waterfall, a rule replayed. |
 Select it. Ask about it. · 0:18 The answer sits on the chart window or log lines you asked about. |
Look at the interface in a browser, with demo data and no Rust. It needs Node 22.
git clone https://github.com/aniketshukla1/root
cd root
npm install
npm run dev
# then open http://localhost:1420/?estate=incidentThe desktop app. Nothing to configure and nobody to sign in to. It reads a config file you own, holds credentials in the OS keychain and binds loopback only. It needs Node 22, a Rust toolchain and the Tauri 2 prerequisites, plus CMake for the bundled Kafka client and, on Linux, curl's headers (libcurl4-openssl-dev).
npm install
npm run tauri devNothing to connect yet? Start the live demo from the first-run screen: a simulated shop of thirteen connections, where every twelve minutes something goes wrong.
The server. Collectors run somewhere that stays up, history goes to Postgres, and the client is a browser on any device, with accounts, roles and single sign-on. It refuses to start without a token. See deploy/README.md.
cd deploy
cp .env.example .env # put real values in it
docker compose up -d
open http://localhost:7777| Containers and orchestration | Docker, Podman, Kubernetes |
| Hosts and storage | This computer, Linux host, SSH server, NFS exports |
| Web and endpoints | HTTP endpoint, Nginx, Apache httpd, Apache Tomcat, HAProxy, Traefik |
| Databases | PostgreSQL, MySQL, MongoDB, ClickHouse |
| Caching and search | Redis, Memcached, Elasticsearch |
| Messaging and coordination | Kafka, RabbitMQ, NATS, ZooKeeper, Consul, etcd |
| CI, observability and cloud | Jenkins, Prometheus, Gigapipe, OpenTelemetry, AWS |
Adding a kind is a backend-only change: the frontend knows about no service type in particular. How to add one.
flowchart LR
estate["Your estate<br/>31 kinds of system"] -->|polled, read-only| engine
files["Declared config and log files<br/>local, container, SSH, pod"] -->|redacted in the reader| engine
otlp["Apps, over OTLP"] --> engine
subgraph engine["The engine (Rust)"]
direction TB
rules["Alerts, incidents, config rules, forecasts"]
knows["Estate graph, history, logs, traces"]
end
engine --> desktop["Desktop app<br/>Tauri + React"]
engine --> server["Server<br/>browser client, Postgres"]
engine --> mcp["MCP server"]
engine <-->|fixed tools| ai["Assistant<br/>your model, or none"]
The desktop app and the server run the same engine. Everything works with no model configured; the assistant adds to it.
Version 0.1, built from source: there are no signed installers yet. Every push to main runs Clippy with warnings as errors, the backend suites on Linux and macOS, on Linux against a real TimescaleDB (list), the frontend checks and bundle budget, and a build of the server image. Suites for services CI does not run, such as Redis, Kafka and Kubernetes, skip there and run when one is up. Reading files inside a container, inside a pod and from a journal over SSH have tests but have not yet been exercised against a live engine or cluster, so reports are welcome.
- The reference: every collector, the assistant's limits, the MCP server, credentials, the layout
- Frontend architecture, Gigapipe, Releasing
- Contributing and Security