Adopt: connect your stack

This guide walks you through connecting sureops to your real infrastructure. By the end, sureops agents will be watching your services, diagnosing incidents from your telemetry, and proposing code fixes as pull requests in your GitHub repos. This page is a connection guide, not a step-by-step wizard — for the full numbered onboarding tour (including the demo path), see Guided onboarding journey.

You are in early access. If you get stuck, open Help & support in the sidebar and use Email us or Ping us on Slack — we aim to respond within one business hour during business hours. Hands-on, in-your-environment co-implementation support from a sureops field engineer is planned for higher tiers, but isn’t a generally available self-serve feature yet.

Before you start

Have these ready before beginning:

Item	Why
An AI model / LLM API key (BYOK)	Required before generating a starter contract or diagnosing any incident — agents cannot analyze telemetry without a configured model. Connect this early; it is a prerequisite for later steps, not an afterthought
A dedicated knowledge-base (KB) repo	sureops stores your service contract (`.sureops/services.yaml`) in one dedicated KB repo per organization — never in your service source repos. Pick an existing empty repo or create a new one before you start writing contract files. You’ll designate it in Settings → Knowledge Base once GitHub is connected
Prometheus URL + auth token, or a Grafana URL + service account token	Used to configure `prometheus-mcp` or `grafana-mcp` — a small MCP proxy you stand up yourself. sureops never receives your Prometheus/Grafana URL or credentials directly, only the MCP endpoint URL and its own auth method/token
GitHub org admin permissions	Required for the OAuth installation that lets sureops read repos and open fix PRs
Slack workspace admin (or permission to install apps)	Required to create incident war-rooms and post agent updates
`kube-state-metrics` with pod-label allowlist (recommended)	Improves service discovery fidelity — sureops correlates deployments to services via `app.kubernetes.io/name`
OTel collector with `servicegraph` connector (recommended)	Generates `traces_service_graph_request_total` so sureops can derive your service call graph

Connecting your stack

Create your environment

An environment is the scope for everything sureops does — telemetry connections, incident history, agent configuration, and alert routing are all tied to one environment.

Go to Settings → Organization → Environments → Create environment
Give it a name that matches your deployment context (e.g., production, staging)
Click Create environment

Free and Starter plans are limited to one environment. Growth adds up to three, and Enterprise is unlimited — if you want a non-production environment alongside production, check your plan’s environment limit first.

Connect your AI model

sureops agents need a configured AI model before they can diagnose incidents, draft runbooks, or propose fixes — including generating your starter service contract later in this guide.

Go to Settings → Environment → AI Agents
Provide your own API key (BYOK)

You can skip this step and come back to it, but no agent work — including contract generation — will function until a model is connected.

Connect your observability stack

sureops needs access to your observability data to discover services, understand topology, and diagnose incidents.Option A — Prometheus (direct)

Stand up prometheus-mcp — a small MCP proxy pointed at your Prometheus instance, configured with whatever auth (none, basic, or bearer) it requires. Your Prometheus URL and credentials configure this proxy directly; they are never entered into sureops
Go to Settings → Integrations → Prometheus → Connect
Fill in the MCP Server Endpoint (your prometheus-mcp URL), Authentication Method, and Token — this is how sureops authenticates to prometheus-mcp, not your Prometheus credentials
Click Save & Connect
Once connected, go to Settings → Environment → Landscape and click Re-sync now to run the initial service discovery

Option B — Grafana (proxy) Use this if your Prometheus is not directly internet-reachable. sureops can query through your Grafana instance instead.

Stand up grafana-mcp pointed at your Grafana instance, using a service account token. Viewer is sufficient for read-only metric/log queries — only assign alert.provisioning:write (Editor, or a custom role with that permission) if you plan to use Proposed Monitor Export (Growth plan and above) to push approved monitors into Grafana as alert rules
Go to Settings → Integrations → Grafana → Connect
Fill in the MCP Server Endpoint (your grafana-mcp URL), Authentication Method, and Token — this is how sureops authenticates to grafana-mcp, not your Grafana credentials
Click Save & Connect
Once connected, go to Settings → Environment → Landscape and click Re-sync now

What “done” looks like: Settings → Environment → Landscape shows your service nodes and deployments.Common issues:

401 Unauthorized — the token sureops sends to your MCP server is wrong, or the MCP server’s own upstream Prometheus/Grafana credentials are wrong or expired
Connection timed out — your prometheus-mcp/grafana-mcp server is not reachable from sureops, or your Prometheus/Grafana instance is not reachable from the MCP server. If it’s your Prometheus that’s unreachable, switch to the Grafana proxy option
0 services discovered — enable the kube-state-metrics pod-label allowlist (kubeStateMetrics.metricLabelsAllowlist: [pods=[*]] in your kube-prometheus-stack values) and re-sync

Connect Slack

sureops creates a dedicated Slack channel for every incident, posts agent updates there, and routes approval requests to your on-call team.

Go to Settings → Integrations → Slack → Connect
Authorize the sureops Slack app on your workspace

By default, incident channels are named with an inc- prefix. To change the channel prefix, go to Settings → Environment → Channels — this is a separate setting from the Slack connect flow itself.What “done” looks like: The Slack integration shows “Connected” in Settings. When the next incident fires, sureops creates a channel and posts the initial alert context automatically.

Connect GitHub

GitHub integration enables two things: sureops reads your .sureops/ service contract from your KB repo, and the resolution agent opens draft fix PRs against your service repos.The architecture intent is a GitHub App install with nothing for you to stand up (see How integrations work) — but that install redirect isn’t reachable from the connect screen today. GitHub, like several other integrations, has no vendor-hosted MCP endpoint wired in yet, so the connect form today is the same generic MCP-endpoint form used by Grafana, Prometheus, and the other customer-hosted integrations, not a GitHub App install redirect.

Go to Settings → Integrations → GitHub → Connect
Fill in the MCP Server Endpoint, Authentication Method, and Token for the MCP server you use to reach GitHub
Click Save & Connect
Tag any service repo you want sureops to actively watch with the GitHub topic sureops-service

What “done” looks like: Settings → Integrations → GitHub shows “Connected”.Common issues:

401 Unauthorized — the token is incorrect, expired, or your MCP server’s own GitHub credentials have been revoked
No repos with sureops-service topic — add the topic to at least one repository, then go to Settings → Environment → Landscape and click Re-sync now

Add your .sureops/ service contract

The service contract is a YAML file that tells sureops what you know about your services that telemetry alone cannot infer: who owns each service, where its source lives, and where its runbook lives. Agents read this contract before every incident to understand blast radius and who to involve.The contract lives in your dedicated KB repo (the repo you picked in the prerequisites above) — never in a service’s own source repo. sureops supports one KB repo per organization. Designate which repo is your KB repo in Settings → Knowledge Base — this org-scoped tab is also where you generate the contract.Auto-generate (recommended for getting started):

Go to Settings → Knowledge Base → Generate starter contract
sureops reads your observed services and deployments, then opens a draft PR against your KB repo with a pre-filled .sureops/services.yaml
Review the PR — check owners and runbook paths — and merge

Already using Backstage? sureops can read your catalog-info.yaml directly as a one-shot import instead of generating a contract from scratch — look for the Backstage import option on the same Knowledge Base page.Hand-author: Create .sureops/services.yaml in the root of your KB repo. The only required fields per service are name and git_repo; everything else is optional:

version: 1
services:
  - name: checkout-service
    git_repo: your-org/checkout-service
    owner: payments-team
    runbook: docs/runbooks/checkout-service.md
    tags:
      - tier-1
    depends_on:
      - payment-service
      - inventory-service

What “done” looks like: At least one service in Settings → Environment → Landscape shows provenance Customer contract.

After you connect

Once you’ve connected your stack:

Route your alerts to sureops — there’s no self-serve alert-routing connect flow for the adopt path yet. Tell your sureops onboarding contact which alert source you use; they’ll set up the webhook registration on your environment so alerts open incidents automatically.
Trigger a test incident — scale a non-production service to zero replicas and watch the full lifecycle run.

Trust and data principles

sureops’s primary data model is derived structure: service names, dependency edges, and ownership, plus root cause findings, recommendations, and timeline entries written into the incident record. Agents pull raw telemetry (logs, traces, metric series) on demand during an incident to reason through it. See How integrations work for what agents do with telemetry during an incident. Your authored service contract always overrides anything sureops infers from telemetry.

Getting help

If you get stuck:

Open Help & support from the sidebar and choose Email us (opens a pre-filled email to hello@sureops.ai) or Ping us on Slack (copies your context to paste into the shared Slack support channel)
If a provisioning step itself fails, look for a Contact support button on the failure banner in Settings → Environment — it carries the relevant event log straight to support

Hands-on co-implementation — a sureops field engineer debugging your setup directly in your environment — is planned as a higher-tier offering, not something every plan can self-serve today. For now, the channels above are how to get help.

Getting Started

Onboarding & Setup

Using sureops

Operating Modes & Trust

Integrations

Your Rules (.sureops)

AI Agents & Models

Problem Management

Administration

Self-Hosting

Reference

Adopt: connect your stack

Before you start

Connecting your stack

After you connect

Trust and data principles

Getting help

​Before you start

​Connecting your stack

​After you connect

​Trust and data principles

​Getting help

Before you start

Connecting your stack

After you connect

Trust and data principles

Getting help