Doctor Droid vs Sherlocks.ai (2026)

DrDroid offers 80+ integrations across AWS, GCP, Azure, GitHub, Datadog, Grafana, PagerDuty, Slack, Linear and Jira, runbook based remediation, and ArgoCD rollbacks, with write access granted only when rollbacks and permissions are configured.

The connectors cover observability tools such as Grafana with Loki and Mimir, Prometheus, CloudWatch, Azure Log Analytics, Google Cloud metrics and logs, New Relic, Datadog, Elasticsearch, OpenSearch, Sentry, SigNoz, Coralogix, VictoriaLogs and PostHog, Kubernetes on EKS, AKS, GKE or self managed clusters, and databases including BigQuery, ClickHouse, MongoDB Atlas and PostgreSQL.

Incident and work tools include Slack, Microsoft Teams, email, Opsgenie, PagerDuty, Jira, Confluence, Rootly and Zenduty, and code access runs through GitHub, GitHub Actions, Bitbucket and Jenkins. The agent can also run bash and remote server commands. Every plan includes unlimited integrations.

SourceDrDroid, drdroid.io, /pricing and docs.drdroid.io Common FAQs and llms.txt indexread 2026-10-05

Sherlocks connects to 50+ tools (Datadog, New Relic, Prometheus, AWS, GCP, Azure, Kubernetes, databases) and queries logs, metrics and traces. The Watson data agent runs inside the customer's own VPC with strictly read only permissions, so agents read outside systems and report to Slack or Teams instead of acting in them. Named sources also include Sentry, Coralogix, Elasticsearch, Loki, PostgreSQL, MySQL, MongoDB, Redis, Kafka, RabbitMQ, GitHub Actions and Jenkins.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

Teams build agents for alert tuning, deployment tracking, investigations, remediation, reporting and retrospectives on the open source PlayBooks runbook engine, and agents can be triggered 'from an alert, a conversation, another agent, or your own automation', with A2A delegation.

The named agent jobs run from alert middleware, the first response to every alert, through alert tuning that adjusts thresholds and files tech debt tickets, canary deployment tracking, end to end investigation and auto remediation, to observability gap analysis, cost and monitoring reports, long horizon infrastructure migration and retrospectives. Outside MCP servers a team connects become tools inside playbooks and custom actions. Investigations draw on credits, 99 a month on the $99 Startup plan with $1 top ups and volume credits on Business and Enterprise.

SourceDrDroid, drdroid.io, /pricing and docs.drdroid.io MCP Server integrationread 2026-10-05

Each investigation runs 16+ domain specialized agents in parallel. Sherlocks maps the alert to its knowledge graph, forms a hypothesis, queries logs, metrics and traces to validate it, then reports root cause with short and long term remediations. Findings arrive in Slack or Microsoft Teams.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

Investigations start on alerts, PagerDuty pages, alertmanager webhooks, cron jobs and API calls from CI/CD, as well as Slack and Microsoft Teams threads, and auto investigation rules fire on alert filters and severity. Automations on the Startup plan run from Slack only, Business adds Teams, Google Chat, PagerDuty, Opsgenie, Zenduty and custom sources, and Enterprise adds ServiceNow and Jira Service Management. Claude and Cursor can start work through the MCP server, and other agents can hand work to DrDroid over the A2A protocol.

SourceDrDroid, drdroid.io and /pricingread 2026-10-05

The alert itself triggers Sherlocks, which investigates on its own with 16+ domain specialized agents and reports back in Slack, and tickets and Slack requests also start investigations. The free plan covers 30 investigations a month, and Enterprise is unlimited.

SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05

'DrDroid maps every repo, dashboard, K8s pod and cloud resource into one live knowledge graph' that traces blast radius when an alert fires, alongside uploaded documents and runbooks the agent draws on. Cross tool correlation and a decision engine work over that graph. When it picks queries, the agent combines log patterns with the alert, the runbooks and debugging knowledge, and it tries further queries when the first ones fail. It forms its hypotheses from live context, the dashboards and integrations available and the documents it can reach.

SourceDrDroid, drdroid.io and docs.drdroid.io Common FAQsread 2026-10-05

Sherlocks maps each alert to a knowledge graph of the customer's infrastructure and applications, built automatically, that persists across investigations and grounds each hypothesis before it queries telemetry.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

A named AI Memory 'holds your service graph, runbooks, docs, and every live signal, alerts, deploys, conversations, incidents' across investigations, and the service graph doubles as the product's knowledge graph. DrDroid does not say who can see the remembered conversations and incidents, how long they are kept or how to delete them. The memory builds patterns over time so an engineer starts an incident with context already in place. Source code sessions are the exception, since each one starts fresh with nothing carried over.

SourceDrDroid, drdroid.io and docs.drdroid.io Source Code Securityread 2026-10-05

Sherlocks carries institutional memory across infrastructure, past incidents, runbooks and Slack conversations, so each investigation starts with the context the team has already built up. That memory carries across runs, but Sherlocks does not say what it covers, how long it lasts or how to delete it.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

Remediation runs from runbooks with human approvals, so responders approve remediations without leaving the thread, and the agent does not have access to execute write commands by default, with write access granted only alongside rollbacks and permissions. Responders can ask questions, approve a remediation and close the investigation from the same Slack or Teams thread. When the coding agent proposes a fix, it opens a pull request on a feature branch, cannot change the default branch and respects the repository's protection rules.

SourceDrDroid, drdroid.io and docs.drdroid.io Common FAQs and Source Code Securityread 2026-10-05

The data agent has strictly read only permissions, and Sherlocks reports remediations for the team to carry out, so action stays with people. Sherlocks describes no step that presents a fix for approval. Remediations come in short term and long term versions.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

Access controls include SSO and SAML, SSO and SCIM with an audit log on Business, and RBAC and access management with PII scrubbing. DrDroid reports SOC 2 Type II compliance, and the Enterprise plan lists both SOC 2 Type II and ISO 27001.

Integrations are read only by default, data is encrypted at rest and in transit, and the agent never holds API keys itself, since an execution engine stores the credentials. Enterprise also lists an IP allowlist.

Source code is analyzed inside short lived E2B micro VMs that are destroyed after each session, with no context carried between sessions and none of it used for training.

SourceDrDroid, drdroid.io, /pricing and docs.drdroid.io Common FAQs and Source Code Securityread 2026-10-05

The Enterprise plan adds SSO and SAML, audit logs and RBAC, with a read only in VPC data agent, and compliance rests on SOC 2 Type 2, with security review support. Data is encrypted in transit and at rest, and the free plan has no SSO, audit logs or RBAC.

SourceSherlocks.ai, sherlocks.ai/pricing and sherlocks.airead 2026-10-05

An audit export of task execution records, retrieved over the API, can be filtered to executions performed by the 'Drdroid agent' and shows who ran each task, when, and the activity. Investigations are shared across the team on every plan, and on PagerDuty the findings arrive already attached to the page. The audit log in the product starts on the Business plan.

SourceDrDroid, docs.drdroid.io Audit, drdroid.io and /pricingread 2026-10-05

Each investigation reports a root cause with remediations in Slack, and Enterprise includes audit logs, but Sherlocks names no record per investigation of the queries and steps the agents took. Reports also go to Microsoft Teams.

SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05

DrDroid is cloud hosted, or self hosted in the customer's VPC by Helm or Docker Compose with air gapped support. Business offers self hosting, and Enterprise self hosts in the customer's VPC with zero outbound traffic to DrDroid. Business runs from $999 a month in DrDroid's cloud or from $2,999 a month self hosted, and Enterprise adds custom data residency. The $99 Startup plan is cloud only, with one click setup.

SourceDrDroid, drdroid.io and /pricingread 2026-10-05

The Watson data agent runs inside the customer's own VPC, so raw telemetry never leaves the customer's environment, and Enterprise adds an air gapped deployment option and an option to run the LLM in the VPC. The VPC data agent comes with the free plan too.

SourceSherlocks.ai, sherlocks.ai/pricing and sherlocks.airead 2026-10-05

Teams build their agents for listed jobs on the PlayBooks engine. The open source projects (PlayBooks, droidctx, Status Page Aggregator, Kenobi, VPC Agent) are tools, and no catalog of prebuilt agents or playbook templates is published. Nine agent jobs are listed, among them Alert Middleware, the Investigation Agent, the Deployment Tracking Agent, the Infrastructure Migration Agent and the Retrospective Agent.

SourceDrDroid, drdroid.ioread 2026-10-05

The 16+ domain specialized agents run together inside each investigation, not as agents a customer selects or adopts separately. None of them is named, and the earlier Database Sherlock and Kubernetes Sherlock names no longer appear. Every plan includes all 16+ agents, and Enterprise adds a dedicated field engineer for setup.

SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05

On the Business plan the customer can bring its own LLM or use DrDroid's, while Startup includes a managed LLM. The coding agent that analyzes source code is built on Claude Code. The models behind investigations on the managed option are not named.

SourceDrDroid, drdroid.io/pricing and docs.drdroid.io Source Code Securityread 2026-10-05

Enterprise offers an 'In-VPC LLM option', so the model can run in the customer's own environment. Sherlocks names no model or maker, and no way to choose between makers.

Sourcesherlocks.ai/pricingread 2026-09-29

The DrDroid MCP server at aiops.drdroid.io/mcp/ uses bearer API keys and offers tools that update the service catalog, create and edit runbooks, and manage alert definitions and auto investigation rules, beside a published OpenAPI specification and API triggers.

DrDroid also works as an MCP client, connecting to a team's own MCP servers with bearer tokens, API keys or basic auth so their tools appear in playbooks and custom actions.

The open source projects include the PlayBooks engine, droidctx, a Status Page Aggregator, Kenobi and a VPC Agent, and the docs include a guide to building your own AI debugging agent.

SourceDrDroid, docs.drdroid.io DrDroid MCP Server, MCP Server integration and llms.txt indexread 2026-10-05

No API, SDK or MCP server is published for driving Sherlocks from outside. Teams work with Sherlocks through Slack and Microsoft Teams.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

DrDroid says 'Every alert, deploy, and incident strengthens the graph', and gives no more detail on how the agent improves. Alert tuning adjusts the customer's alerts, and DrDroid publishes no way to test or score the agent. The Retrospective Agent looks back over past incidents for long term improvements, and the Observability Agent reviews metric cardinality, logs and telemetry gaps in the customer's own monitoring.

SourceDrDroid, drdroid.ioread 2026-10-05

No evaluation harness, scored tests or improvement loop is named for the agents' investigations. Sherlocks reports MTTR falling from hours to minutes, alert noise down 90% and downtime down 70%.

SourceSherlocks.ai, sherlocks.airead 2026-10-05

DrDroid acts through integrations, runbooks, commands and APIs and does not control a browser, desktop or computer. Commands on servers run through the bash and remote server command integrations, not a screen.

SourceDrDroid, drdroid.io and docs.drdroid.io llms.txt indexread 2026-10-05

Agents query telemetry through integrations and report in Slack and Teams. Sherlocks names no browser, desktop or computer control.

Sourcesherlocks.airead 2026-09-29