Corelayer

Corelayer has an integration catalog with a page per connector, covering AWS, GCP, Cloudflare, Oracle Cloud, Datadog, Sentry, GitHub and GitLab, Slack, Microsoft Teams, ClickHouse, PlanetScale, Airflow, Trigger.dev, Vercel, incident.io, Merge and a custom webhook. Agents take authenticated action by opening pull requests in GitHub and querying production databases.

SourceCorelayer, docs.corelayer.com integrations section and corelayer.com FAQread 2026-09-06

Investigations run end to end without a prompt. Sub agents filter noise and false positives, a deep research agent maps the environment, and the investigation agent traces an anomaly through pipelines and deploys to a root cause, groups related issues by blast radius and can open a pull request with the fix.

SourceCorelayer, corelayer.com and docs.corelayer.comread 2026-09-06

A maintained context graph, the Production Cortex, maps code, databases, deployments and observability across the customer's environment and is explored and updated continuously, giving every investigation grounded context with citations back to logs and code. The organization's learned memories are kept apart from this graph.

SourceCorelayer, corelayer.com and docs.corelayer.comread 2026-09-06

Engineers validate and continue agent investigations in the browser, close or reopen issues with feedback that the platform reads as instruction, and are asked to confirm when a new instruction contradicts an existing memory instead of having it overwritten. Production access is read only by design with PII masking, and preflight is advisory and never blocks a push. Pull request creation is optional, and the review gate on a pull request belongs to GitHub.

SourceCorelayer, docs.corelayer.com/memory/overview and corelayer.com; docs.corelayer.com/memory/overview.mdread 2026-09-06

SOC 2 Type II is in place, with a trust center at trust.corelayer.com, and customers get SSO, RBAC and SCIM provisioning, plus configurable PII masking, zero data retention by default and read only access to production data. Audit logs and on prem and BYOC deployment are also offered.

SourceCorelayer, corelayer.comread 2026-09-06

Every investigation records its steps and cites the logs and code behind each finding, audit logs are among the enterprise controls, and a detailed audit trail covers every action the agent takes, with citations and explanations. That per action record lets a team reconstruct what the agent did.

SourceCorelayer, corelayer.com and docs.corelayer.comread 2026-09-06

Organization Memory is scoped to the organization and isolated per tenant, with each memory anchored to a specific resource or held organization wide. Memories come in four typed kinds (failure pattern, preference, fact and decision) and are kept canonical rather than as a log. They are created from issue feedback, chat instruction and incident consolidation, decay in influence with age, and can be read, edited, archived and restored from the Cortex view. Each memory is managed independently of the incident record it came from.

SourceCorelayer, docs.corelayer.com/memory/overview; docs.corelayer.com/memory/overview.mdread 2026-09-06

Corelayer deploys into the customer's own cloud (BYOC) or on premises so production data never leaves the environment, with confidential compute as a secure inference option, alongside Corelayer's hosted cloud.

SourceCorelayer, corelayer.comread 2026-09-06

The specialized sub agents for noise filtering, grouping, deep research and investigation run inside the platform and are not chosen by the customer. The per connector integration pages and the installable Corelayer skill for coding agents are configuration and tooling, and no template or agent catalog is published.

SourceCorelayer, corelayer.com and docs.corelayer.comread 2026-09-06

Agents pick up work from continuous monitoring of logs, metrics and data, from alerts pushed by Datadog, Sentry, incident.io and any monitoring tool through a custom webhook endpoint, from scheduled consolidation of resolved issues, and from ad hoc requests in Slack, Microsoft Teams, the CLI and the MCP server.

SourceCorelayer, docs.corelayer.com integrations and corelayer.comread 2026-09-06

Customers can bring their own key and use a custom gateway, and inference can run through a company's own LLM gateway or licensed model providers, with confidential compute as a secure inference option. Customers therefore control which provider serves inference, though there is no model picker in the product.

SourceCorelayer, corelayer.com and corelayer.com/guides/platforms-ai-on-call-engineers-2026read 2026-09-06

Corelayer exposes a V1 REST API (api/v1) for issues, groups, integrations, events, anomaly configs, deep research and settings, with API key authentication, RBAC and per key rate limits, shipped in v1.3.0. Alongside it are a CLI package, an SDK for custom metrics and an MCP server through which outside agents read issues and organization memory and run preflight.

SourceCorelayer, docs.corelayer.com/changelog/march-2026 and docs.corelayer.com/memory/overview; docs.corelayer.com/changelog/march-2026.mdread 2026-09-06

Corelayer offers no evaluation harness, scored test cases, quality gate or controlled optimization loop for its agent. A learnings and feedback loop feeds the organization's memory, and preflight checks the customer's pull request against that memory. The ROI calculator on the site estimates return on investment and does not test the agent.

SourceCorelayer, docs.corelayer.com/memory/overview and corelayer.com; docs.corelayer.com/memory/overview.mdread 2026-09-06

Agents reach systems through integrations, APIs and a CLI, and do not control a browser, desktop or computer.

SourceCorelayer, corelayer.com and docs.corelayer.comread 2026-09-06