ARGUS: MCP-Grounded Root Cause Analysis for Kubernetes Incidents

• URL: http://arxiv.org/abs/2608.23084v1
• Date: Mon, 24 Aug 2026 10:48:21 GMT
• Title: ARGUS: MCP-Grounded Root Cause Analysis for Kubernetes Incidents
• Abstract summary: ARGUS connects a commercial to live observability data through MCP servers covering Prometheus state, metrics, logs, and NATS messaging.<n>ARGUS named the correct root cause in all ten scenarios with an aggregate MCP success ratio of 0.91.<n>Our central finding is a diagnostic/prescriptive asymmetry: ARGUS reliably identifies what went wrong, but is perceived as less reliable or trustworthy at specifying what to do next.
• Score: 0.9685837672183747
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Kubernetes incident triage requires correlating signals from metrics, logs, container state, and messaging systems across multiple monitoring tools, a fragmented workflow that slows diagnosis and contributes to alert fatigue. Large language models (LLMs) have shown promise for automated root cause analysis (RCA), but existing systems rely on custom, system-specific data access layers that cannot be reused across organisations. We present ARGUS, an MCP-grounded RCA assistant that connects a commercial LLM to live Kubernetes observability data through standardised MCP servers covering Kubernetes state, Prometheus metrics, Loki logs, and NATS messaging, and delivers structured diagnostic summaries inside the Slack incident channel where on-call engineers already work. We conduct a preliminary evaluation of ARGUS using three complementary methods: controlled fault injection across ten Kubernetes incident scenarios, rubric-based scoring of the resulting RCA summaries on three dimensions, and semi-structured interviews with six on-call engineers at an industrial partner. ARGUS named the correct root cause in all ten scenarios with an aggregate MCP success ratio of 0.91. Practitioners trusted the diagnostic output but consistently expressed scepticism toward the recommended fixes. Our central finding is a diagnostic/prescriptive asymmetry: ARGUS reliably identifies what went wrong, but is perceived as less reliable or trustworthy at specifying what to do next. This pattern can be observed across all three evaluation methods, and has important implications for future autonomous agentic incident handling systems.

Related papers

• Log-Insight: Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis [4.172239714799967]
  We present Log-Insight, an automated incident-diagnosis system deployed in production at Huawei.<n>Our six-stage pipeline reduces millions of raw events by 1,000-7,000x while preserving statistically significant failure signals.<n>Log-Insight achieves MRR = 0.790, returning the correct root cause within the top-3 hypotheses in over 90% of runs in under a minute of latency.
  arXiv  Detail & Related papers  (2026-07-09T14:25:31Z)
• Can Large Language Models Generate Observability-Aware Code? [51.30941152293301]
  We present a systematic study of observability in agent-generated systems.<n>Our results reveal a consistent gap between diagnostic semantics at the source level and fault signals at runtime.<n>We introduce an observability-oriented skill, which can serve as a guidance to improve both diagnostic semantics and fault-signal exposure.
  arXiv  Detail & Related papers  (2026-07-07T03:20:52Z)
• Synergistic Perception-Reasoning Governance: Grounding Medical MLLMs with Verifiable Anatomical Evidence [45.78409219344429]
  Multimodal large language models (MLLMs) show strong promise for clinical VQA and radiology report generation, yet inference-time hallucinations undermine trustworthy use.<n>We propose a holistic, training-free evidence-injection framework that systematically mitigates hallucinations through dual-side evidence injection.<n>We conduct systematic evaluations on 2 tasks and 5 datasets using textttLLaVA-1.5-7B, texttLLaVA-Med-1.5-7B, texttQwen3-VL-8B/32B, and textttInternVL
  arXiv  Detail & Related papers  (2026-06-30T08:07:25Z)
• Agentic AI-based Framework for Mitigating Premature Diagnostic Handoff and Silent Hallucination in Healthcare Applications [17.69274632062373]
  Open-ended conversational agents remain prone to two critical failure modes: premature diagnostic handoff and silent clinical hallucinations.<n>We propose a multi-agent framework that addresses both issues by replacing LLM-as-a-judge'' routing with deterministic orchestration constraints.<n>We evaluate the system using simulated patient agents powered by the llama-3.1-70b-instruct model on 150 test cases.
  arXiv  Detail & Related papers  (2026-06-16T15:39:19Z)
• From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation [0.7136933021609079]
  This paper presents a unified, end-to-end framework that closes the gap between threat detection and actionable response.<n>The system operates in two tightly coupled stages. First, an ensemble of three independently trained binary Deep Neural Networks (DNNs) classifies network traffic flows as Benign, Denial of Service (DoS) or Distributed Denial of Service (DDoS)<n>Second, a Retrieval-Augmented Generation (RAG) pipeline constructs explanation-aware prompts from the top-5 anomalous features.
  arXiv  Detail & Related papers  (2026-05-18T07:17:55Z)
• Multi-Agent Systems for Root Cause Analysis in Microservices [58.95503998127531]
  LATS-RCA is a multi-agent framework for root cause analysis in MSS.<n> Reflection scores are used to guide the search toward the most likely root cause.<n>We evaluate LATS-RCA on the open-source industrial MSS, Light-OAuth2.
  arXiv  Detail & Related papers  (2026-05-05T08:39:42Z)
• Automated Self-Testing as a Quality Gate: Evidence-Driven Release Management for LLM Applications [51.56484100374058]
  We present an automated self-testing framework that introduces quality gates with evidence-based release decisions.<n>We evaluate the framework through a longitudinal case study of an internally deployed multi-agent conversational AI system.
  arXiv  Detail & Related papers  (2026-03-13T20:44:15Z)
• Arbiter: Detecting Interference in LLM Agent System Prompts [0.0]
  Arbiter is a framework combining formal evaluation rules with multi-model LLM scouring to detect interference patterns in system prompts.<n> Applied to three major coding agent system prompts: Claude Code (Anthropic), Codex CLI (OpenAI), and Gemini CLI (Google)
  arXiv  Detail & Related papers  (2026-03-09T22:29:47Z)
• Why Does the LLM Stop Computing: An Empirical Study of User-Reported Failures in Open-Source LLMs [50.075587392477935]
  We conduct the first large-scale empirical study of 705 real-world failures from the open-source DeepSeek, Llama, and Qwen ecosystems.<n>Our analysis reveals a paradigm shift: white-box orchestration relocates the reliability bottleneck from model algorithmic defects to the systemic fragility of the deployment stack.
  arXiv  Detail & Related papers  (2026-01-20T06:42:56Z)
• MicroRCA-Agent: Microservice Root Cause Analysis Method Based on Large Language Model Agents [12.160412894251406]
  MicroRCA-Agent is an innovative solution for microservice root cause analysis based on large language model agents.<n>The proposed solution demonstrates superior performance in complex microservice fault scenarios, achieving a final score of 50.71.
  arXiv  Detail & Related papers  (2025-09-19T05:57:03Z)
• MCP-Orchestrated Multi-Agent System for Automated Disinformation Detection [84.75972919995398]
  This paper presents a multi-agent system that uses relation extraction to detect disinformation in news articles.<n>The proposed Agentic AI system combines four agents: (i) a machine learning agent (logistic regression), (ii) a Wikipedia knowledge check agent, and (iv) a web-scraped data analyzer.<n>Results demonstrate that the multi-agent ensemble achieves 95.3% accuracy with an F1 score of 0.964, significantly outperforming individual agents and traditional approaches.
  arXiv  Detail & Related papers  (2025-08-13T19:14:48Z)
• RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models [46.476439550746136]
  Large language model (LLM) applications in cloud root cause analysis (RCA) have been actively explored recently. We present RCAgent, a tool-augmented LLM autonomous agent framework for practical and privacy-aware industrial RCA usage. Running on an internally deployed model rather than GPT families, RCAgent is capable of free-form data collection and comprehensive analysis with tools.
  arXiv  Detail & Related papers  (2023-10-25T03:53:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.