Kloudfuse gives you an AI SRE that investigates incidents, a governed way for your own AI assistants to query production, and tracing for the AI you ship. All three run on one data lake in your own VPC, under the access controls your engineers already work under.
# kloudfuse / ai / live · running in your VPC ask "why did checkout error rate spike at 14:02?" auth signed in as the engineer · toolsets: apm, logs query 3 traces · 47 log lines · correlated in one lake llm model span 1.80s · retrieval 142ms · same trace # the agent connects to the server # your telemetry stays where it is
Every vendor will ship an AI feature this year. The real question is whose cloud it runs in, whose identity it uses, what it is allowed to touch, and whether the engineer stays in control.
An agent that investigates, a governed door for the agents you already use, and observability for the AI you ship. All on the same lake, under the same RBAC, and in all three the engineer stays the one who decides. A context-aware assistant inside the product follows.
Dexter, the Kloudfuse AI SRE, onboards the way a new engineer does, learning your services, dependencies and incident history. It investigates across everything inside your boundary and hands back a drafted RCA with the evidence attached. A proposal, not a change.
Your engineers already have an AI assistant open. The Kloudfuse MCP server is the governed door between it and your production telemetry, whether that is Claude, Cursor, Codex or something your team wrote. One deployment serves the organization, and your data never moves to reach it.
The model call lands as a span in the same trace and the same lake as the API around it. But the call was never the hard part. Tracing was built for services calling services, and now agents call agents, where every step depends on what the last tool returned and no single step looks wrong alone. Agentic observability is tracing catching up with what it is now tracing.
An agent pointed at raw telemetry invents metric names, invents label values, and answers confidently from nothing. Everything in the Kloudfuse AI layer is built so it has to check first.
Before querying, the agent can list the metric names, log labels and label values that actually exist in your cluster. It works from what is there rather than what a model expects to be there.
Kloudfuse documentation is exposed to the agent as a toolset of its own, so query syntax and platform behavior come from the current docs rather than from whatever the model absorbed about some other vendor's query language.
Define several connections against the same cluster with different scopes, and point separate connections at separate clusters, so an agent working on staging can never pull from production.
Three industries, three different reasons for needing the data to stay put, one architecture underneath.
Vendor AI features and AI-native observability look adjacent on a feature list. They differ on who controls the data, the identity and the record.
| Vendor AI features | Kloudfuse | |
|---|---|---|
| Where the AI runs | The vendor's cloud | Your VPC |
| Which agents work | The vendor's own assistant | Any MCP client: Claude, ChatGPT, Cursor, Gemini CLI, custom |
| Identity on AI queries | Vendor-side identity | OAuth 2.1 with your SSO, policies set All, None or Filtered per stream |
| Runaway query protection | Whatever the vendor runs internally, with nothing for you to see or tune | Query Safety Mode validates every query before it runs, and tells the agent which limit it hit |
| Audit trail | Held in the vendor's system, at the vendor's retention | Every MCP query logged in your own lake: user, prompt, generated query, duration |
| LLM telemetry | Separate product, separate store | Same lake, same query languages, same RBAC |
| Agent scoping | One assistant with whatever access it was given, not adjustable by you | Nine toolsets, selected per connection |
| Cost of the AI itself | Metered by the vendor, per feature | Your own model, your own inference cost, every token accounted for in your lake |
No. The MCP server runs against your data lake, inside your VPC. The agent connects to the server. Your data does not move to the agent or to a vendor cloud.
The remote server supports OAuth 2.1 with Dynamic Client Registration, so a client registers itself on first connection and the user signs in through the SSO they already run, whether that is Okta, Azure AD, Google or SAML. They get a short-lived token bound to their identity. Headless and programmatic clients use a service account token instead, scoped to that account's policy.
Yes, on two levels. Toolsets narrow the surface: expose only the tools you want on a given connection, and define several connections against the same cluster with different scopes. Underneath that, RBAC policies decide which streams the identity can query at all. Toolset scoping applies to the remote server; the local Docker container exposes the full set.
Query Safety Mode validates every AI-generated query before it reaches the storage engine. It rejects bare selectors with no filters, caps the ratio between lookback and resolution, and refuses queries that would return an impractical number of data points. The rejection explains which limit was hit, so the agent reformulates rather than retrying blind.
No. LLM spans flow into the same unified data lake as your APM traces, with the same query languages, the same retention and the same stream-level access control.
There is no AI surcharge on top of your Kloudfuse license. Dexter runs on a model inside your own VPC, so you pay your own inference cost directly. If you connect an external provider you pay that provider at their rate, with no markup in between.

Audited by third parties, not asserted by us. Deployment inside your own VPC means residency and data-handling requirements are governed by your controls, not ours.
Thirty minutes on your telemetry. The cause, before the call ends.