IntentOps — Agentic FinOps Platform

"Why does this cost exist?" — Not just what the cost is, but the intent behind it.

IntentOps is an autonomous, multi-agent FinOps platform that bridges cloud costs to business intent. It uses a swarm of specialized AI agents to detect anomalies, reason about their causes, and recommend actions — all with a human-in-the-loop safety protocol.

---

Architecture Overview

┌──────────────────────────────────────────────────────────────┐
│                     INGESTION LAYER                          │
│  Slack Webhooks │ Jira Webhooks │ GitHub Webhooks │ AWS APIs │
└──────────────┬───────────────────────────────────────────────┘
               │
               ▼
┌──────────────────────────────────────────────────────────────┐
│                   CONTEXTUAL MEMORY                          │
│         Pinecone (Vector DB / RAG)  │  Neo4j (Graph DB)      │
└──────────────┬───────────────────────────────────────────────┘
               │
               ▼
┌──────────────────────────────────────────────────────────────┐
│                  MULTI-AGENT SWARM                           │
│                                                              │
│  ┌─────────────┐  ┌──────────────┐  ┌──────────────┐        │
│  │  Architect   │  │Visual Auditor│  │  Researcher  │        │
│  │ GPT-5 Mini   │  │Gemini2.5Flash│  │Perplexity    │        │
│  │              │  │              │  │Sonar         │        │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘        │
│         └─────────────────┼─────────────────┘                │
│                           ▼                                  │
│                   ┌──────────────┐                            │
│                   │ Communicator │                            │
│                   │ GPT-5 Nano   │                            │
│                   └──────────────┘                            │
│                                                              │
│              Redis Pub/Sub (Inter-Agent Bus)                  │
└──────────────┬───────────────────────────────────────────────┘
               │
               ▼
┌──────────────────────────────────────────────────────────────┐
│                     ACTION LAYER                             │
│     Slack HITL Buttons  │  Infrastructure Executor (AWS)     │
└──────────────────────────────────────────────────────────────┘

Agents

Agent	Model	Responsibility
The Architect	GPT-5 Mini	High-level cost-benefit reasoning. Classifies costs as intentional, unintentional, or attack.
Visual Auditor	Gemini 2.5 Flash	Agentic Vision inspection of CloudWatch graphs. Detects burst vs sustained traffic.
The Researcher	Perplexity Sonar	Live web search for AWS pricing changes, outages, and security incidents.
The Communicator	GPT-5 Nano	Drafts concise Slack messages with HITL approval buttons.

Reasoning Chain

When a 15%+ cost spike is detected:

1. Detection — Anomaly Detector polls AWS Cost Explorer
2. Context Retrieval — RAG pipeline queries Pinecone for Jira tickets, Slack decisions
3. Parallel Analysis:
   • Gemini 2.5 Flash inspects CloudWatch traffic graph (burst vs sustained)
   • Perplexity Sonar searches for AWS outages or pricing bugs
4. Synthesis — GPT-5 Mini combines all inputs for a final classification
5. Communication — Slack message with HITL buttons sent to the team

Safety Protocol: Every destructive action (Delete, Stop, Shrink) requires a Slack button click before execution.

Tech Stack

Component	Technology
Backend	Python 3.12, FastAPI
Frontend	React 19, Vite, TailwindCSS 4
Auth	Clerk (JWT)
Vector DB	Pinecone Serverless
Graph DB	Neo4j 5
Messaging	Redis Pub/Sub
Cloud	AWS (Cost Explorer, CloudWatch, CloudTrail)
Notifications	Slack (Bot + Interactive Components)

Project Structure

intentops/
├── app/                        # Backend (FastAPI)
│   ├── main.py                 # Application entry point
│   ├── config.py               # Settings (env-based)
│   ├── logging_config.py       # Structured logging
│   ├── auth/                   # Clerk JWT authentication
│   ├── ingestion/              # Webhook handlers + AWS collectors
│   │   ├── slack_webhook.py
│   │   ├── jira_webhook.py
│   │   ├── github_webhook.py
│   │   ├── aws_collector.py
│   │   └── visual_input.py
│   ├── memory/                 # Contextual memory layer
│   │   ├── vector_store.py     # Pinecone RAG pipeline
│   │   └── graph_store.py      # Neo4j relationships
│   ├── agents/                 # Multi-agent swarm
│   │   ├── base.py             # Base agent class
│   │   ├── architect.py        # GPT-5 Mini
│   │   ├── visual_auditor.py   # Gemini 2.5 Flash
│   │   ├── researcher.py       # Perplexity Sonar
│   │   └── communicator.py     # GPT-5 Nano
│   ├── messaging/              # Redis Pub/Sub bus
│   │   └── bus.py
│   ├── execution/              # Autonomous execution loop
│   │   ├── anomaly_detector.py
│   │   ├── reasoning_chain.py
│   │   └── scheduler.py
│   ├── actions/                # HITL + infra actions
│   │   ├── slack_notifier.py
│   │   ├── hitl_manager.py
│   │   └── infra_actions.py
│   └── routers/                # API endpoints
│       ├── health.py
│       └── dashboard.py
├── frontend/                   # React dashboard
│   ├── src/
│   │   ├── App.jsx
│   │   ├── pages/
│   │   │   ├── DashboardPage.jsx
│   │   │   ├── CostsPage.jsx
│   │   │   ├── AgentsPage.jsx
│   │   │   ├── HITLPage.jsx
│   │   │   ├── GraphPage.jsx
│   │   │   └── VisualPage.jsx
│   │   └── lib/
│   │       └── api.js
│   └── package.json
├── docker-compose.yml
├── Dockerfile
├── requirements.txt
├── .env.example
└── README.md

Quick Start

1. Clone & Configure

cd intentops
cp .env.example .env
# Edit .env with your API keys

2. Docker (Recommended)

docker-compose up -d

This starts: Backend (port 8000), Frontend (port 80), Redis (6379), Neo4j (7474/7687).

3. Local Development

Backend:

cd intentops
python -m venv .venv
.venv\Scripts\activate        # Windows
pip install -r requirements.txt
uvicorn app.main:app --reload --port 8000

Frontend:

cd frontend
npm install
npm run dev

4. Verify

• API Docs: http://localhost:8000/docs
• Dashboard: http://localhost:3000
• Health: http://localhost:8000/health
• Readiness: http://localhost:8000/ready

API Endpoints

Health

Method	Path	Description
GET	/health	Basic health check
GET	/ready	Dependency readiness check

Dashboard (Authenticated)

Method	Path	Description
GET	/api/v1/costs/daily	Daily cost breakdown
GET	/api/v1/costs/by-tag/{key}	Costs grouped by tag
POST	/api/v1/anomaly/check	Trigger anomaly check
POST	/api/v1/anomaly/analyze	Full reasoning chain
POST	/api/v1/anomaly/simulate	Simulate spike + full chain (testing)
GET	/api/v1/hitl/pending	Pending HITL actions
POST	/api/v1/hitl/{id}/resolve	Resolve HITL action
GET	/api/v1/hitl/history	Decision history
POST	/api/v1/memory/ingest	Ingest document to RAG
POST	/api/v1/memory/search	Semantic search
GET	/api/v1/graph/resource/{id}	Resource ownership chain
GET	/api/v1/graph/user/{id}/exposure	User cost exposure
GET	/api/v1/graph/orphans	Find unowned resources
POST	/api/v1/visual/analyze	Visual analysis (upload image)

Webhooks (Signature-verified)

Method	Path	Description
POST	/webhooks/slack/events	Slack events
POST	/webhooks/slack/interactions	Slack HITL button clicks
POST	/webhooks/jira/events	Jira ticket events
POST	/webhooks/github/events	GitHub push/PR events

Configuration

All configuration is via environment variables. See .env.example for the full list.

Required for full functionality:

• OPENAI_API_KEY — GPT-5 Mini/Nano (Architect + Communicator)
• GOOGLE_API_KEY — Gemini 2.5 Flash (Visual Auditor)
• PERPLEXITY_API_KEY — Sonar (Researcher)
• PINECONE_API_KEY — Vector DB (RAG)
• SLACK_BOT_TOKEN — Slack notifications + HITL
• AWS credentials — Cost data collection

The system degrades gracefully — you can run with partial credentials and the unavailable features will be skipped.

Safety

• No destructive action executes without human approval
• All Slack HITL buttons include a confirmation dialog
• The InfraActionExecutor is only callable through HITLManager.resolve_action()
• All webhook endpoints verify request signatures
• Clerk JWT authentication protects all dashboard API endpoints
• Dev mode bypasses auth for local development

License

MIT