First Investigation

With the Quickstart server running:

curl --fail-with-body http://127.0.0.1:8090/api/v1/chat \
  -H 'Authorization: Bearer example-token' \
  -H 'Content-Type: application/json' \
  --data '{"messages":[{"role":"user","content":"What should I check for sustained high CPU?"}]}'

The response contains answer, activity, capability_gaps, and-when audit is enabled-run_id. activity is host evidence of tool calls. Akritas first retrieves local guidance, then forces a structured investigation plan, validates its selected authorized read-only tools and arguments, executes every accepted planned check, and gives the resulting evidence to the final model request. A recommendation in answer is not evidence that a check ran. capability_gaps names steps for which no suitable authorized execution tool was available.

Add local context by following Local Context / RAG, or use the complete incident demo under demos/incident-response.