DupTrace

Overview

DupTrace is an evidence-first incident investigation assistant built to help engineers move from an alert to a defensible investigation. It connects a conversational interface to read-only tools for inspecting service health, active incidents, deployments, events, and investigation context.

The problem

During an incident, engineers often have to correlate several signals quickly. A deployment shortly before an alert is a useful lead, but timing alone does not prove that the deployment caused the incident. Investigation tools should preserve that distinction rather than turn a plausible hypothesis into a confident but unsupported conclusion.

What it does

• Retrieves structured service, incident, deployment, and event evidence through read-only MCP tools.
• Builds an investigation timeline and correlates signals across the available evidence.
• Keeps observed facts separate from hypotheses and explicitly marks causality as unconfirmed when the evidence does not establish it.
• Streams assistant responses to the interface with Server-Sent Events.
• Preserves provider-specific response parts when handling model fallbacks, and renders assistant Markdown without injecting raw HTML.

Architecture

The application uses a Next.js frontend with an Express backend and an in-process Model Context Protocol server. The assistant calls a bounded set of read-only investigation tools, while the backend validates tool activity and carries verified follow-up context between turns.

The included incident scenario uses deterministic fixture data. It demonstrates the investigation workflow and evidence boundaries; it is not a live telemetry integration.

Engineering focus

DupTrace explores practical agent orchestration, tool boundaries, incident evidence modeling, streaming UX, and reliability under model-provider failure. Its central design rule is simple: report what the evidence shows, label what remains a hypothesis, and never present correlation as proof of cause.

Links

• Live demo
• Source code