​

Edge v3.5.0 — Namespace Scoping & Honeycomb

v3.5.0 lets you scope which namespaces Edge maps into the resource graph, and routes Honeycomb queries through the Edge Proxy so the API key never leaves your cluster.

New:

• Namespace scoping — Allow or deny which namespaces enter the resource graph, so blast radius and dependency maps cover only the workloads that matter to you. Off by default. Learn more
• Honeycomb connector for Edge Proxy — Route Honeycomb queries through the Edge Proxy to keep the API key inside your cluster instead of storing it in NOFire. Learn more

Improvements:

• Complete graph on startup — Edge now waits for the full cluster state to load before its first publish, so a partially-loaded graph no longer prunes real services when Edge restarts.

​

Edge v3.4.0 — Observed Traffic

v3.4.0 adds observed traffic — the real calls between services, read from an observability stack you already run. Alongside the existing DNS-derived dependency map, NOFire can now trace real call paths and blast radius during an investigation.

New:

• Observed traffic — Edge maps the real service-to-service calls in your cluster, with request and error counts per service pair, auto-detecting Hubble, Istio, or Caretta. Only one source is active at a time, in that order of precedence, so the same call is never double-counted. Disabled by default. Learn more
• Per-call detail with Hubble — Where Cilium Hubble is present, Edge surfaces the HTTP method, path, and status, DNS queries (including NXDOMAIN), dropped flows, and latency percentiles that Istio and Caretta don’t.
• Namespace-scoped flow collection — Exclude noisy namespaces (kube-system and monitoring by default) from Hubble flow collection to cut CPU and bandwidth on busy clusters. Learn more

​

Platform — Workflows

NOFire Workflows let you define triggered sequences that run when a deploy, a webhook event, or a Slack slash command fires. Each workflow runs over your live system context and returns structured output — with full markdown and diagram rendering — before or during an incident.

New:

• Workflows — Define triggered sequences that run over your live system context. Connect a trigger (deploy event, webhook, or slash command) to an agent and receive structured output you can act on before a problem escalates. Learn more
• Slash commands — Invoke any workflow from Slack using a slash command. Results stream back inline, with markdown tables and Mermaid diagrams rendered in the thread.
• Webhook triggers — Register a webhook URL per workflow and call it from your CI/CD pipeline, alerting system, or any HTTP client. Each webhook is authenticated at registration time.
• Environment & cluster scoping — Each workflow runs within a specific environment and cluster, and only has access to the connections and data sources registered for that scope.
• Cancel runs — Stop a running workflow from the Workflows page or from Slack before results are returned.
• Output history — Every workflow run is saved so your team can review past results and compare outputs over time.

​

Platform — Fixes

Fixes:

• Slack bot echo — Under certain Slack retry conditions, the bot was returning the user’s message instead of the correct response.

​

Platform — Value Dashboard

The new Value Dashboard shows how much your team is relying on NOFire, how its reasoning is performing over time, and where it’s spending token budget. Every metric on the page maps to something you can act on.

New:

• Value Dashboard — New dashboard section with trust score, activity trends, per-actor and per-model LLM token spend, and per-thread feedback ratings. Learn more
• Trust score — A reliability score built from feedback ratings, weighted by a 30-day decay. Shows whether NOFire’s reasoning is improving or drifting, so you know when NOFire’s reasoning needs correction.
• Token spend breakdown — LLM spend split by actor (system vs. user-triggered) and by model, with 30-day trend sparklines per category.
• Feedback ratings — Per-thread 5-point ratings aggregated across your workspace, with response rate and rating distribution visible per time window.

​

Edge v3.3.2 — Fixes

Fixes:

• Multi-connector context — Resolved missing connector identity in multi-connector setups, where queries could arrive without the source connector identified.

​

Edge v3.3.1 — Fixes

Fixes:

• Postgres query failures — Resolved a connection handling bug that caused Postgres queries to fail under certain configurations.

​

Edge v3.3.0 — Postgres & Custom HTTP Query Routing

Edge Proxy adds two new connector types: Postgres databases and custom HTTP APIs. Both are configured within your Edge deployment and surface in NOFire automatically — queried during root-cause analysis without credentials leaving your infrastructure.

New:

• Postgres connector — Query your Postgres databases through Edge Proxy during root-cause analysis. NOFire correlates application state from the database with system signals from your observability backends. SSL mode is configurable per connection. Configuration
• Custom HTTP connector — Route calls to any HTTP API within your own network through Edge Proxy. Per-request auth headers are configured at registration time so credentials never pass through NOFire’s cloud. Configuration

Fixes:

• CVE-2026-33816 — Resolved a security vulnerability in the Postgres database driver.

​

Platform — Workflows

NOFire Workflows let you define triggered sequences that run when a deploy, a webhook event, or a Slack slash command fires. Each workflow runs over your live system context and returns structured output — with full markdown and diagram rendering — before or during an incident.

New:

• Workflows — Define triggered sequences that run over your live system context. Connect a trigger (deploy event, webhook, or slash command) to an agent and receive structured output you can act on before a problem escalates. Learn more
• Slash commands — Invoke any workflow from Slack using a slash command. Results stream back inline, with markdown tables and Mermaid diagrams rendered in the thread.
• Webhook triggers — Register a webhook URL per workflow and call it from your CI/CD pipeline, alerting system, or any HTTP client. Each webhook is authenticated at registration time.
• Environment & cluster scoping — Each workflow runs within a specific environment and cluster, and only has access to the connections and data sources registered for that scope.
• Cancel runs — Stop a running workflow from the Workflows page or from Slack before results are returned.
• Output history — Every workflow run is saved so your team can review past results and compare outputs over time.

​

Platform — Fixes

Fixes:

• Slack bot echo — Under certain Slack retry conditions, the bot was returning the user’s message instead of the correct response.

​

Platform — Value Dashboard

The new Value Dashboard shows how much your team is relying on NOFire, how its reasoning is performing over time, and where it’s spending token budget. Every metric on the page maps to something you can act on.

New:

• Value Dashboard — New dashboard section with trust score, activity trends, per-actor and per-model LLM token spend, and per-thread feedback ratings. Learn more
• Trust score — A reliability score built from feedback ratings, weighted by a 30-day decay. Shows whether NOFire’s reasoning is improving or drifting, so you know when NOFire’s reasoning needs correction.
• Token spend breakdown — LLM spend split by actor (system vs. user-triggered) and by model, with 30-day trend sparklines per category.
• Feedback ratings — Per-thread 5-point ratings aggregated across your workspace, with response rate and rating distribution visible per time window.

​

Edge v3.3.2 — Fixes

Fixes:

• Multi-connector context — Resolved missing connector identity in multi-connector setups, where queries could arrive without the source connector identified.

​

Edge v3.3.1 — Fixes

Fixes:

• Postgres query failures — Resolved a connection handling bug that caused Postgres queries to fail under certain configurations.

​

Edge v3.3.0 — Postgres & Custom HTTP Query Routing

Edge Proxy adds two new connector types: Postgres databases and custom HTTP APIs. Both are configured within your Edge deployment and surface in NOFire automatically — queried during root-cause analysis without credentials leaving your infrastructure.

New:

• Postgres connector — Query your Postgres databases through Edge Proxy during root-cause analysis. NOFire correlates application state from the database with system signals from your observability backends. SSL mode is configurable per connection. Configuration
• Custom HTTP connector — Route calls to any HTTP API within your own network through Edge Proxy. Per-request auth headers are configured at registration time so credentials never pass through NOFire’s cloud. Configuration

Fixes:

• CVE-2026-33816 — Resolved a security vulnerability in the Postgres database driver.

​

Edge v3.2.0 — Network Policy, PDB & HPA Tracking

Edge now captures three additional Kubernetes resource types in the dependency graph: NetworkPolicy, PodDisruptionBudget, and HorizontalPodAutoscaler. Together these give NOFire the context needed to reason about network segmentation, disruption blast radius, and autoscaling behavior during investigations.

New:

• NetworkPolicy tracking — Edge maps network segmentation rules in your cluster and links each policy to the pods it governs, so NOFire can answer which pods can communicate with which. Learn more
• PodDisruptionBudget tracking — PDBs and their current disruption status are now included in the graph, with edges to the pods each budget protects. NOFire can use this during rollout and node-drain investigations to assess blast radius.
• HorizontalPodAutoscaler tracking — HPAs are captured with their target workload, min/max replica bounds, metric configuration, and live scaling status. NOFire can now correlate scaling events with incidents.

Fixes:

• Duplicate graph updates under load — Under sustained load, Edge could send duplicate updates to NOFire; the timing loop now enforces a full interval between operations.

​

Platform — Honeycomb & GCP Observability

Two new observability backends are now queryable during root-cause analysis: Honeycomb and GCP. Connect either from the Connections page and NOFire queries them automatically when reasoning over an incident.

New:

• Honeycomb — Query Honeycomb traces, metrics, and logs during root-cause analysis, alongside your other connected backends. Setup guide
• GCP observability — Query Cloud Logging, Cloud Monitoring, and Cloud Trace for GCP-hosted clusters. Works alongside existing Kubernetes graph data from Edge. Setup guide

​

Platform — Autonomous Investigations

NOFire can now watch your incident channels and start investigations on its own. Invite the bot to any Slack channel used for incident response and it monitors the conversation, builds context, and kicks off a full investigation without anyone having to ask.

New:

• Incident channel monitoring — Invite @NOFire AI to an incident channel. It monitors the conversation, builds context, and starts a root-cause analysis when enough signals are present. How it works
• Configurable trigger sensitivity — Choose per workspace how quickly NOFire triggers: proactive, balanced (default), or careful. Learn more
• Postmortem generation — After an incident, ask NOFire to write the postmortem, and it drafts a structured doc from the full channel history. Learn more

​

Platform — Organizational Knowledge

You can now teach NOFire about your environment: clusters, services, log patterns, known failure modes, and team conventions. This context is applied automatically on every investigation, so NOFire starts with what your team already knows.

New:

• Knowledge Library — Write down how your environment works: service docs, runbooks, past incident patterns, dashboard guidance. NOFire applies relevant entries automatically at the start of every investigation. Learn more
• Automatic learning — After completed investigations, NOFire captures confirmed root causes and useful patterns and adds them to the library. No manual curation required.
• Feedback corrections — Mark an investigation incorrect and describe what was wrong. The correction is saved and applied the next time a similar incident occurs.
• Postmortem channel scan — Point NOFire at your postmortem Slack channels. It extracts lessons from past incidents and seeds the library automatically. Learn more

​

Edge v3.1.0 — Cloud Infrastructure Mapping & Graph Fixes

New:

• Cloud infrastructure mapping — Edge now discovers AWS and GCP resources backing your Kubernetes objects and links them in the dependency graph. Nodes map to EC2/GCE instances, PersistentVolumes link to EBS/Persistent Disk volumes, and LoadBalancer Services connect to ALB, NLB, or GCP load balancers. StorageClasses are now tracked as graph nodes. Learn more

Improvements:

• Service-to-controller graph accuracy — Services now connect to their managing controller (Deployment, StatefulSet, DaemonSet, Job) instead of linking directly to individual Pods. Pod-to-Node edges corrected to use the proper relationship type.

Fixes:

• Orphaned edges on node removal — Resolved a bug where deleting graph nodes with three or more edges left orphaned edges, causing “no source/destination node” warnings during analysis
• Sensitive data in logs — Auth tokens, configuration content, HTTP response bodies, TLS file paths, and pod IPs are no longer exposed in log output
• gRPC security patch — Upgraded gRPC dependency to v1.79.3 to address CVE-2026-33186

​

Edge v3.0.0 — On-Premises Observability Query Routing

NOFire Edge Proxy routes observability queries from Brain to data sources behind your firewall. During root cause analysis, Brain queries your Prometheus, Loki, Tempo, and other backends through a secure outbound gRPC stream — without exposing credentials or requiring inbound firewall rules.

New:

• Edge Proxy — New component that streams observability queries from Brain to on-prem data sources via outbound-only gRPC. Credentials never leave the cluster. Learn more
• 8 connector types — Prometheus, Loki, Tempo, Grafana, Elasticsearch, OpenSearch, MongoDB Atlas, and Alertmanager. Supported data sources
• PII redaction — 15 built-in patterns (emails, SSNs, credit cards, JWTs, IP addresses, and more) redact sensitive data before it leaves your network. Redaction configuration
• Outbound-only connection — No inbound firewall rules, VPNs, or tunnels required. Only outbound TCP 443. Quick start

Improvements:

• Immediate node removal — Deleted Kubernetes resources are now removed from the dependency graph immediately instead of waiting for periodic pruning. The graph always reflects current cluster state.

​

Platform — Change management, AWS topology, and self-serve billing

Root-cause analysis now includes a unified change-management view across infrastructure and code, AWS resources became navigable in the dashboard’s topology and workload views, and teams on self-serve plans can now manage their trial and billing directly in NOFire.

New:

• Change management agent — Unifies infrastructure changes and VCS commits into a single timeline for root-cause analysis to reason over. Learn more
• GitHub code analysis — NOFire now pulls the changed files and PR diffs that landed inside the incident window, so a root-cause explanation can point at the specific commit that introduced the regression.
• Token usage and cost metrics — Token usage and per-account cost are now tracked and exposed for cost attribution. Learn more
• AWS in topology and workload views — AWS entity types now appear in the dashboard’s topology and workload graphs. Learn more
• MCP Server as a connection type — Connect a remote MCP server alongside other data sources, with dedicated form, filter tab, and icon. Learn more
• Trial banner and billing page — Usage tracking surfaced inline with a billing settings page for self-serve plans.

Improvements:

• Permission-denied UI — Redesigned to make next steps clear when a user lacks access.
• Signup hardening — Personal and temporary email domains are blocked at signup.

​

Platform — AWS-first observability, new log connectors, self-serve signup

AWS support expanded significantly: Claude on Bedrock, a dedicated AWS SRE agent, and broader resource discovery shipped alongside expanded log connectors and a self-serve signup flow with AWS Marketplace billing.

New:

• AWS Bedrock for Claude — Run Claude models through Bedrock for customers who require all LLM traffic to stay inside AWS.
• AWS SRE agent — A dedicated agent that handles infrastructure, cost, and compliance questions for AWS accounts using NOFire’s resource discovery as context. Learn more
• Expanded AWS resource discovery — Beyond RDS and Aurora, NOFire now discovers EC2 instances, Auto Scaling Groups, load balancers, EBS volumes, S3 buckets, and SQS queues, and matches them back to the Kubernetes workloads they back. Learn more
• Elasticsearch and OpenSearch logs — Connector and analysis tools for both Elasticsearch and OpenSearch backends. Elasticsearch · OpenSearch
• GCP Logs — full coverage — Support extended to Cloud Run, Cloud Functions, and the remaining GCP log types. Learn more
• Datadog connection form — Add a Datadog metrics source from the dashboard. Learn more
• GitHub VCS change events — Commits and merges are captured as change events feeding root-cause analysis. Learn more
• Self-serve signup and onboarding — Signup page with Slack OAuth and email, plus a multi-step onboarding wizard. Slack OAuth
• AWS Marketplace — Subscribe and pay through AWS Marketplace, with subscription management built in.
• Private Link hint — On-prem integration forms now surface a Private Link hint where applicable.

Improvements:

• Large graph view — The dependency graph now supports filtering, multiple layout algorithms, and auto-refresh for large clusters.
• Entity details page — Drill into an entity for its current state, dependencies, and recent change events.
• Analysis page redesign — Redesigned investigation page with a simpler structure for reviewing diagnoses and evidence.
• Better-attributed rollout and config events — Change events from rollouts and config updates carry the precise source (which controller, which resource), so investigations cite the right object.

​

Platform — Conversational Slack, MongoDB Atlas, FinOps and audit agents

Slack moved from alert-only to a conversational assistant, new specialized agents joined for cost optimization and audit, and MongoDB Atlas joined the supported data sources.

New:

• Conversational Slack bot — Ask NOFire questions in Slack and get async, formatted replies — interactive triage without leaving the channel. Learn more
• MongoDB Atlas integration — Database agent reads Atlas metrics and metadata for investigations involving managed Mongo clusters. Learn more
• FinOps cost-optimization agents — Specialized agents for traces, metrics, and logs surface observability spend hotspots. Learn more
• Alerts and traces audit agents — Specialized audit agents plus dashboard audit views for alert rules and trace data quality. Learn more
• AWS Secrets Manager — Store connector credentials in AWS Secrets Manager instead of entering them directly in NOFire. Credentials stay in your AWS account and rotate without requiring changes in NOFire. Learn more
• Slack integration settings — A Slack settings page with the OAuth flow exposed in-product, so any team member can complete the Slack workspace install without needing to contact NOFire support.

Improvements:

• Database and root-cause analysis narratives — Analysis summaries read more clearly, especially for database-rooted incidents.
• Chat UX redesign — Chat surfaces NOFire’s capabilities and the entity context in-context rather than hidden in menus.
• Service name resolution — When multiple services share similar names, NOFire now correctly identifies which service an alert or question refers to before starting analysis.
• Unlinked Slack users — Slack users who haven’t connected their NOFire account now get a clear prompt explaining how to do so, instead of a silent failure.

​

Platform — Root-cause analysis v2

NOFire now classifies each question before collecting evidence and routes root-cause, triage, and service-health questions along separate evidence paths.

New:

• Smarter analysis routing — A dedicated intent-classification step reads your question first and picks the appropriate evidence path, so root-cause analysis, alert triage, and service-health questions follow different flows. Learn more

Improvements:

• Simplified connections UI — The dashboard’s connection-management flow was condensed into a single, scannable view.

​

Platform — Edge agent registration, API key types, CloudWatch and GCP logs

NOFire added a dedicated Edge connection type to the dashboard — Edge deployments now authenticate with their own API keys, separate from the personal keys used for direct MCP access. CloudWatch Logs and GCP Logs became available as data sources during root-cause analysis.

New:

• NOFire Edge agent registration — Edge now appears as a named connection type in the dashboard, with a dedicated authentication identity. Learn more
• API key types: agent vs MCP — Two distinct key types are now available: service-account keys for Edge and personal keys for MCP, with matching UI in the dashboard. Learn more
• CloudWatch Logs analysis — When investigating, NOFire can now query CloudWatch log groups directly and discovers their fields up front so it knows what to filter on. Learn more
• GCP Logs in root-cause analysis — Initial GCP Logs support is now available during root-cause analysis. Learn more
• Datadog service-dependency tracking — Edge reads service dependencies from Datadog and feeds them into the topology graph. Learn more

​

Platform — Google Cloud Logs connector and per-agent usage metrics

Google Cloud Logs joined the supported connectors and per-agent usage telemetry became available, so you can see LLM cost and usage broken down by each NOFire analysis agent.

New:

• Google Cloud Logs connector — Connect a GCP project’s logs as an investigation source. Learn more
• Per-agent usage metrics — LLM and tool usage are now attributed per analysis agent for cost and quality analysis. Learn more

​

Platform — Resilient analysis and a change timeline

If an investigation hits a transient failure mid-run, NOFire now recovers instead of dropping the whole thing, and the dashboard gained a dedicated change-timeline view.

New:

• Change-timeline screen — A dashboard view that lays out resource changes over time. Learn more

Improvements:

• Resilient investigation retries — When an individual step fails due to a transient error, NOFire retries that step rather than failing the entire investigation.

​

Platform — Change events in root-cause analysis, new dashboard UI

Recent infrastructure and config changes now feed every root-cause analysis directly, and the dashboard’s main UI shell was redesigned.

New:

• Change events in root-cause analysis — Recent infrastructure and config changes feed root-cause analysis directly, sharpening the causal chain. Learn more
• Agent API-key management — Manage Edge agent API keys from the dashboard. Learn more

Improvements:

• New dashboard UI — Refreshed top-level layout and navigation across the dashboard.

​

Platform — Multi-hop causality and Graph API v2

NOFire can now trace cause and effect across multiple hops in the dependency graph instead of stopping at the directly-connected neighbour, and the underlying graph API moved to v2.

New:

• Multi-hop causality — When investigating an incident, NOFire follows the chain of changes across structural, temporal, and multi-hop relationships in the graph, surfacing root causes that sit several services away from the symptom. Learn more
• Graph API v2 — The dependency-graph API moved to v2, powering the new dashboard graph views.

​

Platform — Causal graph, causality API, configmap and secret change events

A new view in the dashboard visualizes how change events propagate through your service dependencies during an incident. NOFire now also exposes a public API for causality results and detects Kubernetes ConfigMap and Secret changes as incident signals.

New:

• Causal-graph view — Visualizes how change events propagate through the dependency graph during an incident.
• Causality API — Public endpoints exposing the causality results, alongside an improved causal-analysis agent. Learn more
• Configmap and secret change events — Kubernetes ConfigMap and Secret changes are captured as change points, surfacing config drift during investigations. Learn more

​

Platform — RDS and Aurora in the dependency graph

AWS RDS and Aurora became visible in the dependency graph, so investigations involving managed databases can now follow service-to-database edges directly.

New:

• RDS and Aurora in the graph — RDS and Aurora resource types appear in the topology graph and the entity metadata sheet. Learn more

Improvements:

• Sharper causal explanations — Root-cause explanations are more precise and readable.

​

Platform — CloudWatch logs, traces as a datasource, Grafana IRM webhooks

CloudWatch Logs joined the inputs NOFire reads during pod investigations, traces became a connectable datasource alongside logs and infrastructure, and NOFire can now act on alerts arriving from Grafana IRM.

New:

• CloudWatch Logs for pod investigations — Connect AWS CloudWatch Logs and NOFire reads them when diagnosing pod-level issues. Learn more
• Traces as a datasource — Traces became a first-class datasource you can connect alongside logs and infrastructure. Logs, traces, and infrastructure are each optional. Learn more
• Grafana IRM webhooks — NOFire now accepts inbound webhooks from Grafana IRM so it can act on alerts as they fire, with the webhook URL exposed when you create the connection. Learn more
• Kubernetes clusters API — A clusters-listing API, sourced from connected Prometheus instances, used by the dashboard and third-party integrations. Learn more

​

Platform v1.0.0 — Proactive Reliability & Monitoring Integration

General availability of the NOFire Platform. Proactive reliability monitoring and extensive integration support to help you catch issues before they impact users.

New:

• Proactive reliability monitoring — AI-powered detection of system issues before they impact users. Learn more
• Multi-provider integrations — Connect Grafana, Datadog, Prometheus, and more. Setup guides
• Log analysis — Support for Loki, Elasticsearch, OpenSearch, CloudWatch, and Google Cloud Logs. View integrations
• Trace analysis — Tempo integration for distributed tracing. Setup guide
• Custom prompts — Configure AI analysis behavior for your specific needs. Learn more

​

Edge v1.0.0 — On-Premise Deployment

NOFire Edge deploys within your own infrastructure to capture service dependencies and query your observability data on NOFire’s behalf. Your credentials never leave your network, and no inbound firewall rules are required.

New:

• On-premise deployment — Run NOFire analysis within your infrastructure. Introduction
• Quick start guide — Get running in minutes. Quick start
• Flexible configuration — Customize Edge behavior for your environment. Configuration
• RBAC support — Role-based access control for Edge instances. Setup guide

​

Slack App v1.0.0 — Interactive Incident Management

Manage incidents directly from Slack with our new interactive app. Get real-time alerts and collaborate on resolutions without leaving your workspace.

New:

• Slack integration — Receive alerts and interact with NOFire directly in Slack. Installation
• Interactive workflows — Acknowledge, investigate, and resolve incidents from Slack. How it works

​

MCP Server v1.0.0 — AI Assistant Integration

Connect your favorite AI assistants to NOFire using the Model Context Protocol (MCP) for intelligent incident analysis and automation.

New:

• MCP protocol support — Connect AI assistants to NOFire for intelligent incident analysis. Getting started
• API key management — Secure authentication for MCP connections. Setup guide