Coroot

Coroot is an open-source observability and APM platform that automatically collects metrics, logs, traces, and continuous profiles using eBPF — no code instrumentation required. It delivers AI-powered root cause analysis that can identify over 80% of issues automatically, presenting actionable insights and suggested fixes rather than overwhelming teams with raw alerts.

Built in Go with a Vue 3 frontend and backed by ClickHouse for high-performance telemetry storage, Coroot provides a unified service map covering 100% of your system, predefined inspection rules for every major database and runtime, and SLO-based alerting that consolidates all relevant findings into a single, context-rich notification.

The platform has recently added an MCP (Model Context Protocol) server, enabling AI assistants like Claude to directly query live production data — including alerts, traces, logs, and incident details — through a structured API. This makes Coroot a natural bridge between observability data and AI-powered operations workflows.

Coroot deploys as a single Docker container or Kubernetes Helm chart and integrates with Prometheus for metrics, ClickHouse for logs and traces, and all major cloud providers for cost attribution — without requiring cloud account credentials or changes to existing CI/CD pipelines.

What You Get

• Zero-instrumentation telemetry collection - Coroot uses eBPF to automatically capture metrics, logs, distributed traces, and continuous profiles from every service in your cluster, including legacy apps and third-party databases, without any code changes or SDK deployments.
• AI-powered Root Cause Analysis - The built-in RCA engine correlates telemetry across the service graph to automatically identify over 80% of production issues, presenting specific findings and suggested remediation steps rather than a flood of disconnected alerts.
• Automatic Service Map - Coroot continuously builds a live dependency-aware service map with 100% coverage, showing connection latency, error rates, and traffic volume between every service pair detected by eBPF — with no manual topology configuration.
• Continuous Profiling - One-click CPU and memory profiling down to the specific line of code, with automatic baseline comparisons that highlight anomalies introduced by deployments or configuration changes.
• Log Pattern Clustering - Automatic out-of-the-box log event clustering powered by ClickHouse, with seamless correlation to distributed traces and lightning-fast full-text search across billions of log events.
• Deployment Tracking and Regression Detection - Coroot automatically detects every Kubernetes rollout and compares performance metrics, error rates, and cloud costs before and after each release without any CI/CD integration.
• Cloud Cost Monitoring Per Application - Tracks AWS, GCP, and Azure spend broken down to the individual microservice level without requiring cloud account credentials or complex billing export configurations.
• MCP Server for AI-Assisted Operations - A built-in Model Context Protocol server lets AI assistants directly query live production data — alerts, traces, logs, incidents, and service topology — enabling AI-augmented incident response workflows.

Common Use Cases

• Diagnosing latency spikes in microservice architectures - An SRE investigating a p99 degradation uses Coroot’s service map and distributed tracing to identify the specific upstream dependency introducing latency, without having manually instrumented any of the 50+ services in the call path.
• Automatically detecting post-deployment regressions - A DevOps team uses Coroot’s deployment tracking to receive an alert the moment a new Kubernetes rollout introduces a 15% increase in error rate or memory usage, with a side-by-side comparison to the previous release.
• Monitoring databases and third-party services - A platform team observing PostgreSQL, Redis, and MySQL clusters uses Coroot’s eBPF-based instrumentation to capture query patterns, connection pool saturation, and replication lag without installing agents or modifying database configurations.
• AI-assisted incident triage - A DevOps engineer uses an AI assistant connected to Coroot’s MCP server to ask natural-language questions about open alerts, trace outliers, and recent deployment events, getting structured answers drawn directly from live production data.

Under The Hood

Architecture Coroot is structured as a Go monolith with clear package-level boundaries separating the API layer, auditing engine, data collection, caching, and notification subsystems. The main process wires together a Gorilla Mux HTTP server, a gRPC server for OTLP ingestion, a Prometheus-compatible metrics cache, and the watcher system via constructor-based dependency injection — keeping each subsystem independently testable. Static frontend assets are embedded directly in the binary using Go’s embed.FS, eliminating runtime filesystem dependencies and simplifying deployment to a single executable. A database abstraction layer supports both SQLite (for simple single-node setups) and PostgreSQL (for production HA deployments), and the ClickHouse integration handles all trace, log, and profile storage at scale.

Tech Stack The backend is written in Go 1.25 and uses ClickHouse for long-term telemetry storage, with the official ClickHouse Go client for high-throughput batch writes. Prometheus client libraries handle metrics scraping and the internal time series representation uses a custom typed timeseries package. The frontend is built with Vue 3 and compiled into the Go binary at build time. OTLP telemetry (traces, logs, profiles) is ingested over gRPC, while HTTP endpoints serve the Prometheus remote write protocol and the OpenTelemetry collector format. The platform ships a Model Context Protocol server using the mark3labs/mcp-go library, exposing structured tools for AI assistant integration. Infrastructure deployment is handled via Helm charts for Kubernetes and Docker Compose for standalone setups.

Code Quality The codebase has comprehensive test coverage across its core subsystems — time series operations, caching logic, collector configuration parsing, RBAC policies, ClickHouse query generation, and Prometheus client behavior all have dedicated test suites using the testify assertion library. The auditor package is particularly well-structured, with each inspection domain (CPU, memory, SLO, network, per-database type) isolated in its own file. Error handling is explicit throughout, with meaningful context added at call sites. Go idioms are consistently applied across naming conventions, interface design, and package boundaries.

What Makes It Unique Coroot’s distinguishing technical approach is the combination of eBPF-based universal instrumentation with a structured inspection engine and an AI RCA layer — applied across a unified data model that correlates metrics, logs, traces, and profiles. Unlike traditional APM tools that require per-language agents, Coroot’s eBPF instrumentation works at the kernel level and covers any process without code access. The addition of a native MCP server is particularly forward-looking: it lets AI assistants directly query live production state using typed tool calls rather than screen-scraping a UI, making Coroot a first-class participant in AI-assisted operations workflows.

Self-Hosting

Coroot is licensed under the Apache License 2.0, which is one of the most permissive open-source licenses available. You can use it commercially, modify it, distribute it, and build proprietary products on top of it — with no copyleft obligations that would require you to open-source your own code. The only requirements are retaining the copyright and license notices. This makes Coroot genuinely free to run in production environments of any scale without legal restrictions.

Running Coroot yourself requires deploying the main container plus the coroot-node-agent DaemonSet on Kubernetes (which handles eBPF instrumentation on each node) and optionally a ClickHouse cluster for trace, log, and profile storage at scale. For small setups, the bundled SQLite backend and an embedded ClickHouse-compatible store suffice. You are responsible for keeping agents up to date, managing ClickHouse storage capacity, configuring alerting destinations (Slack, PagerDuty, OpsGenie, etc.), and planning for high availability if required. The release cadence is aggressive — multiple releases per month — which means staying current requires active maintenance attention.

Coroot offers an Enterprise Edition (Coroot EE) with additional capabilities beyond the open-source Community Edition. The enterprise tier adds advanced SSO and RBAC features, multi-cluster management, enhanced AI analysis quotas, SLA-backed support, and direct access to the engineering team. Self-hosters on the community edition rely on GitHub Issues, community Slack, and GitHub Discussions for support. If your organization needs guaranteed response times, centralized multi-cluster visibility, or the AI RCA features at higher scale, evaluating the enterprise offering or the Coroot Cloud managed service is worth factoring into the decision.