Ismail Ben Alla

Alert Agent

MCP-Powered Incident Investigation

Agents · Jun 2026 · Completed

An AI agent that investigates data-pipeline alerts posted in Slack.

Built withGeminiMCPAirflowBigQueryGCPSlack

Code is private (company / client work)

Alert Agent — overview

Overview

On a data platform, an alert in Slack is only the start: someone still has to work out whether the cause is an Airflow pipeline, a Dataflow job, Pub/Sub, or a SQL query in BigQuery, and that means jumping between several systems.

At Dailymotion I built an LLM-powered Alert Agent that picks up these alerts and investigates them. It pairs Gemini with MCP clients and dedicated MCP servers for Airflow, GCP, and BigQuery, so the model can look into each system through its own scoped set of tools.

Giving the agent one MCP server per system kept each tool narrow and easier to describe to the model. This is internal Dailymotion work, so only a portfolio-level summary is shared here.

The question

Can an agent with scoped tools shorten the path from a Slack alert to a root cause across pipelines, Dataflow, Pub/Sub, and SQL?

Key features

How it works

  1. Alert arrives in Slack

    A data-platform alert posted in Slack is the trigger for an investigation.

  2. Gemini investigates

    Gemini, connected through MCP clients, works through the incident using the tools each system exposes.

  3. Scoped tools per system

    Dedicated Airflow, GCP, and BigQuery MCP servers give the agent narrow tools to look into pipelines, Dataflow, Pub/Sub, and SQL.

Tech stack

What I learned

Limitations