A stack held together with glue
An alerting tool, a chat thread, a doc template, a status page. You stitch them together with a process doc, and it comes apart in the heat of the moment.
Open Source Built For Slack Agent Ready
Code Breaks Fix it without leaving Slack
Open-source incident management for Slack. One command opens the channel, pulls in the right people, and captures everything as it happens. When it is over, the postmortem is already drafted.
Sign in with Slack14 days free, then $99 a month per workspace. Nobody on the team needs a seat.
-
AGPL-3.0, every feature
Nothing is held back for a paid tier. Read the code, change it, and run your own version.
-
Your servers or ours
Let us host it, with patches and upgrades handled for you. Or run the same platform on your own servers.
-
One price for your whole team
$99 a month per workspace, with $25 of AI included every month. Nobody on the team needs a seat.
-
Integrates with anything
A versioned REST API, outbound webhooks, and an MCP server your AI agents can act through.
The Problem
Incident management shouldn't be this painful
Your team already lives in Slack.
Incidents come with enough pressure. The process should not add more.
The first 20 minutes go to setup
Opening the channel, finding the right people, posting the first update. By the time everyone is in the room, the incident has had a head start.
Answers buried in threads
Critical details are trapped in DMs, threads, and dashboards. Anyone joining late has to wade through hundreds of messages to learn what everyone else already knows.
The fix ships, the write-up waits
Someone still has to rebuild the timeline, chase the follow-ups, and write the postmortem, usually after hours. So it gets skipped, and the same incident comes back two months later.
Built to resolve. Designed for Slack.
FireFight connects your tools, teams, and timelines so every incident is captured, automated, and resolved without leaving your workflow.
Slack-native
Run every incident directly in Slack. FireFight lives where your team already works. Create incidents, assign roles, and post updates without leaving Slack.
- Run incidents in Slack
- Capture incident timelines
- Assign clear owners
- Stakeholders follow along without pinging you
Integrations
Webhooks, API and MCP that keep everything in sync. Subscribe to incident events with webhooks, manage incidents through our REST API, or let AI agents work them over MCP.
- Stream incidents via webhooks
- Sync monitoring and tickets
- Query data with API
- Keep Slack always updated
Postmortem
Postmortems that write themselves. FireFight's AI turns every incident into a clear story you can learn from, automatically pulling timelines, decisions, and Slack context into one place.
- AI-drafted timeline
- Assign follow-up owners
- Find similar past incidents
- Publish in minutes
Catalogue
Never wonder who owns what. Define your teams, services, and environments once, and attach the runbook each one needs. When an incident starts, the owner, the context, and the steps to take are already in the channel.
- Teams, services, and environments
- An owner on every one
- Runbooks attached automatically
- Custom catalog types
Dashboard
Your incidents in the dashboard, in step with Slack
The channel runs the response. The dashboard holds the full record, and every change made in either one shows in the other.
-
Follow along without joining the channel
Support, leadership or anyone curious can watch the incident unfold on its page. Every update, role change and step Halon takes shows up the moment it happens.
-
The same dialogs as Slack
Declare, post an update, assign roles and resolve with the forms your workspace configured, from either surface.
-
The whole record
Status, severity, roles, the timeline, action items, alerts, runbooks and the postmortem, on one page per incident.
Halon
Halon finds the cause and ships the fix
Halon is the open-source AI SRE. It investigates production incidents, proves the root cause, and ships the fix.
-
Starts from the signal
It reads the metrics, logs and errors to find when the trouble really began, then every deploy and merge just before it, and ranks the suspects.
-
Reads your code, not a summary
Each run gets a sandbox with every commit of your repositories, so it can check that a method exists before it blames the data.
-
Challenges every finding
Each finding is tested against the evidence it cites before it posts. Any claim that evidence does not show is removed.
-
Answers where you asked
Ask Halon in any channel, even before anyone declares an incident, or press Investigate on one. Every step shows in Slack as it runs.
What Halon knows
- Resource map Read from connections
- Catalog Kept by your team
- Handbook Approved by your team
- Memory Confirmed by your team
- Incident history Recorded by FireFight
- Connected tools Read live
Resource map
See everything you run, and what breaks with it
Firefight maps your clouds, services, databases and code on its own, and keeps it current. When something fails, you see at a glance what depends on it and who owns it.
Alert ingestion
Built for retries, duplicates, flapping and alert storms
Monitoring tools do not send one clean alert. They send the same one five times, then four hundred at once at 3am. FireFight sorts that out before anyone is notified.
-
One alert, not five
However many times your monitoring resends the same alert, your team sees one and deals with one.
-
Flapping stays quiet
An alert that clears and comes straight back is still one problem. Nobody is notified twice for it.
-
Storms become one incident
When related alerts fire at once they land in one incident, with one channel and one timeline. Not forty channels with nobody in charge.
-
Noise cannot bury a real incident
A misconfigured monitor firing nonstop is held at the door. The alert that matters still gets through.
Ability Gateway
Give agents real access, without handing over the keys
Agents read the same incident record a responder sees, over MCP and the REST API. Grant access capability by capability. Nothing runs unless you allowed it, and every attempt is recorded. When an answer lives in Datadog, Grafana, Sentry or your database, FireFight asks for it there. It is not another place your logs, metrics and traces have to live.
Works with
-
Claude Code -
Codex -
Cursor - Claude.ai
What they can reach
Firefight discovers what each tool can do. Switch off any you do not want. Changes still need a grant.
Code
- Pull requests merged before the alert
- The deploy that lines up with it
- A file, fetched on demand
Telemetry and errors
- Logs, metrics and traces
- Monitors and dashboards
- Error issues and releases
Issues and knowledge
- Runbooks pulled in as context
- Architecture pages
- Follow-up work opened from the incident
Databases
- Read-only data checks
- Schema and table lookups
- Scoped to one environment
Anything else that speaks MCP connects the same way, with no code from us How It Works
Operational in minutes, not weeks
The process lives in the tool, not in one person's head.
A new joiner can run their first incident on day one.
- 01 Sign in Create your FireFight account
- 02 · One click Install to Slack Connect FireFight to Slack
- 03 Start responding Declare your first incident
Setup takes under 5 minutes
Open Source
We're open source.
Read exactly how Firefight handles your alerts, what Halon can do and what it keeps. Run it on your own servers, or let us host it.
Star on GitHub
Questions
The things teams ask before they switch
If your question is not here, the answer is probably in the docs, and if it is not, we reply to every message.
-
Does everyone on the team need a paid seat?
No. There is one plan, $99 a month per workspace at the early adopter price, and it covers your whole team. Everyone can declare incidents, take roles, post updates, and ask Halon without changing what you pay. It includes $25 of AI every month, and you can top up or bring your own AI key.
See pricing -
Is FireFight really open source, or is it open core?
The whole platform is AGPL-3.0. There is no separate paid edition of the source and no feature held back for the hosted version. If you self-host, you are running the same thing we run.
-
How long does setup actually take?
Sign in, install the Slack app, declare your first incident. There is nothing to configure beforehand, because statuses, severities, roles, and the incident form all ship with working defaults you can change whenever you want.
-
What does the AI do during an incident?
It keeps a running summary of the channel, so anyone joining late can run /ff catchup and be current in a few seconds. Mention it and it answers questions about the incident from that incident’s own record. When the incident closes it drafts the postmortem from the timeline and the discussion, and it will rewrite any passage of that draft when you tell it how.
-
Do you train AI models on our data?
No. We do not use your data to train AI models, and we do not use any provider or setting that would allow anyone else to. FireFight works one incident at a time, from that incident’s own channel and timeline, and nothing else in your workspace is touched. Known credential formats are stripped before anything is saved, and everything saved is encrypted. Self-host and none of it leaves your own infrastructure.
What is stored, what is redacted, and what reaches a model -
Can AI agents change things in our systems?
Only what you have explicitly granted. Every ability is given to a named agent for a named environment, nothing is on by default, and you can take any of it back at any time. Anything high risk waits for a person to approve it. Every attempt is recorded whether it was allowed or refused, so you can always see what an agent did and what it was stopped from doing.
How permissions, approvals and the activity record work -
What happens when the same alert fires ten times?
Your team sees one alert and one incident. An alert that clears and comes back is still that one alert, and a burst of related alerts becomes one incident with one channel. A monitor stuck firing nonstop is held back so a real alert still gets through.
How alerts are grouped and deduplicated -
Does it work with the tools we already run?
FireFight connects to GitHub, GitLab, Datadog, Grafana, New Relic, Sentry, Linear, Notion, Confluence, and Postgres on Neon, Supabase, or PlanetScale. Anything else that speaks MCP can be connected directly, and outbound webhooks plus a versioned REST API cover whatever is left.
-
What happens when the trial ends?
You add a card when you start the trial, and it is first charged when the trial ends, unless you cancel before then. If that payment does not go through, the workspace pauses until an admin updates the card, and everything you already have stays exactly where it is.
-
What if we want to leave?
Cancel under Settings, Billing at any time. There is no contract and no cancellation fee, and the workspace keeps working until the end of the period already paid for. After that your data is kept for 90 days in case you come back, then permanently deleted. If you would rather keep running FireFight without us, self-hosting is the same software and free.
Your next incident is already on its way
Install FireFight in your Slack today. Setup takes five minutes.
Sign in with Slack14 days free, cancel whenever you like. Or run it on your own servers.
Get notified when something ships