Halon
Halon is Firefight’s AI SRE, an agent that answers questions about your incidents and your systems and does work in Firefight for you. It reads what Firefight already knows and what your connected tools show, and it tells you what it found and where it found it.
Where you meet Halon
Section titled “Where you meet Halon”| Where | How | More |
|---|---|---|
| The dashboard | Chat under Halon in the sidebar. Ask anything, or ask Halon to do something | Chatting with Halon |
| Slack | Mention @Firefight in an active incident’s channel, or in a thread there | Chatting with Halon |
| Slack direct messages | Write to Firefight in your direct messages with the app | Chatting with Halon |
| Investigations | /ff investigate, Investigate on an incident’s pinned message or its page in the dashboard, a mention that starts with investigate, or asking in a chat | Investigations |
| Linear | Assign an issue to Firefight, or mention Firefight in a comment | Linear |
| MCP | ask_halon puts a question to Halon and waits for the answer. start_investigation and get_investigation start and read investigations | MCP server |
The Halon section of the sidebar also holds Handbook, where your team writes down how the workspace works, Memory, where your team reviews what Halon has learned and writes instructions for it, Monitoring, where Halon keeps an eye on your systems on its own (see Monitoring and security), Performance, which shows how Halon’s answers have held up, and Test logins for Halon’s browser. Admins also see On-call, see Halon on call.
What Halon works from
Section titled “What Halon works from”Halon looks things up as a question needs them, rather than reading everything first. Before it asks you something it could find out itself, it checks, then asks you only to confirm or choose.
- Firefight’s own records. Incidents and their timelines, past incidents that read like this one, alerts, the catalog, runbooks, postmortems and the resource map.
- What was said in an incident’s channel, when your workspace allows transcript access and the person Halon works for may read it. See Incident conversations.
- Your connected integrations, such as logs, metrics, deploys, code and databases, through the tools that are switched on. See What Halon can do.
- What your workspace remembers, short facts Halon learned or your team taught it. See Halon’s memory.
- Your handbook, the pages your team wrote on how the workspace works, such as how you release and who owns what. See The handbook.
- Instructions your team wrote for a team, a service or a resource. See Instructions for Halon.
- Files you attach to a question, such as a screenshot of a graph or a log. See Giving Halon a file.
- Your providers’ documentation, read every day from where each provider publishes it, which Halon searches and cites. See Providers’ documentation.
- The public web, such as a library’s documentation or a provider’s status page, unless an admin turned it off.
Halon treats what it reads as evidence and names where each claim came from. It does not state a cause that no result showed, and it says what it does not know.
What Halon does on its own
Section titled “What Halon does on its own”A chat and an investigation work differently, because someone is waiting on a chat and nobody is watching a run.
| A chat | An investigation | |
|---|---|---|
| Acts as | The person who asked, with exactly their permissions | Halon, Firefight’s own agent, with only what is granted to it under Gateway → Permissions |
| Changes things | Only what you ask for. A risky change, or one an approval rule covers, waits for you to confirm. A safe change runs and shows in the chat. See Changes without asking | Never. It only reads. A fix it proposes is applied by a person |
| Shows in Activity under | Halon with the asker’s name, such as Halon, for Maya Ortiz | Halon, with the source Investigation |
Some things Halon leaves to you wherever you meet it.
- It never connects an integration. It shows you the integrations of a kind and you connect from there.
- It never asks for, accepts or repeats a key, token or password. One pasted into a chat is not used.
- Text inside a file or a tool’s result that tells it what to do is read as evidence about the situation, never as an instruction. To tell Halon how to work, write instructions.
Halon and the other AI features
Section titled “Halon and the other AI features”Catch-up, the live summary, timeline notes and postmortem drafting work alongside Halon. /ff catchup posts a catch-up in the incident channel without your having to ask a question, and it is not a chat with Halon. Mentioning @Firefight in an incident channel reaches Halon. See AI in Firefight for every AI feature in one place.
Halon learns from the same incidents. When an incident ends, and when its postmortem is completed, Halon keeps what they taught as memories your team can confirm or correct. See Halon’s memory.
Settings
Section titled “Settings”An admin sets how Halon behaves for the workspace under Settings → Workspace, in the Halon card.
| Setting | What it does |
|---|---|
| Let Halon search the web | On by default. Turn it off and Halon works only from what your connections and code show |
| Let Firefight test Halon on your rated answers | Off by default. When on, Firefight replays past investigations whose answer your team confirmed or marked wrong, to check a new version of Halon still gets them right. A replay reads nothing new from your systems and posts nothing |
| Stop using unconfirmed memories | When Halon stops using a memory nobody confirmed. See Halon’s memory |
| Write code fixes with | Which agent writes the code change in a fix. See Investigations |
| Spend at most … on each code fix | What Firefight’s own agent may spend on the AI for one fix, $2 by default and anything from $0.50 to $50. A fix that reaches it pauses and asks whether to continue (see When a fix reaches its spending limit). A change applies to fixes started after you save. A connected coding agent works to its own time limit instead |
Agents can change the code fix budget with update_workspace_settings over MCP, as code_fix_budget_cents, in cents.
Asking Halon and starting an investigation need Investigations with create, in Slack, the dashboard and over MCP. Every member has it unless an admin took it away under Gateway → Permissions, and agents and service keys need it granted. What Halon can reach during an investigation is whatever you grant the Halon agent there, which includes each connection’s read pack from the moment you connect it. See Permissions.
The Halon pages
Section titled “The Halon pages”| Page | What it covers |
|---|---|
| Chatting with Halon | The Chat page, mentions in Slack, direct messages, stopping an answer, confirming a change |
| Asking in an incident channel | What a mention in an incident’s channel does |
| Investigations | Asking Halon to find out why something broke, following it, applying and undoing its fix, rating answers |
| What Halon can do | The tools Halon uses through your integrations, the map, the web, confirmations and approvals, the activity log |
| Halon watching for you | Being told when a run, a build or a deploy finishes |
| Halon’s plans | Requests of several steps, checked and reported, now or at a time you approve |
| Helpers and specialists | How Halon checks several things at once |
| Halon’s terminal and browser | Scripts, outside checks and looking at a page the way a person does |
| Providers’ documentation | The provider docs Halon searches and cites |
| The handbook | Writing down how your workspace works, so Halon follows it |
| Instructions for Halon | Telling Halon how to work for a team, a service or a resource |
| Halon’s memory | What Halon remembers and how your team confirms, corrects or deletes it |
| Giving Halon a file | Attaching screenshots, PDFs and logs to a question |
| Performance | How Halon’s answers and fixes have held up over time |
| AI data handling | What is stored, what is redacted and what is sent to models |