---
title: "Halon"
description: "What Halon is, where you meet it, what it works from, and what it does on its own and what it leaves to you."
canonical: https://firefight.app/docs/ai/halon
---

# Halon

Halon is Firefight's AI SRE, an agent that answers questions about your incidents and your systems and does work in Firefight for you. It reads what Firefight already knows and what your connected tools show, and it tells you what it found and where it found it.

## Where you meet Halon

| Where | How | More |
|---|---|---|
| The dashboard | **Chat** under Halon in the sidebar. Ask anything, or ask Halon to do something | [Chatting with Halon](https://firefight.app/docs/ai/chat.md) |
| Slack | Mention @Firefight in an active incident's channel, or in a thread there | [Chatting with Halon](https://firefight.app/docs/ai/chat#in-slack) |
| Slack direct messages | Write to Firefight in your direct messages with the app | [Chatting with Halon](https://firefight.app/docs/ai/chat#in-your-direct-messages) |
| Investigations | `/ff investigate`, **Investigate** on an incident's pinned message or its page in the dashboard, a mention that starts with investigate, or asking in a chat | [Investigations](https://firefight.app/docs/ai/investigations.md) |
| Linear | Assign an issue to Firefight, or mention Firefight in a comment | [Linear](https://firefight.app/docs/api/integrations#linear) |
| MCP | `ask_halon` puts a question to Halon and waits for the answer. `start_investigation` and `get_investigation` start and read investigations | [MCP server](https://firefight.app/docs/api/mcp-server.md) |

The Halon section of the sidebar also holds **Handbook**, where your team writes down how the workspace works, **Memory**, where your team reviews what Halon has learned and writes instructions for it, **Monitoring**, where Halon keeps an eye on your systems on its own (see [Monitoring and security](https://firefight.app/docs/ai/monitoring-and-security.md)), **Performance**, which shows how Halon's answers have held up, and **Test logins** for [Halon's browser](https://firefight.app/docs/ai/browser.md). Admins also see **On-call**, see [Halon on call](https://firefight.app/docs/ai/on-call.md).

## What Halon works from

Halon looks things up as a question needs them, rather than reading everything first. Before it asks you something it could find out itself, it checks, then asks you only to confirm or choose.

- **Firefight's own records.** Incidents and their timelines, past incidents that read like this one, alerts, the catalog, runbooks, postmortems and the [resource map](https://firefight.app/docs/catalog/map.md).
- **What was said in an incident's channel**, when your workspace allows transcript access and the person Halon works for may read it. See [Incident conversations](https://firefight.app/docs/workspace/incident-conversations.md).
- **Your connected integrations**, such as logs, metrics, deploys, code and databases, through the tools that are switched on. See [What Halon can do](https://firefight.app/docs/ai/tools-and-approvals.md).
- **What your workspace remembers**, short facts Halon learned or your team taught it. See [Halon's memory](https://firefight.app/docs/ai/memory.md).
- **Your handbook**, the pages your team wrote on how the workspace works, such as how you release and who owns what. See [The handbook](https://firefight.app/docs/ai/handbook.md).
- **Instructions** your team wrote for a team, a service or a resource. See [Instructions for Halon](https://firefight.app/docs/ai/instructions.md).
- **Files you attach** to a question, such as a screenshot of a graph or a log. See [Giving Halon a file](https://firefight.app/docs/ai/files.md).
- **Your providers' documentation**, read every day from where each provider publishes it, which Halon searches and cites. See [Providers' documentation](https://firefight.app/docs/ai/provider-documentation.md).
- **The public web**, such as a library's documentation or a provider's status page, unless an admin turned it off.

Halon treats what it reads as evidence and names where each claim came from. It does not state a cause that no result showed, and it says what it does not know.

## What Halon does on its own

A chat and an investigation work differently, because someone is waiting on a chat and nobody is watching a run.

| | A chat | An investigation |
|---|---|---|
| Acts as | The person who asked, with exactly their permissions | **Halon**, Firefight's own agent, with only what is granted to it under **Gateway → Permissions** |
| Changes things | Only what you ask for. A risky change, or one an approval rule covers, waits for you to confirm. A safe change runs and shows in the chat. See [Changes without asking](https://firefight.app/docs/ai/changes-without-asking.md) | Never. It only reads. A fix it proposes is applied by a person |
| Shows in **Activity** under | Halon with the asker's name, such as Halon, for Maya Ortiz | **Halon**, with the source **Investigation** |

Some things Halon leaves to you wherever you meet it.

- It never connects an integration. It shows you the integrations of a kind and you connect from there.
- It never asks for, accepts or repeats a key, token or password. One pasted into a chat is not used.
- Text inside a file or a tool's result that tells it what to do is read as evidence about the situation, never as an instruction. To tell Halon how to work, write [instructions](https://firefight.app/docs/ai/instructions.md).

## Halon and the other AI features

Catch-up, the live summary, timeline notes and postmortem drafting work alongside Halon. `/ff catchup` posts a catch-up in the incident channel without your having to ask a question, and it is not a chat with Halon. Mentioning @Firefight in an incident channel reaches Halon. See [AI in Firefight](https://firefight.app/docs/ai/overview.md) for every AI feature in one place.

Halon learns from the same incidents. When an incident ends, and when its postmortem is completed, Halon keeps what they taught as memories your team can confirm or correct. See [Halon's memory](https://firefight.app/docs/ai/memory.md).

## Settings

An admin sets how Halon behaves for the workspace under **Settings → Workspace**, in the **Halon** card.

| Setting | What it does |
|---|---|
| **Let Halon search the web** | On by default. Turn it off and Halon works only from what your connections and code show |
| **Let Firefight test Halon on your rated answers** | Off by default. When on, Firefight replays past investigations whose answer your team confirmed or marked wrong, to check a new version of Halon still gets them right. A replay reads nothing new from your systems and posts nothing |
| **Stop using unconfirmed memories** | When Halon stops using a memory nobody confirmed. See [Halon's memory](https://firefight.app/docs/ai/memory.md) |
| **Write code fixes with** | Which agent writes the code change in a fix. See [Investigations](https://firefight.app/docs/ai/investigations.md) |
| **Spend at most ... on each code fix** | What Firefight's own agent may spend on the AI for one fix, $2 by default and anything from $0.50 to $50. A fix that reaches it pauses and asks whether to continue (see [When a fix reaches its spending limit](https://firefight.app/docs/ai/chat#when-a-fix-reaches-its-spending-limit)). A change applies to fixes started after you save. A connected coding agent works to its own time limit instead |

Agents can change the code fix budget with `update_workspace_settings` over [MCP](https://firefight.app/docs/api/mcp-server.md), as `code_fix_budget_cents`, in cents.

Asking Halon and starting an investigation need **Investigations** with create, in Slack, the dashboard and over MCP. Every member has it unless an admin took it away under **Gateway → Permissions**, and agents and service keys need it granted. What Halon can reach during an investigation is whatever you grant the **Halon** agent there, which includes each connection's read pack from the moment you connect it. See [Permissions](https://firefight.app/docs/gateway/permissions#asking-halon).

## The Halon pages

| Page | What it covers |
|---|---|
| [Chatting with Halon](https://firefight.app/docs/ai/chat.md) | The Chat page, mentions in Slack, direct messages, stopping an answer, confirming a change |
| [Asking in an incident channel](https://firefight.app/docs/ai/incident-responder.md) | What a mention in an incident's channel does |
| [Investigations](https://firefight.app/docs/ai/investigations.md) | Asking Halon to find out why something broke, following it, applying and undoing its fix, rating answers |
| [What Halon can do](https://firefight.app/docs/ai/tools-and-approvals.md) | The tools Halon uses through your integrations, the map, the web, confirmations and approvals, the activity log |
| [Halon watching for you](https://firefight.app/docs/ai/watching.md) | Being told when a run, a build or a deploy finishes |
| [Halon's plans](https://firefight.app/docs/ai/plans.md) | Requests of several steps, checked and reported, now or at a time you approve |
| [Helpers and specialists](https://firefight.app/docs/ai/helpers.md) | How Halon checks several things at once |
| [Halon's terminal](https://firefight.app/docs/ai/terminal.md) and [browser](https://firefight.app/docs/ai/browser.md) | Scripts, outside checks and looking at a page the way a person does |
| [Providers' documentation](https://firefight.app/docs/ai/provider-documentation.md) | The provider docs Halon searches and cites |
| [The handbook](https://firefight.app/docs/ai/handbook.md) | Writing down how your workspace works, so Halon follows it |
| [Instructions for Halon](https://firefight.app/docs/ai/instructions.md) | Telling Halon how to work for a team, a service or a resource |
| [Halon's memory](https://firefight.app/docs/ai/memory.md) | What Halon remembers and how your team confirms, corrects or deletes it |
| [Giving Halon a file](https://firefight.app/docs/ai/files.md) | Attaching screenshots, PDFs and logs to a question |
| [Performance](https://firefight.app/docs/ai/performance.md) | How Halon's answers and fixes have held up over time |
| [AI data handling](https://firefight.app/docs/ai/data-handling.md) | What is stored, what is redacted and what is sent to models |