我们持续集成团队的一位工程师，将带大家了解他构建的、为 Anthropic 的 CI 事件响应提供支持的智能体。
Category Enterprise AI Agents Claude Code
Product Claude Tag
Date August 18, 2026
Reading time 5 min
Share Copy linkhttps://claude.com/blog/ai-ci-cd-on-call
Author(s) Sachin Malhotra
使用我们的设置套件，搭建属于你自己的 Claude 值班助手。
几周前，我正值班，同事在晚上 10 点通过 Slack 给我发了条消息：一个新服务上大约 44 个测试没有触发。
过去，我会放下手头的事，抱着笔记本电脑坐下，疲惫地叹口气，然后开始长达一小时的排查修复流程。但现在，我的工作流程完全不同了：我拉上 @Claude，问它看到了什么。
这次，Claude 发现测试是在当天早上某个功能开关被打开时消失的，并且回滚该开关是安全的。我请同事回滚了开关。3 分钟后，Claude 在 Slack 上 ping 我，确认跳过规则确实已被移除，错误率也恢复到了基线水平。
过去几个月里，Claude Tag 一直是 Anthropic 内部 CI/CD 故障的值班第一响应者。这不仅改善了我们的社交生活，也让每一起 CI 事件都有了即时响应的第一人：在最近每一起有事件报告的故障中，Claude 都撰写了第一份情况报告，通常在 15 分钟内就发布其首次分析。
在本文中，我们将介绍我们构建了什么以及它是如何工作的，这样你就可以自己动手搭建，不再害怕轮到你值班。
我们的 Claude 值班设置
在深入事件响应流程的每个阶段之前，我先在这里做个总体概述，让你在了解细节前先有个整体概念。
值班智能体需要记忆，以便记住已完成的工作；需要连接和访问权限，以便进行调查、理解和采取行动；需要排班表，以便知道何时重新投入工作；还需要指令，以便知道该做什么。
Claude Tag 是我们值班智能体的核心支柱。Claude Tag 在我们的值班 Slack 频道中保存记忆，并提供界面，以便在事件期间提供逐轮指令。Claude 还会实时响应值班频道及其他频道中的事件。例行任务的调度，也就是 Claude 定期执行的操作，也在这个频道上通过自然语言提示词完成，例如“每周一上午 9:00（美东时间）运行 CI 交接”。
Claude Tag 拥有自己的服务账号，并能访问 Anthropic CI 工程师所需的工具，如 Datadog 或 Grafana。这是管理员为频道一次性配置好的（具体方法见这里）。
除了值班频道之外，我们还让 Claude 关注其他同样将 Claude Tag 设为成员的相关频道，这样它就能获取更多上下文，比如服务告警、配置变更或 PR 更新。
常驻指令以技能的形式存放在 markdown 文件中，并提交到 GitHub 仓库里。这样多个团队成员可以共同迭代这些指令，我们也能像管理代码一样管理变更。其中还包含路由指令、策略等关键信息，以及作为自我改进循环一部分的经验教训日志。
这套配置只花了我们几小时，而不是几天。我们在 GitHub 上创建了一个通用的值班配置工具包，可以帮助你快速上手搭建类似的智能体。它能将你们团队自身的故障历史转化为分诊手册，并在你的故障频道中留下一个只读的 Claude，负责诊断、升级和处理学习。你可以在大约十分钟内观看它针对一个虚构团队的历史记录运行。
用 TL;DR 的方式总结一下步骤：
你需要 Claude Team 或 Claude Enterprise 套餐。组织所有者需要通过 Claude Tag 将 Claude 添加到值班 Slack 频道中。组织所有者还需要帮助将值班 Slack 频道中的 Claude 连接到相应的连接器、GitHub 仓库，并设置好 Claude Code Remote。将 Claude 添加到你的故障频道，并指示它监控故障并立即进行分诊。
现在，让我们深入看看在故障处理的每个阶段，这种转变具体是什么样的。
检测
Claude 不仅改变了你响应故障的方式，更改变了你最初发现故障的方式。此前，故障检测存在两大主要失效模式。
人类很难总是有先见之明，设定出完美的规则和完美的阈值。尤其是在数据不足、无法分析流量模式的时候，这就更加困难了。
为了解决这个问题，我们让 Claude 在新服务上线后的头几天分析数据和收到的告警，以便建议补充规则，并对任何过宽或过窄的规则进行微调。
事件检测的第二个主要失败模式是告警疲劳：逐一检查和核实每条触发的告警非常繁琐。然而，Claude 不会像人类那样感到疲劳。
Claude 会监控每个告警频道中的每一条相关告警，并对照根目录下 oncall.md 文件中的标准进行判断，以确定某个问题是可以等到早上处理，还是需要立即呼叫值班人员。例如，在通过数据分析完成调优后，文件中的一条规则可能是：“如果错误率超过 2% 且持续时间超过 5 分钟，并且不属于已知的部署窗口，则呼叫值班人员，否则将其写入 lessons.md。”
Claude 值班告警流程还有另外两种触发方式：
CI 团队成员可以在值班频道中报告问题，就像开头示例中 44 个测试缺失的情况那样；或者公司内任何人可以通过内部页面开启一个事件。如果该事件被标记为 CI 基础设施事件，则会为该事件配置一个 Slack 频道，我们的值班 Claude 会接手处理。
这里的关键要点是：告警流程是确定性的，而值班升级流程则同时包含确定性和智能体两种路径。
分类排查
让 Claude 过滤告警噪音是一回事，但真正的成本节省来自调查环节。Claude 会在事件开启后中位时间 14 分钟内发布其首份基于证据的分析，而在最快的情况下，能在首份报告中于 4 分钟内指出根本原因。
当告警升级为事件时，Claude 通常已经准备好出现在我们的 Slack 频道中，并给出一个基于证据、可供我们审查的假设。Claude Tag 会启动一个动态工作流，其中包含一个编排智能体，该智能体会启动执行子智能体来调查每个依赖项和数据源。
对我们来说，这些数据源包括 Grafana、我们的日志存储、PagerDuty、GitHub、Kubernetes 和 Slack 事件频道——全部通过 MCP Connectors 连接起来。Claude 可以并行追踪多条线索，有助于缩短 MTTR（平均解决时间）。
执行智能体将调查结果反馈给编排智能体，后者将信息整合成一份条理清晰的态势报告（SITREP）并呈现出来。
编排智能体和执行智能体并非盲目搜索。它们由一项调查技能引导，该技能针对每类缺陷附有更详细的参考 Markdown 文件。
例如，一份针对影子分歧（shadow divergence）缺陷的 617 行调查技能文件，编码了我在典型调查过程中采取的每一个步骤。我是在某次事件处理期间，通过和 Claude 逐步排查问题构建出这份文件的，然后让它根据那次经验创建了该文件。
Lessons.md 也指导着 Claude 的故障排查。这份 Markdown 文件是我们解决过的每一起事件的持续日志：发生了什么、根本原因、修复方法，以及值得记住的坑。Claude 会自动向其中追加内容。每次新的调查都会从阅读这份文件开始，因此 Claude 的第一个假设总是从最近发生过的事情出发。
如果同样的模式反复出现足够多次，我们就会将其提升到调查技能本身中。我最喜欢的一条记录是 Claude 写关于我的。我当时在查看指标之前先根据配置文件做了假设，现在 lessons.md 文件里写着：“先查数据，再提理论。配置告诉你可能出什么问题；指标告诉你实际出了什么问题。”
即使有了这些工具和上下文，Claude 也并非总能一次就做对。人类的直觉和经验仍然重要。Claude Tag 让团队能够以多人协作模式排查事件。我们中的任何一方都可以实时引导调查方向或添加一个假设，共同协作。
问题解决
如果 Claude 能够升级处理并排查告警，那它也能修复这些问题吗？这个问题的答案会因团队而异，但下面是我们团队的做法。
我们团队内部的大多数部署都在功能开关（feature flag）后面进行。我在 Claude Code 中创建了一个独立的智能体，拥有我的权限，能够在每个功能开关后面进行渐进式部署。
我们发布流程的第一阶段通常涉及 Claude 管理金丝雀（canary）流量、监控问题，并自动调高或调低某个功能开关的流量比例。这本身完全可以单独写一篇文章，所以我在这里就不展开细说了。
其他 Claude Tag 能帮助我的团队解决的路径包括：
告知我们是否需要排空或隔离 Kubernetes 集群的某些部分；给出如何扩容部分基础设施以应对需求激增的指令（这种情况很少见，但当 Claude 给出我们具体可执行的缓解措施时非常有帮助）；以及最频繁出现的——以 PR 形式给出的修复方案，值班人员可以审查、合并，然后部署以快速解决问题。
验证、沟通与交接
Claude 使用与调查阶段相同的许多 MCP Connectors 和工具来验证修复是否按预期生效。作为 oncall.md 中常设指令的一部分，它会将事后复盘写入 lessons.md，并为交接生成 SITREP 报告。
为了在多个事件之间传达完整情况，我们创建了一个名为 ci-weather 的智能体。它汇总来自每个事件 Slack 频道、构建指标、合并队列统计和部署延迟的信息，然后将新闻编辑室风格的报告发布到一个全公司任何人都可阅读的公共频道。现在，我们的工程师在判断是否应该暂缓合并，或试图回答“CI 出了什么问题？”时，可以直接参考该频道，而无需再联系我们。
一个坦诚的说明：我们不得不多次迭代报告格式。Claude 可以一次性生成一个生成状态报告的技能，但让它真正可读的是团队自身的偏好。这是人与人之间的沟通，不是管道工程。
最后，虽然 Claude 会在 lessons.md 中为自己保留日志，我们也希望每周一为人类生成交接报告。Claude 会生成每日和每周摘要，以便团队成员之间能够无缝接续工作。
从监控事件到监控事件响应系统
我们的软件工程师每季度交付的代码量平均是 2021 至 2025 年期间的 8 倍。虽然我们保持了高质量标准（每个 PR 都有明确的人类负责人，每项变更都需要批准才能合并，每项变更都经过同一套 CI 门禁），但要跟上智能体编程的步伐，唯一的方式就是智能体化的 CI。
Claude 已经接手了我工作中那些繁琐的部分——下班后的突发状况和事故通报，让我得以专注于真正能提升系统可靠性的中长期架构变革。
我们这套方案最棒的地方在于，它并不显得零散。我们的值班流程都在 Slack 里，而现在 Claude 也加入了频道。
如何开始：
你需要 Claude Team 或 Claude Enterprise 套餐。组织所有者需要通过 Claude Tag 将 Claude 添加到值班 Slack 频道中。组织所有者还需要帮助将值班 Slack 频道中的 Claude 连接到相应的连接器、GitHub 仓库，并设置 Claude Code Remote。将 Claude 添加到你的事故频道，并指示它监控事故并立即进行分诊。
使用我们的设置工具包，搭建你自己的 Claude 值班系统。
本文由 Anthropic 技术成员 Sachin Malhotra 撰写。
相关文章
Claude Science 产品指南
Claude Science 产品指南Claude Science 产品指南
Claude Science 产品指南Claude Science 产品指南
ABC Legal 如何借助 Claude Managed Agents 让每位员工都成为构建者
ABC Legal 如何借助 Claude Managed Agents 让每位员工都成为构建者ABC Legal 如何借助 Claude Managed Agents 让每位员工都成为构建者
ABC Legal 如何借助 Claude Managed Agents 让每位员工都成为构建者ABC Legal 如何借助 Claude Managed Agents 让每位员工都成为构建者
最大化你的 Claude Code 会话价值
Claude Code
最大化你的 Claude Code 会话价值最大化你的 Claude Code 会话价值
最大化你的 Claude Code 会话价值最大化你的 Claude Code 会话价值
守护前沿：JetBrains 如何评估和部署 Claude Fable 5
守护前沿：JetBrains 如何评估和部署 Claude Fable 5守护前沿：JetBrains 如何评估和部署 Claude Fable 5
守护前沿：JetBrains 如何评估和部署 Claude Fable 5守护前沿：JetBrains 如何评估和部署 Claude Fable 5
用 Claude 改变你组织的运作方式
Claude Tag
编码
An engineer on our Continuous Integration team walks through the agent he built that powers CI incident response at Anthropic.
Category Enterprise AI Agents Claude Code
Product Claude Tag
Date August 18, 2026
Reading time 5 min
Share Copy linkhttps://claude.com/blog/ai-ci-cd-on-call
Author(s) Sachin Malhotra
Set up your own Claude on-call with our setup kit.
A few weeks ago, I was on-call and my colleague Slacked me a message at 10pm: roughly 44 tests on a new service weren’t firing.
In the past, I would have stopped what I was doing, sat down with my laptop, sighed wearily, and began an hour-long investigate-and-fix process. But now, my workflow is entirely different: I pull in @Claude, and ask what it sees.
In this case, Claude found the tests disappeared when a feature flag got turned on that morning, and also that it would be safe to revert. I asked my colleague to revert the flag. Claude pinged me on Slack 3 minutes later to verify the skip rules had indeed been removed and the error rate was back to baseline.
For the last several months Claude Tag has been the on-call first responder for CI/CD failures at Anthropic. Not only has this helped with our social lives, it has given every CI incident an instant first responder: Claude authored the first situation report in every recent incident that had one, typically publishing its first analysis within 15 minutes.
In this article we’ll walk through what we built and how it works so you can build it yourself and stop dreading your turn in the rotation.
Our Claude on call setup
Before we go into each stage of the incident response process, I’ll provide a general overview of our setup here so you have the big picture in mind as we fill in the details.
An on-call agent needs memory so it remembers what’s been done; connections and access so it can investigate, understand, and act; schedules so it knows when to get back to work; and instructions so it knows what to do.
Claude Tag is the backbone of our on-call agent. Claude Tag holds memory across our on-call Slack channel and the interface to provide per-turn instructions during an incident. Claude also acts in real time to events in the on-call channel and others. The scheduling of routines, or the regular actions Claude takes, happens on this channel as well with natural language prompts like “run CI handoff every Monday at 9:00am EST.”
Claude Tag has its own service account and access to the tools an Anthropic CI engineer needs such as Datadog or Grafana. This was set up one time by an administrator for the channel (here’s how).
In addition to the on-call channel, we set up Claude to watch other relevant channels that also have Claude Tag as a member so it can get additional context like service alerts, configuration changes, or updates on PRs.
Standing instructions are in markdown files as skills, committed in a GitHub repository. This way multiple teammates can iterate on them and we can manage changes just like we do code. It also includes key information like routing instructions, policies, and a log of lessons learned as part of a self-improvement loop.
This setup took us hours, not days. We created a generalized on-call setup kit in GitHub that can help get you started with a similar agent.It transforms your team's own incident history into triage playbooks and leaves you with a read-only Claude in your incident channel that diagnoses, escalates, and learns. You can watch it run against a fictional team's history in about ten minutes.
To summarize the steps TL;DR fashion
You’ll need a Claude Team or Claude Enterprise plan The organization owner needs to add Claude to the on call Slack channel via Claude Tag The org owner also needs to help connect Claude in the on-call Slack channel to the appropriate connectors, GitHub repo, and set up Claude Code Remote. Add Claude to your incident channel and instruct it to monitor for incidents and immediately triage
Now, let’s dive into the details of what this transformation looks like at each step of an incident.
Detection
Claude doesn’t just transform how you respond to incidents, it transforms how you detect them in the first place. Previously, there were two major failure modes for detecting incidents.
It's hard for humans to have the foresight to set perfect rules with perfect thresholds all the time. It's especially difficult when you don't have enough data to analyze traffic patterns.
To address this, we have Claude analyze the data and incoming alerts for the first few days of a new service to suggest additional rules and to fine-tune any that are overly broad or narrow.
The second major failure mode for detecting incidents was alert fatigue: checking and vetting every alert that fires is tedious. However, Claude doesn’t get fatigued the same way a human does.
Claude monitors every relevant alert in each alert channel and goes through the criteria in the root oncall.md file to determine if it can wait until the morning or if the on-call needs a page. For example, once tuned from analyzing the data, a rule in the file could be, “If the error rate is greater than 2% for longer than 5 minutes AND it's not a known deploy window, page the on-call otherwise write it to lessons.md.”
There are two other ways the Claude on-call alert process can trigger:
A member of the CI team can report an issue in the on-call channel, as was the case in the opening example of 44 missing tests; or Anyone in the company can open an incident through an internal page. If it’s marked as a CI infrastructure incident then a Slack channel is provisioned for that incident and our on-call Claude picks it up.
The key takeaway here is that the alerting process is deterministic, while on-call escalation has both deterministic and agentic paths.
Triage
It's one thing to have Claude filter through the alert noise, but the real savings comes from the investigation. Claude posts its first evidence-grounded analysis a median of 14 minutes after an incident opens, and in the fastest cases names the root cause within 4 minutes in its first report.
When an alert has been escalated to an incident, Claude is often ready in our Slack channel with a hypothesis grounded in evidence that we can review. Claude Tag kicks off a dynamic workflow with an orchestration agent that spins up executor subagents to investigate each dependency and source of truth.
For us that’s Grafana, our log store, PagerDuty, GitHub, Kubernetes and Slack incident channels–all wired up via MCP Connectors. Claude can chase multiple leads in parallel, helping to reduce MTTR (mean time to resolution).
Executors report the findings back to the orchestration agent which synthesizes and surfaces the information in a coherent SITREP.
The orchestrator and executor agents aren’t searching blind. They are guided by an investigation skill with more detailed reference markdown files for each bug class.
For example, a 617 line investigation skill for shadow divergence bugs encodes every step I take during a typical investigation. I built it by troubleshooting with Claude turn-by-turn during one of the incidents and then had it create the file from that experience.
Lessons.md also guides Claude’s troubleshooting. This markdown file is a running log of every incident we've resolved: what happened, the root cause, the fix, and the gotcha worth remembering. Claude appends to it on its own automatically. Every new investigation starts by reading it, so Claude's first hypothesis starts with what has happened recently.
If the same pattern shows up enough times, we promote it into the investigation skill itself. My favorite entry is one Claude wrote about me. I'd made an assumption from a config file before checking the metrics, and the lessons.md file now states, "query the data first, then theorize. Config tells you what could go wrong; metrics tell you what did."
Even with these tools and context, Claude doesn’t always get it right the first time. Human intuition and experience matter. Claude Tag allows the team to troubleshoot incidents in multi-player mode. Either of us can steer the investigation or add a hypothesis in real-time, together.
Resolution
If Claude can escalate and troubleshoot alerts, can it fix them too? The answer to this question will vary from team to team, but here’s how we do it.
Most deployments within our team happen behind a feature flag. I have created a separate agent in Claude Code, with my permissions, capable of progressive deployment behind each of these feature flags.
The first stage of our rollout process usually involves Claude managing canary traffic, monitoring for issues, and automatically ramping a given feature flag up or down. This could be an entirely separate article, so I won't go into more detail here.
Other resolution paths that Claude Tag helps my team with are:
Letting us know if we need to drain or cordon off certain sections of our Kubernetes cluster;. Giving us instructions on how to scale up some of our infrastructure in responses to demand-surges (this is rare but it’s very helpful when Claude comes back with exactly what we can do for mitigation); and, most frequently, Fixes in the form of a PR that the on-call can review, merge, and then deploy for a swift resolution.
Verification, communication, and handoff
Claude uses many of the same MCP Connectors and tools that it did for its investigation to verify the fix worked as intended. As part of the standing instructions in oncall.md, it writes a post-mortem to lessons.md and for the handoff SITREP.
To communicate the full picture across multiple incidents, we created an agent called ci-weather. It compiles information from each incident Slack channel, build metrics, merge queue stats, and deploy lag. Then it posts a newsroom-style report to one public channel anyone in the company can read. Now, our engineers can reference that channel rather than pinging us when they are trying to determine if they should hold their merges or if they’re trying to answer “what’s wrong with CI?”.
One honest note: we needed to iterate the report format several times. Claude can one-shot a skill that generates a status report, but what makes it readable is team-specific taste. It's human communication, not plumbing.
Finally, while Claude keeps a journal for itself in lessons.md, we also want to produce handoff reports for humans as well every Monday. Claude produces daily and weekly summaries so one member of the team can pick up where the other left off.
From monitoring incidents to monitoring an incident response system
Our software engineers on average ship 8x as much code per quarter as they did from 2021 to 2025. And while we have kept the quality bar high (every PR has a named human owner, every change requires approval to merge, every change goes through the same set of CI gates), the only way to keep up with agentic coding is agentic CI.
Claude has absorbed the tedious parts of my job, the after-hours disruptions and the incident comms, while allowing me to focus on the medium and long term architectural changes that truly move the needle for system reliability.
The best part of what we have built is that it doesn’t feel scattered. Our on-call processes live in Slack, but now Claude has joined the channel.
How to get started:
You’ll need a Claude Team or Claude Enterprise plan The organization owner needs to add Claude to the on call Slack channel via Claude Tag The org owner also needs to help connect Claude in the on-call Slack channel to the appropriate connectors, GitHub repo, and set up Claude Code Remote. Add Claude to your incident channel and instruct it to monitor for incidents and immediately triage
Set up your own Claude on-call with our setup kit.
This article was written by Sachin Malhotra, technical member of Anthropic staff.
Related posts
The Claude Science product guide
The Claude Science product guideThe Claude Science product guide
The Claude Science product guideThe Claude Science product guide
How ABC Legal turned every employee into a builder with Claude Managed Agents
How ABC Legal turned every employee into a builder with Claude Managed AgentsHow ABC Legal turned every employee into a builder with Claude Managed Agents
How ABC Legal turned every employee into a builder with Claude Managed AgentsHow ABC Legal turned every employee into a builder with Claude Managed Agents
Maximizing the value of your Claude Code sessions
Claude Code
Maximizing the value of your Claude Code sessionsMaximizing the value of your Claude Code sessions
Maximizing the value of your Claude Code sessionsMaximizing the value of your Claude Code sessions
Securing the frontier: How JetBrains evaluates and deploys Claude Fable 5
Securing the frontier: How JetBrains evaluates and deploys Claude Fable 5Securing the frontier: How JetBrains evaluates and deploys Claude Fable 5
Securing the frontier: How JetBrains evaluates and deploys Claude Fable 5Securing the frontier: How JetBrains evaluates and deploys Claude Fable 5
Transform how your organization operates with Claude
Claude Tag
Coding