Skip to content
Cerberius Agents

Now in early access

Support tickets, investigated and fixed. In minutes, with your approval.

For teams who look after systems: a product you run, your clients' IT, or your own company's. Cerberius Agents looks into each ticket across the code, logs, accounts and domains you connect. It finds the cause, drafts the reply and proposes the fix. A person on your team checks it and decides.

Request early accessSee how it works
  • Read-only investigations
  • Nothing sent without approval
  • Every change approved first
Made-up tickets, one for each kind of team. The labels and buttons match the app.

How it works

From a new ticket to a reply you trust

The agent does the digging. A person makes every decision that matters.

  1. 01

    A ticket arrives

    From the ticket system you already use, such as HaloPSA, ConnectWise, Zendesk, ServiceNow or Jira. Or from the log watcher, when a new error shows up in your logs.

  2. 02

    The agent investigates

    It only reads: the code, logs, databases, cluster, user accounts and DNS records you connected. Every step is recorded.

  3. 03

    You review

    What it found and what it proposes wait on one page: the reply, and any change or fix. Approve each one, edit it first or skip it, or tell the agent where to look next.

  4. 04

    The reply goes out

    Approved replies go back to the ticket system. A fix becomes a pull request. A change runs only once a person approves it. Then the agent looks again.

What it connects to

Connect what you look after

Each platform connects only what it needs. The agent needs at least one thing to look at, and reads only what you connect. Anything it would change waits for a person.

Tickets

Where the work comes from.

Service desks and help desks

Issue trackers

Your own system

Each platform connects one of these. Eleven connect with a key or login from that system, with no code to write. Your own system needs a developer.

  • Your ticket system

    One of the systems above, on each platform.

    Reads
    New tickets and the requester's replies, with their files. Older HaloPSA tickets too, when you import them.
    With approval
    The reply goes back on the ticket it came from, to the requester or as a private note for your team. In an issue tracker, it's a comment on the issue.
    How to connect it

  • Log watcher

    For when nobody has reported it yet.

    Reads
    Your logs and Sentry, every 5 minutes, wherever they are.
    Opens
    One ticket per new error. By default, errors close together join one ticket. Up to a daily limit you set. The rest wait until someone starts them.
    How to connect it

Code

For teams with code of their own.

  • GitHub

    Reads
    Your code, and whether a build passed or failed, and why.
    With approval
    A fix, as a pull request. Merged only when a person presses Merge.
    How to connect it

  • GitLab

    gitlab.com or your own server.

    Reads
    Your code, and your pipelines' results.
    With approval
    A fix, as a merge request. Merged only when a person presses Merge.
    How to connect it

Live systems

Where things run, what they logged and what they hold.

  • Kubernetes

    Reads
    Workloads, events and pod logs, in the namespaces you choose. Never Secrets.
    With approval
    Restart, scale or other set steps, tried first without changing anything. Never Secrets, service accounts or permissions.
    How to connect it

  • Logs in Loki, Elasticsearch, OpenSearch, Datadog, Better Stack, ClickHouse, Graylog or your cloud

    Amazon CloudWatch, Azure Monitor and Google Cloud Logging, with your cloud account. Grafana Cloud, Elastic Cloud and ClickStack work too.

    Reads
    Log searches, up to 7 days back.
    Changes
    Never. Logs are only read.
    How to connect it

  • Errors in Sentry

    sentry.io or your own Sentry server.

    Reads
    Issues and their stack traces, in the projects you choose. Secrets hidden.
    Changes
    Never. Sentry is only read.
    How to connect it

  • PostgreSQL, MySQL, MariaDB, SQL Server and MongoDB

    Reads
    One read-only query at a time, at most 200 rows, with a read-only login.
    With approval
    Exact statements, run in one transaction. Rolled back if more rows would change than agreed.
    How to connect it

Accounts

The people, and what they can get into.

  • Microsoft 365

    Reads
    Users, sign-ins and why they failed, licences, groups, mailbox settings and devices.
    With approval
    For example, unblock a sign-in, add someone to a group or assign a licence. Admin roles and policies too. Never a new password or key.
    How to connect it

  • Google Workspace

    Reads
    Users, sign-ins, groups, licences and devices.
    With approval
    For example, unsuspend a user or add them to a group. Admin roles too. Never a new key or backup codes.
    How to connect it

Cloud

The servers and services your systems run on.

  • Amazon Web Services

    A role we take on, so no key leaves your account.

    Reads
    Servers, containers, functions, databases and who changed what, in the regions you use.
    With approval
    Exact calls, such as restarting a server or giving someone back a role. Never one that hands out a key.
    How to connect it

  • Microsoft Azure

    Reads
    Virtual machines, web apps, databases and networks, their health, and the activity log.
    With approval
    Exact requests, such as restarting a web app or resizing a virtual machine. Never one that hands out a key.
    How to connect it

  • Google Cloud

    Reads
    Virtual machines, Cloud Run, Cloud SQL, Kubernetes clusters, storage and networks.
    With approval
    Exact requests, such as resetting a virtual machine or rolling back a Cloud Run service. Never one that hands out a key.
    How to connect it

Domains

Where email and websites point.

  • GoDaddy

    Reads
    The DNS records of the domains you list for the platform.
    With approval
    Add or change A, AAAA, CNAME, MX and TXT records, such as the ones email needs. Only on those domains. Never name servers.
    How to connect it

  • Cloudflare

    Reads
    Records, proxying, SSL/TLS mode, certificates and recent security events of the domains you list.
    With approval
    The same records as GoDaddy, proxied or not. Never SSL/TLS, firewall or caching settings.
    How to connect it

Optional: its own machine

Per platform, off until you switch it on. A separate computer for each ticket, where the agent runs checks of its own, such as looking up a domain's mail records, testing a mail server or checking a certificate. It holds none of your keys and can't reach your systems. Every command shows on the ticket.

Read about its own machine

Also works with

Slack and Telegram, to tell your team when something waits. Claude for the agent, and Claude or OpenAI for chatbots, with keys you add.

Products and clients

Built for teams that look after other people's systems too

Run one platform for your own product, or one for each client you look after. The agent working on a ticket sees only that platform's systems.

  • A platform per client

    Each platform has its own connections, tickets, queue and settings. Your organisation keeps one key library, and each platform picks the keys it uses.

  • Each client's tickets, to their own platform

    Connect each platform to the same service desk, such as HaloPSA, ConnectWise PSA or Autotask PSA, and tick the client it takes. Two platforms never take the same client's tickets.

  • Your backlog, brought in

    From HaloPSA, import tickets opened before you connected, with the whole conversation. Start the agent on some now. The rest wait as Not started until someone starts them.

  • People see only their platforms

    Owners and admins see every platform. Approvers and viewers see only the platforms you give them, on the web and in the phone app.

  • Your team still decides

    Every reply and every change waits for one of your people. They can edit a change before they approve it.

Which ticket systems connect
Made-up clients, for illustration.

You stay in control

Built to look, not touch

The agent reads. People decide. Anything that changes a system or reaches a requester goes through a person first.

How we keep it safe

  • Read-only while it investigates

    Its tools only read your code, logs, databases, cluster, accounts and DNS. It has no shell and no web browser.

  • Nothing sent without approval

    Unless you switch on automatic replies. Even then, a fixed check that doesn't use AI holds back anything long or technical.

  • Every change approved first

    Fixes and database, cluster, account and DNS changes each wait for a person. They see exactly what will run, and can edit it first.

  • The service makes changes, not the agent

    The agent never receives your secrets or change logins. For Microsoft 365, Google and your cloud accounts it gets an hour-long pass, used only by tools that read.

  • Secrets stay secret

    Keys are encrypted and never shown again. Secrets in logs and results are hidden before the agent sees them.

  • Its own machine, only if you want it

    Off until you switch it on. It holds none of your keys, can't reach your systems, and every command shows on the ticket.

Also included

Around the agent

On Team and Business: Development, the content writer and setup assistants. See what they do.

Questions

What people ask first

See all questions
Who is it for?

Anyone who answers support tickets about systems they look after. That might be a software company supporting its own product, an IT service provider looking after its clients' Microsoft 365, Google Workspace and domains, or an in-house IT team. Each product or client is its own platform. It's set up by an owner or admin, and used every day by whoever reviews replies and approves changes.

Which ticket systems does it work with?

Service desks and help desks: HaloPSA, ConnectWise PSA, Autotask PSA, Zendesk, Freshdesk, Jira Service Management, ServiceNow and Zoho Desk. Issue trackers: Jira, Linear and YouTrack. Each connects with a key or login from that system, with no code to write. Any other ticket system can connect through our ticket API: it sends new tickets, follow-ups and closes, and approved replies come back to your webhook, signed to the Standard Webhooks specification. A developer on your side does that. Each platform connects one ticket system at a time.

See every ticket system

Does it change anything on its own?

No. Investigations only read. The agent has no shell and no web browser. Code fixes and database, Kubernetes, Microsoft 365, Google Workspace, DNS and cloud changes are each off until an owner or admin switches them on. Then every one waits for a person (or two, if you ask), who sees exactly what will run and can edit it first. The service makes the change, not the agent. The agent's own machine, if you switch it on, runs checks without approval, but it holds none of your keys and can't reach your systems.

Security and control

How much does Cerberius Agents cost?

It's free on one platform, for good. The paid plans are Starter, Team and Business, monthly or yearly; the pricing page shows today's prices in your currency. AI usage is always paid directly to the AI provider through your own key.

See pricing

See it on your own tickets

Early access is open to teams who look after systems, their own or their clients'. Tell us about your setup and we'll get in touch.

Request early accessTalk to us