Architecture
D.A.M.I uses a multi-agent architecture where specialized AI agents collaborate to handle complex DevOps tasks.
System Overview
Core Components
Orchestrator
The central brain of D.A.M.I. Built with FastAPI and deployed on Cloud Run.
- Receives user requests and webhook events
- Routes to appropriate AI agents using Gemini-powered classification
- Manages tool execution with risk-based approval gates
- Provides real-time SSE streaming for dashboard updates
Agent System
D.A.M.I has 29 specialized agents organized in tiers:
| Tier | Agents | Purpose |
|---|---|---|
| Core | SRE, Architect, Code Review, Release Manager | Essential DevOps functions |
| Security | SecOps, Compliance, Audit | Security scanning and compliance |
| Operations | Monitoring, FinOps, Capacity Planner | Observability and cost optimization |
| Advanced | War Room, Chaos Engineering, ML/AI Ops | Complex scenarios and testing |
MCP Protocol (Model Context Protocol)
D.A.M.I uses the MCP protocol to communicate with external tools:
- Standardized tool discovery and execution
- Risk classification (READ / WRITE / DESTRUCTIVE)
- Approval gates for dangerous operations
- Circuit breakers for fault tolerance
Webhook Engine
Real-time event ingestion from 5+ sources:
- GitHub — Push, PR, workflow events (HMAC-SHA256 verified)
- Jenkins — Build status notifications
- Jira — Issue creation and updates
- PagerDuty — Incident alerts with urgency routing
- Datadog — Metric alerts and anomalies
Security Model
- Firebase Authentication with JWT verification
- RBAC with 4 roles: Owner, Admin, Operator, Viewer
- Multi-tenancy with complete data isolation
- AES-256-GCM encryption for all stored secrets
- HMAC signature verification for all webhooks
Data Flow
- Event arrives (webhook, user chat, API call)
- Auth middleware verifies identity and permissions
- Orchestrator classifies the request
- Agent Router selects the best agent(s)
- Agent reasons about the task using Gemini
- Tool Executor runs actions via MCP (with approval if needed)
- Results streamed back to user via SSE