One causal graph. From signal to root cause to safe action.

The end of reactive observability.

Synapses connects your infrastructure, users, AI features and security events in one causal graph, so incidents go from alert to root cause to fix without anyone stitching dashboards together.

Try the live demoView the code
Causal path from symptom to root cause: Revenue dropped, then Users abandoned checkout, then Payment service slowed, then A query got slow, then Missing index.

  1. Revenue dropped

    revenue_drop

  2. Users abandoned checkout

    checkout.abandon

  3. Payment service slowed

    payment-svc P99

  4. A query got slow

    postgres.query

  5. Missing index

    transactions_tbl

88 ms

from revenue drop to root cause

Internal benchmark: graph traversal across 1,240+ nodes.

  • Find the real root cause, not just the loudest alert.
  • See what each incident cost in users and revenue.
  • Fix it automatically, within limits you set.

Works with what you already run

  • OpenTelemetry
  • Kubernetes
  • OpenAI
  • Anthropic
  • Gemini
  • Ollama
  • Groq
  • Together AI

The problem

When something breaks today, the story is scattered.

Server health lives in one tool, user behaviour in another, AI costs in a third and security alerts in a fourth.

An engineer gets paged at 2 a.m. and spends the first hour just working out what happened.

Meanwhile customers leave, and nobody connects the outage to the lost revenue until days later.

AI-built products make it worse

  • AI features are a blind spot.

    Old monitoring tools weren't built around tokens, model costs, or answers that are wrong but look right.

  • AI-written code ships fast and can skip basics.

    For example, a missing login check on one endpoint.

  • More tools means more alerts and fewer answers.

  • Infra metrics, traces, session replay, LLM telemetry and security events usually sit in separate stores with separate IDs. Correlation happens manually, by time-aligning graphs.
  • Static thresholds create alert noise. They don't explain why a threshold was crossed.
  • Runtime context, such as which code path ran for which user with which data, rarely reaches the security or incident workflow.
See it in actionIllustrative scenario

One incident, start to finish

IncidentStep 1 of 5
anomaly
payment-svc P99 latency above baseline
How it works

One loop, running all the time

The traditional model is alert, then a human investigates, then a human fixes. Synapses runs this instead.

SignalsOne graph
  • InfrastructureStreaming
  • TracesStreaming
  • User sessionsStreaming
  • LLM callsStreaming
  • Security eventsStreaming
  • Business metricsStreaming

A living map of what caused what

When revenue dips, Synapses doesn't just show you a red chart. It shows you the path. One picture, one answer.

  • Nodes: services, endpoints, databases and tables, queues, hosts and pods, user sessions, LLM calls, models, prompt routes, security events, business metrics.
  • Edges come from span relationships, time-window and baseline correlation, fingerprint matching, dependency and ownership data, and session-to-request linking. A click in a session replay links to its backend trace.
  • Each edge stores a confidence score and the correlation method, so every step in a root-cause path can be inspected.
  • This is evidence-backed causal inference with a confidence score, not formal proof.
Sources
Backend SDKs (Node, Python, Go, Java), OpenTelemetry, browser SDK, LLM SDK wrapper, cloud / Kubernetes, business events
Ingestion
SDKs, collectors, webhooks and log pipelines write immutable events
Normalization
Events map to canonical entities (Service, Signal, Impact, User, Incident…). PII and secrets masking happens here
Correlation
Edges from trace parent/child links, time windows against statistical baselines, error fingerprints, dependency edges, ownership and historical similarity
Causal graph
One graph holds every node and edge; each edge carries a confidence score and the method that created it
Agents
Traverse the graph, form a hypothesis, check it against history, and generate a candidate fix
Actions
Evidence report, PR, notification, scaling, block, rollback, all gated by policy and fully logged

Raw events are retained, so correlations can be recomputed as detection improves.

What Synapses watches

Six inputs. One graph.

These aren't six products. They're six kinds of signal feeding the same map of cause and effect.

Set-up takes minutes, not a migration project

  1. 1.Install the SDK
  2. 2.Initialise it with your API key
  3. 3.Watch the graph build. Nodes and edges appear as traffic flows.

One line for your AI features

const openai = synapses.wrap(new OpenAI());

Give your coding agent production context

Connect Synapses to Claude or Cursor through MCP, so your coding agent has the same production context a senior engineer would use.

Why did checkout conversion drop in the last 15 minutes, and what changed?

Safe by design

You stay in control

Synapses doesn't take over. You decide how much it's allowed to do, and you can widen that over time as trust builds. Most teams start with suggestions only. Every action is logged, explained and reversible, and there's always an off switch.

Two settings decide what happens

Confidence is how sure the diagnosis is. Policy is what you've permitted. The action taken is the lower of the two.

A 0.97-confidence fix under a PR-only policy still only opens a PR.

How much Synapses may do

  1. Read-only

    Investigate and recommend. No write access.

  2. PR-only

    Open branches and PRs. Cannot merge.

  3. Approval-gated

    Chosen action types need a human to approve them.

  4. Policy-bound

    Production actions run only within predefined environments, rules and thresholds.

  5. Autonomous

    Only narrow, reversible actions run automatically, with an audit log and a kill switch.

Privacy and safety by design

Synapses handles sensitive data such as user sessions, prompts and production logs, so sensitive fields are masked before anything is stored or analysed.

  • PII masking
  • Prompt redaction
  • Secret detection
  • Session-replay input masking
  • Query-parameter scrubbing
  • A full log of every agent action

Masking happens at the normalization layer, before data reaches the causal graph.

Potential growth

Why now

Synapses sits where observability, AI operations and AI-feature monitoring meet. The AI-specific part is growing roughly two to three times faster than classic monitoring.

  • 36.2%

    a year: growth of LLM observability platforms, the fastest-growing segment.[5]

  • 52%

    of organisations plan to consolidate onto a unified observability platform within two years.[9]

  • 45%

    of AI-generated code samples contained a security weakness in testing across 100+ LLMs.[13]

Growth per year, by market

Classic observabilityAI-specific segments
Market growth per year (CAGR) by segment, with size and forecast
MarketGrowth per year
Observability products[1]Gartner11.1% (2021–2028)
Observability platforms[2]Mordor Intelligence15.9%
AI observability[4]Meticulous Research22.8%
AIOps[3]The Business Research Company~30%
LLM observability platforms[5]The Business Research Company36.2%
See the full market analysis
Roadmap

Coming next: from commit to production

Today Synapses explains what broke in production. Next, it will trace problems all the way back to the code change that caused them, and catch slow or risky changes before they ship.

  1. Code
  2. CI
  3. Deploy
  4. Runtime
  5. User impact
  6. Fix
  7. Verified

From commit to production, Synapses understands what changed, why it mattered, and what to do next.

FAQ

Frequently asked questions

  • Only if you allow it. Read-only and PR-only modes are available, and every action is logged.

  • No. LLM calls are intercepted in-process, inside your app, so there's no proxy hop.