Getting Started — Remo OSS Docs

What is Remo?

Remo is an open-source AI SOC triage orchestrator that runs as a Cloudflare Worker for $0/month. It receives alerts from any monitoring tool, diagnoses them with LLMs, and orchestrates chatops, ticketing, escalation, on-call and remediation with human-in-the-loop.

Monitoring tool ──▶ POST /ingest ──▶ parse ──▶ LLM triage ──▶ Slack/Discord + ticket + escalation

Prerequisites

Cloudflare account (free tier)
OpenRouter account (free — no credit card)
Node.js 22+ (fnm install 22)

1. Clone & install

git clone https://github.com/breakingthecloud/remo-api.git
cd remo-api
npm install --legacy-peer-deps

2. Create resources

npx wrangler login
npx wrangler d1 create remo-incidents
npx wrangler kv namespace create TENANT_CONFIG
# copy the IDs into wrangler.toml

3. Deploy

npx wrangler d1 execute remo-incidents --remote --file=src/db/schema.sql
npx wrangler secret put OPENROUTER_API_KEY
npx wrangler deploy

4. Create a tenant + send your first alert

# Tenant config in KV (see /tenants demo.yaml) + secret reverse-index:
curl -X POST https://api.remo.sofe.dev/tenants \
  -H "X-Remo-Admin-Key: <admin>" -H "Content-Type: application/json" \
  -d '{"tenant":"acme","display_name":"Acme Corp","sources":["prometheus","nagios"]}'

Then send any alert:

curl -X POST https://api.remo.sofe.dev/ingest \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Secret: whsec_prometheus_acme_xxx" \
  -d '{"alerts":[{"labels":{"alertname":"HighCPU","severity":"critical","instance":"web-1","job":"node"},"annotations":{"description":"load 12"}}]}'

5. View results

curl https://api.remo.sofe.dev/incidents -H "X-Remo-Key: rk_acme_admin_xxx"

You get structured triage: diagnosis, probable_cause, recommended_actions, severity_assessment, confidence — from a single POST.

Architecture →