An AI DevOps team for small teams
Deploys and incident fixes that wait for your approval.
Groundcrew connects to the infrastructure you already run, maps it into one graph, deploys your apps, and finds and fixes what breaks. It reads freely and changes nothing until a person says yes.
Sign in with GitHub or an email link. Read-only until you approve a change.
Works with what you run
- AWS
- Kubernetes
- GitHub
- Vercel
- AzurePreview
Discovery
One map of what runs where
Connect a cloud account, a cluster, repositories, and Vercel projects. Groundcrew reads them and draws one graph of what calls what across providers.
- Every link carries its evidence: an environment variable name, a security group rule, a DNS record.
- A short written summary of each system, kept up to date when you refresh.
- Environment variable names only. Groundcrew never reads secret values.
Deploys
From a repository to a running service
Pick a repository and a target. Scout reads the code, Builder writes the Dockerfile and builds it in an isolated sandbox, and Deployer shows the exact plan.
- When a build fails, Builder reads the log, patches the Dockerfile, and tries again, up to five times.
- Each image is smoke-tested before anything is pushed.
- Targets: ECS on AWS or your own Kubernetes cluster. Nothing is applied until it is approved.
Incidents
A root cause you can check
The watcher looks at your linked services and opens an incident when a rollout fails, tasks or pods crash, health checks fail, errors spike in the logs, or a database slows down.
- Medic reads logs, metrics, recent deploys, and commits, then names the cause.
- Every claim links to the log line, metric, or commit it came from.
- Past incidents with the same cause are found and reused.
Fixes
Fixes that are proven, not promised
Medic proposes a pull request on your repository. When production is down now, it also proposes an emergency action, such as rolling an ECS service or a Lambda alias back to the previous version.
- Pull requests go through your own review. Groundcrew never merges or pushes to main.
- Emergency actions show the exact change and run only after approval.
- After a fix, Groundcrew checks the signals that opened the incident until they recover.
Safe by design
It asks before it touches anything
Groundcrew is built so that the safe path is the only path. These hold for every workspace.
A role you create, no stored keys
AWS access is a role in your account with your own ExternalId. Observe can read configuration and logs; it cannot read secret values or your data.
Approvals on the exact plan
A deploy, rollback, or restart runs only after an owner or approver approves it. If the plan changes after approval, the approval no longer counts.
Builds in a sandbox
Your code is built and smoke-tested in a gVisor sandbox with no route to the cloud metadata service or private networks.
An audit log
Connections, approvals, deploys, invites, role changes, and deletions are recorded with who did them and when.
Roles for your team
Owners manage connections and members, approvers approve plans, viewers see everything and change nothing.
Delete it all
An owner can delete a workspace and everything Groundcrew stored about it. Groundcrew cannot remove the role in your account, so it tells you how.
How it works
From sign-in to a running service
Sign in
With GitHub or an email link. You get a workspace of your own; invite your team when you are ready.
Connect
Create the read-only AWS role from a template, install the GitHub App on the repositories you pick, or add a cluster or Vercel token.
Discover
Groundcrew builds the map and a summary of each system, so you see what runs where in a few minutes.
Deploy and respond
Start a deploy, or let the watcher open incidents. Approve the plans you agree with and watch each step live.
The crew
Four agents, each with one job
Each agent has its own tools and limits. They run on NVIDIA Nemotron models through Nebius Token Factory, and every step they take is shown live in the run.
Scout
Nemotron NanoReads repositories and the map. Finds how an app builds and runs.
Builder
Nemotron SuperWrites the Dockerfile, builds in the sandbox, and fixes failed builds.
Deployer
Nemotron SuperTurns the app into a target plan, deploys it after approval, and checks it.
Medic
Nemotron UltraFinds the root cause of an incident, proposes a fix, and verifies recovery.
Can Groundcrew change my infrastructure without asking?
No. It reads freely within the access you grant. Every change to a resource is a plan that an owner or approver approves first, or a pull request that goes through your own review.
What access does it need in AWS?
A role you create in your account from Groundcrew's CloudFormation template. Observe is read-only. Deploy adds the rights to run services in a cluster Groundcrew creates for itself. You can delete the stack at any time.
Does it read my secrets or customer data?
No. It reads names and configuration: environment variable names, log lines, metrics, resource settings. The role is denied reading secret values, parameters, and S3 objects, and it has no permission to query your databases.
What happens to my code during a build?
Groundcrew fetches the repository with a short-lived GitHub App token, builds it in an isolated sandbox, smoke-tests it, and removes the containers, images, and build cache when the run ends.
Which models run the agents?
NVIDIA Nemotron Nano, Super, and Ultra through Nebius Token Factory. Each task goes to the smallest model that does it well, and each workspace has a daily spending cap.
Can I run Groundcrew myself?
Yes. The source is on GitHub with a self-hosting guide for a single server running Docker Compose.
Connect one account and see your map.
Start read-only. Nothing changes until you approve it.