DevOps with AI

Your staging deploy is green, but production 500s the moment real traffic hits. The runbook is three engineers’ tribal knowledge, your Terraform state drifted from reality months ago, and the one person who understands the Helm values is on vacation. DevOps is where small mistakes compound into outages — and where an AI assistant that can read your manifests, query your metrics, and draft a remediation plan changes how fast you recover.

The moment AI-written code meets production is also the moment the gates appear: a security scan blocks the deploy, an auditor wants evidence, the token bill spikes. These guides cover that operational layer across Cursor, Claude Code, and Codex — generating pipelines and infrastructure code, debugging failing clusters, running incident response, and defending the result to a security review. Each one is built around copy-paste prompts and the failure modes that generic tutorials skip.

The operations workflows in this section

Incident Response Triage alerts, correlate them, find root cause from logs and metrics, and draft a remediation plan and postmortem under pressure.

Monitoring and Observability OpenTelemetry instrumentation, Grafana dashboards, alert rules, and the Sentry MCP — so problems surface before users report them.

Performance Tuning Profile slow services, right-size resource limits and autoscalers, and validate the fix before it ships.

Security Operations Scanner CLIs in CI, vulnerability triage, infrastructure hardening, and compliance evidence with current, verifiable controls.

Compliance Automation Audit trails, policy enforcement, and turning SOC 2, HIPAA, GDPR, and PCI requirements into checks the AI can help you maintain.

Cloud Cost Management Right-sizing, anomaly detection, cost allocation, and budget forecasting — find and cut cloud waste with AI-assisted analysis.

Disaster Recovery Backup verification, restore drills, and recovery runbooks you can actually execute when the primary region is gone.

The delivery guides this section builds on

Operations start where delivery ends. These three cover the pipeline that puts the code in front of real traffic in the first place.

CI/CD Pipelines Change-aware builds, flaky-test triage, and safe progressive deploys in GitHub Actions and GitLab CI — with the gotchas around caching, matrix builds, and rollback.

Containerization Hardened multi-stage Dockerfiles, OOMKilled and CrashLoop debugging, Kubernetes manifests, and container MCP servers.

Infrastructure as Code Drive Terraform, CloudFormation, Pulumi, and CDK from natural language, and import existing resources with security and cost review built into the loop.

Where MCP servers change the workflow

For DevOps, the difference between a generic answer and a useful one is whether the assistant can see your actual state. Model Context Protocol (MCP) servers give Cursor, Claude Code, and Codex live, read-only access to your toolchain, so instead of pasting log dumps you let the agent query the source. MCP setup is identical across all three tools — point them at the same server config.

A few that are mature and worth wiring up in 2026:

AWS Labs MCP

The awslabs/mcp suite — separate servers for AWS documentation, CDK guidance, cost analysis, and core prompt handling. Run each via uvx and add only the ones your team uses.

Datadog MCP

Datadog’s MCP server reached general availability in March 2026. It feeds live logs, metrics, and traces into the agent during an investigation — under your existing access controls.

Grafana MCP

grafana/mcp-grafana lets the agent search dashboards, run PromQL/LogQL queries, and pull incident context directly from your Grafana instance.

Terraform MCP

hashicorp/terraform-mcp-server gives the agent current Registry provider docs and module metadata so generated HCL targets real arguments. Still beta — keep it out of production-write paths.

Read-only first

Connect observability and documentation MCP servers (Datadog, Grafana, AWS docs) before anything that can mutate infrastructure. The biggest early wins are in investigation and code generation, where the agent reads state and you stay in control of what actually gets applied.

Security guidance moves fast — verify before you ship it

Kubernetes PodSecurityPolicy was removed in v1.25 (2022); any prompt or generated manifest that references PSP will not apply on a current cluster. Ask for Pod Security Admission with the built-in Privileged/Baseline/Restricted standards plus NetworkPolicy instead. The same caution applies to other hardening advice: treat anything the AI generates as a draft to validate against current provider docs, not a finished control.

Where to start when production is on fire

Pick the workflow closest to what’s burning right now. Each guide opens with a concrete scenario, ends with copy-paste prompts, and names the failure modes you have to watch for. If nothing is on fire, start with monitoring and observability — every other workflow in this section gets faster once the agent can see real signals instead of your description of them.