Health Check Agent

The SRE who shows up at 2am, probes your whole stack, and tells you exactly what broke.

What it does

A senior SRE on demand. Not a passive monitor — an active investigator. Give it a URL, a deployment, or an incident report, and it systematically probes your entire stack: DNS, SSL, HTTP endpoints, TCP ports, dependency chains. Returns a structured verdict — not just "it's broken" but which layer is broken, the root cause hypothesis, and concrete next steps.

What it can do

Post-Deploy Verification Gate

After every deployment, runs a systematic check of every layer before you let traffic in: DNS resolution, SSL certificate validity, /health liveness, functional endpoint probing, and database TCP reachability. Outputs a PASS/FAIL verdict per check with a final GO / NO-GO recommendation.

“Verify our Fly.io deployment is fully healthy before I flip the DNS — check DNS, SSL, /health, DB, and the auth endpoints”
“Run a pre-launch checklist on staging: DNS, cert, health endpoint, login flow, and payment API”
“After our Railway deploy, verify the API, the DB connection, and the Redis cache are all reachable”

Incident Triage

When something is broken, systematically probes the entire stack from the outside in — DNS → SSL → HTTP → dependency ports — to isolate the failing component. Outputs an incident report with root cause hypothesis, evidence, blast radius, and concrete fix recommendations.

“Auth service is returning 503 — find the root cause and tell me what to fix”
“Users are getting connection timeouts on checkout. Probe the payment service and its dependencies”
“Our app was healthy 1 hour ago and is now returning 502. Walk through the stack and find the breaking link”

SSL Certificate Audit

Checks SSL/TLS certificates across all your domains: validity, expiry date, days remaining, and issuer. Flags CRITICAL (≤7 days) and WARNING (≤30 days) with renewal instructions before a cert silently expires and breaks your HTTPS.

“Audit SSL certs for all 6 subdomains — flag anything expiring in the next 30 days”
“Check that our new domain has a valid cert after the Let's Encrypt renewal”
“Verify the cert on our API subdomain is from our expected CA, not a misconfigured fallback”

DNS Verification

Resolves DNS records — A, AAAA, CNAME, MX, NS — and verifies they match expectations after domain migrations, provider changes, or new subdomain setup. Confirms DNS has propagated before you spend time debugging something that isn't an app problem.

“Verify our new domain DNS has propagated and resolves to the right Fly.io IP”
“Check that the CNAME for dashboard.myapp.com points to our CDN, not the old server”
“After migrating to Cloudflare, confirm all A records are correct before removing the old DNS”

Dependency Chain Mapping

Maps the full service-to-service dependency graph and verifies each link: API → Database, Database → Redis, API → external payment/auth APIs. Finds the first broken link in the chain — often a database port or cache, not the user-facing service.

“Verify the API can reach Postgres on 5432 and Redis on 6379 after the VPC migration”
“Check all service-to-service connections in our microservices: API gateway, auth service, user service, and notification service”
“After moving the database to a new host, confirm the app server can still reach it on the right port”

Functional Endpoint Probing

Goes beyond HTTP 200 — checks that endpoints return the right response body. Verifies that auth endpoints issue tokens, that API routes return valid JSON with expected fields, and that functional flows actually work, not just that the server is listening.

“Hit /api/auth/ping with our test token and verify the response contains "authenticated: true"”
“Check /api/v1/status returns JSON with all subsystems listed as green”
“Probe /api/payments/health and verify it returns the Stripe connection status in the body”

Environment Parity Check

Runs identical checks against staging and production, then builds a side-by-side comparison flagging any discrepancy — a check that passes in one but fails in the other. Catches env var mismatches, missing secrets, and infra drift before they reach prod.

“Compare staging and production health side by side — flag anything that passes in staging but fails in production”
“Verify staging has identical SSL setup to production before the release today”
“Check if the auth endpoint behaves the same in both environments after the config change”

Good for / not for

Great for

Post-deployment verification before flipping traffic
Incident triage — finding why something broke at 2am
SSL certificate audits across multiple domains
Verifying DNS propagation after domain migrations
Confirming service-to-service connectivity after infra changes

Not the right fit for

Continuous 24/7 uptime monitoring — hire the resident Uptime Monitor agent for that
Load testing or performance benchmarking under traffic
Fixing the underlying issue — it diagnoses, not repairs (use Infra or Backend agents for that)

Example tasks

“We just deployed to Fly.io — verify DNS, SSL, /health, the DB connection, and all API routes before I flip traffic”
“Our auth service started returning 503 at 2am. Probe the whole stack and give me a root cause with evidence”
“Audit SSL certs for api.myapp.com, app.myapp.com, and dashboard.myapp.com — flag anything expiring in 30 days”
“Verify our staging environment is completely healthy before the release branch cut today”
“Check that our API can reach the database on port 5432 and Redis on 6379 after the VPC migration”