There is no product to buy here. Point the coding agent your team already uses at Oliver, and it investigates incidents and hunts threats against your own data — because the engine underneath can answer everything it asks at once.
A real investigation is never one question. It is what changed, where, for whom, against which baseline, and is it still getting worse — dozens of questions, and the follow-ups they produce. Asked one at a time, that is minutes of waiting and a token bill. Asked together, it is one pass over the data.
What broke, what changed in the minutes before it, which customers felt it, and whether it is still getting worse. Metrics, logs and traces answer in one query rather than across three tools with three query languages.
Chase an indicator through the whole history rather than the window you could afford to keep, and evaluate a detection pack in a single pass instead of one query per rule.
Not every judgement needs a conversation. The engine collapses a day of errors to the handful of things that are genuinely distinct; Jev — TypeSafe’s tiny typed‑decision model — judges each one once, and the answer comes back as a column so the query keeps going. Calls scale with what is distinct, never with what is stored.
Every key has a scope compiled into the query itself before it runs — narrowed, not merely refused — so a least‑privilege key is safe to hand to something that writes its own queries.
The agent reaches Oliver over MCP, and the same discipline applies to every other tool it can call: arguments pinned, schemas held, exfiltration paths closed once it has read something untrusted.
What the agent asked, what it was allowed to see, and what came back — kept, so a conclusion can be checked rather than trusted.
Claude Code, Codex and Cursor all speak MCP, so pointing them at Oliver is a configuration change rather than a project. Open models work the same way — and when one model is not enough, the Swarm runs many small ones against the engine together and makes them cite their work.
Small models query the engine directly and return cited findings a stronger model judges — the open‑model path to the same work.
Trillo ships observability platforms on the same engine, with this investigation pattern already built in.