🔍 Investigations that know where to look — and admit when they didn't find it

Released 2026-09-08

An AI investigation is only as good as its access to your data, and two things were quietly undermining that. It had no way of knowing what your log or database connectors actually contain, so it guessed index and field names from the wording of the ticket. And when those guesses returned nothing, it could still report a confident conclusion — including that a customer's record did not exist.

Both are fixed, and connectors are no longer write-once.

Highlights

Tell the AI how to query each source

Every MCP connector now has a How to query this source field. Write which indices or tables it holds, which field carries the order or customer id, and how to query it — the investigator reads it before every run.

This matters more than it sounds, because the AI previously learned nothing about a connector at all: it saw a flat list of tool names shared across every connected server, with no indication which server a tool belonged to. Guidance now reaches it alongside the connector's name and its own functions.

Tested against a real log server, the difference is stark. Without guidance the model invented an index that didn't exist, spent three of its tool calls on it, and declared the order missing. With guidance it queried the right index and field and found the record on the first call.

Write it as instructions rather than description — "query app-logs-* with fields.order_ref:<ref>, always name that field" works; "the order id is fields.order_ref" only half-works. The field ships with a worked example that shows the difference.

Investigations no longer assert facts they never found

A hypothesis verdict was taken from the model as-is. If every search in a run errored — a missing index, a rejected client version — the run could still conclude "the record does not exist", validated, 0.90. A support agent reading that would tell the customer their order was never placed.

A verdict whose every supporting tool call failed is now forced to inconclusive, and the run reports "N of N tool calls errored".

Nothing surfaced this before. The connector warning only appeared when a connector failed to connect — one that connected cleanly and then errored on every query rendered as a perfectly healthy run.

Connectors can be edited and deleted

Correcting a typo used to mean creating a second connector, and because credentials were never shown you had to re-enter them all — so a wrong URL cost you a credential rotation, since most providers show an API key exactly once. Broken connectors then accumulated in the list, each still holding a live secret.

Connectors are now editable and deletable from both the investigation settings and the agent tools tab. Credentials are masked and round-trip untouched: change the URL, keep the key. Deleting names the agents and investigation settings that reference it first.

A destructive button that said it wasn't

The agent tools tab had a Remove button whose confirmation said it removed the tool "from the agent". It deleted the connector for the entire organisation. It is now split into Unlink and Delete, and the delete dialog says what it will actually do.

Database connectors: one less wasted call

Every investigation used to open by asking which tables it was allowed to read, spending one of its limited tool calls to learn something the server already knew. That catalogue is now given to it up front.

Re-run an investigation with guidance

Correcting a run used to be possible only by rejecting a proposed resolution — which meant it did not exist below autonomy level 2, where no proposal is ever created. Watching a run search the wrong place, your only option was to edit the ticket and start again.

The investigation panel now has Re-run with guidance… at every autonomy level. The note steers that one run; anything worth saying every time belongs on the connector.

Credentials stay on the server

Connector environment variables and headers are no longer sent to the browser at all. The edit form shows a mask and sends it back unchanged unless you type a replacement.