AI-powered incident-response dashboard built with CopilotKit + OpenAI. Triage cybersecurity incidents conversationally, fill report forms via human-in-the-loop chat, drill into per-incident analysis and cross-incident timelines, and view charts over a decade of global cybersecurity threats (2015–2024).
- Frontend: React + TypeScript + Vite, CopilotKit (
@copilotkit/react-core,@copilotkit/react-ui), Recharts - Backend: Node + Express +
@copilotkit/runtimewith the OpenAI adapter - LLM: OpenAI via
OpenAIAdapter - Data: Global Cybersecurity Threats (2015–2024) (see
README_DATASET.md) - Tests: Vitest + Testing Library
- Node.js 20.19+ or 22.12+
- pnpm — install
- An OpenAI API key
git clone https://github.com/NathanTarbert/incident-copilot.git
cd incident-copilot
pnpm install
cp .env.example .env # then paste your OPENAI_API_KEYpnpm dev:all- Frontend: http://localhost:5173 (Vite)
- Backend: http://localhost:4000/copilotkit (CopilotKit runtime)
pnpm dev:server # one terminal — Express + runtime
pnpm dev # another — Vitepnpm test # one-shot
pnpm test:watch # watch mode- Incidents list & detail — severities P0–P4, statuses Open / Investigating / Mitigated / Resolved, with sorting and filtering.
- AI sidebar —
CopilotSidebarchat that can read app state and trigger frontend tools. - Conversational incident reporting — the AI fills a structured
ChatIncidentFormin-chat, the user reviews and submits (classic HITL pattern). - Tool calls visualized — runbook execution cards, analysis panels, and cross-incident timelines render inline from tool results.
- Charts — Recharts-powered incident charts over the cybersecurity-threats dataset.
The frontend wraps the app in <CopilotKit runtimeUrl="http://localhost:4000/copilotkit"> and a <CopilotSidebar>. Three integration points carry the work:
useCopilotReadable— shares the live incidents list and selection state with the agent.useFrontendTool— registers ~9 tools the agent can call (report/resolve/clear incidents, fill the chat form, navigate to a detail view, run a runbook, etc.).useRenderToolCall— renders custom React UI for specific tool calls (runbook cards, analysis panels) directly inside the chat thread.
The backend (server.js) mounts copilotRuntimeNodeHttpEndpoint on /copilotkit with the OpenAIAdapter so each request reaches OpenAI with the latest app context attached.
incident-copilot/
├── server.js # Express + CopilotKit runtime + OpenAI adapter
├── src/
│ ├── App.tsx # CopilotKit provider, sidebar, frontend tools
│ ├── components/
│ │ ├── IncidentsList.tsx # Sort + filter incidents
│ │ ├── IncidentDetail.tsx # Per-incident detail view
│ │ ├── ChatIncidentForm.tsx # HITL form rendered inside the sidebar
│ │ ├── CrossIncidentTimeline.tsx
│ │ ├── AnalysisPanel.tsx
│ │ ├── RunbookExecutionCard.tsx
│ │ └── charts/IncidentCharts.tsx
│ ├── services/
│ │ ├── incidentDatabase.ts # In-memory store
│ │ └── mockApi.ts # Async wrapper
│ ├── data/ # Cybersecurity threats dataset
│ └── types/incident.ts
├── README_DATASET.md # How the dataset is wired in
└── package.json
| Variable | Description | Required |
|---|---|---|
OPENAI_API_KEY |
Used by the runtime's OpenAI adapter. | Yes |
The backend port (4000) and the frontend's runtimeUrl are matched in server.js and src/App.tsx — change both if you need a different port.
Deploys as a single Node service. In production server.js binds to process.env.PORT, serves the Vite build from dist/, and mounts the runtime at /copilotkit on the same origin — no CORS, no second service.
- Build:
pnpm install --frozen-lockfile && pnpm build - Start:
pnpm start - Env:
NODE_ENV=production,OPENAI_API_KEY,VITE_COPILOTKIT_RUNTIME_URL=/copilotkit
Run the production bundle locally to sanity-check:
pnpm build
OPENAI_API_KEY=sk-... pnpm start # http://localhost:4000Agent 'default' not found— make surepnpm dev:serveris running and theruntimeUrlinApp.tsxmatches.OPENAI_API_KEY is not set— populate.envand restart the server.- Port 4000 already in use —
lsof -ti:4000 | xargs kill -9.