When your app is slow, stuck, crashing or eating memory, your AI agent used to read the code and guess. With DEA it looks inside the running app, measures what is actually happening, and shows you the proof. One command to install. No terminal skills needed.
“It's slow after a while.” “It just freezes.” “Memory keeps going up.” “Port already in use.” “The container keeps dying.”
Not the code on screen, the program actually running. DEA uses the same tools senior engineers use, drives them for the agent, and keeps it safe: it only watches, never changes anything.
“This list grows and is never emptied.” “This function uses 58% of the CPU.” “Two threads are waiting on each other.” Every sentence points at the measurement behind it, so it can't make things up.
The agent never touches a tool directly. DEA picks the right one, runs it inside hard limits, keeps the raw output as an artifact, and returns a short structured result.
Two snapshots, a diff, and the retainer: Array retains 50 MB via Context.retained, the module-level array in server.js. Real output, no edits.
Numbers from our own reproductions are real; the rest show the shape of the evidence. Every finding carries its evidence ids.
A finding without evidence ids is rejected by the schema before it ever reaches the agent. Hover the chain.
HIGHlikely deadlock: 2 threads blocked acquiring locks, none running [inferred; e14, e1]
e14 lock_wait worker-ab-20 at worker_ab (app.py:38) [with lock_b:] e1 stack_summary 64 threads: 0 active
~/.dea/sessions/…/artifacts/
pyspy-dump.txt (raw, 6.3 KB)
open it. same bytes the agent saw.One command per developer, one command per repo, evidence in pull requests, a gate in CI. Nothing to host.
Register with your agent. Ask it something about a running process.
npx dea-agents setupCommit three files; every teammate's agent gets DEA and the rule for when to use it.
dea initPerf and bug fixes carry run ids. Reviewers open the artifact instead of asking "did you measure?"
dea diff profile_cpu#2 profile_cpu#3Smoke test under two snapshots; fail the job if RSS grows.
dea diff … --json | jq -e …Linux hosts attach by container name. Kubernetes via an ephemeral debug container.
kubectl debug … -- dea why 1A Python agent reacts to the alert, measures, posts findings with the report path.
pip install dea-agentsdea port 3000; never kill it blindly.The skill and the MCP instructions tell the agent to attach and measure on these signals. In Claude Code, a 40 ms hook spots them in command output and prompts, and nudges the model toward the right tool. Read-only observation needs no permission; packet capture always does.
Listening ports, connections by remote, CLOSE_WAIT pileups, fd growth, deleted-but-open files.
Heap snapshot, exact top retainers with the retaining path, JS main-thread stack.
CPU flamegraph, every thread's stack, lock / join / sleep / I/O classification from source lines, deadlocks.
Top syscalls by time, slowest calls with paths and addresses, error counts, blocking share.
perf or sample flamegraphs; gdb / lldb thread dumps with mutex vs idle classification.
Per-remote bytes, RSTs, unanswered SYNs, retransmits, DNS, .pcap. Filter scoped to the target.
OOM kills, exit codes, restarts, limits vs usage, cgroup throttling, log tail.
Needs root? DEA prints the sudo command; you run it and dea import the file. strace, fs_usage, perf, py-spy, sample, gdb/lldb, lsof, tcpdump.
Diff any two runs: what grew, appeared, disappeared. Proof for the PR.
npx dea-agents setup
dea init # commit .mcp.json, .cursor/mcp.json, AGENTS.mddea why 12345 --symptom slow
npx skills add shreyassaw5394/dea
pip install 'dea-agents[langchain]' from dea_agents.langchain import dea_tools
Install in Cursor → Install in VS Code →
/plugin marketplace add shreyassaw5394/dea /plugin install dea@dea gemini extensions install https://github.com/shreyassaw5394/dea
{"command":"npx","args":["-y","dea-agents@latest","serve"]}