Skip to content
SPECIFICTION
Get listed

Coroot

coroot.com

From $1/mo Free plan Open source WebWindowsLinuxAPISelf-hosted
Visit coroot.com
Spec score 9.4 #1 of 56 in Runtime Monitoring Software

What it is

Coroot is an open-source observability platform that uses eBPF to collect metrics, logs, traces, and profiling data without code changes. It maps services and dependencies, and pairs eBPF auto-instrumentation with OpenTelemetry SDK traces for end-to-end request tracking. Continuous profiling can locate CPU spikes down to the line of code. Coroot tracks cloud costs without access to cloud accounts and detects risks such as single-instance applications, unreplicated databases, poor replica placement, and publicly exposed services. Its AI root cause analysis correlates metrics, logs, traces, events, and profiles to identify likely incident causes, with evidence and suggested fixes. Notifications can be sent through Slack, Microsoft Teams, PagerDuty, Opsgenie, and webhooks. Coroot supports Kubernetes, OpenShift, Docker, Docker Swarm, several listed Linux distributions, and Windows agents. Linux use requires kernel version 5.1 or later. The platform is self-hosted, keeping data within the customer's infrastructure. Community Edition is Apache 2.0 licensed and can run on premises or in a customer's cloud. The free Community Edition includes core features. Standard support is by email, chat, or ticket during business hours, while Premium includes 24×7 and phone support.

Spec sheet

What it does
Coroot is an open-source observability and application-performance platform that correlates metrics, logs, traces, profiles and service dependencies.Read 19 Oct 2026 · github.com
Purpose
Coroot is an open-source observability platform powered by eBPF that collects metrics, logs, traces and profiling data without code changes.Read 30 Sep 2026 · coroot.com
Support
Standard includes business-hours support by email, chat or ticket, while Premium includes 24×7 and phone support.Read 30 Sep 2026 · coroot.com
License
The Coroot repository is licensed under Apache License 2.0.Read 19 Oct 2026 · github.com
Founded
2021Read 23 Sep 2026 · coroot.com
AI model integrations
Enterprise AI configuration supports Anthropic, OpenAI and OpenAI-compatible endpoints including tested Google Gemini and DeepSeek connections.Read 19 Oct 2026 · docs.coroot.com
AI root-cause analysis
AI RCA is available in Enterprise or through Coroot Cloud integration, which provides Community Edition users with 10 free investigations per month.Read 19 Oct 2026 · docs.coroot.com
Alert integrations
Alert notifications can be routed to Slack, Microsoft Teams, PagerDuty, Opsgenie or a customizable webhook.Read 19 Oct 2026 · docs.coroot.com
API access change
Release 1.26.8 added service accounts and user API keys for programmatic access to the MCP endpoint and API.Read 19 Oct 2026 · github.com
Application health
The platform provides real-time service health summaries, log correlation and SLO tracking.Read 19 Oct 2026 · coroot.com
Cloud cost insights
Coroot tracks cloud costs without cloud-account access and supports AWS, GCP, Azure and other cloud or on-premises environments.Read 30 Sep 2026 · coroot.com
Cloud cost monitoring
Cost monitoring supports AWS, GCP and Azure pricing models and can allocate usage, allocation and overprovisioning costs to applications.Read 19 Oct 2026 · docs.coroot.com
Company founding
LinkedIn lists Coroot as founded in 2021.Read 19 Oct 2026 · linkedin.com
Company headquarters
LinkedIn lists the headquarters as Palo Alto, California.Read 19 Oct 2026 · linkedin.com
Company size
LinkedIn lists Coroot as a privately held software-development company with 2–10 employees.Read 19 Oct 2026 · linkedin.com
Continuous profiling
Its profiler continuously profiles node processes and can associate profiles with container metadata.Read 19 Oct 2026 · docs.coroot.com
Deployment targets
Coroot supports Kubernetes, OpenShift, Docker, Docker Swarm, Ubuntu, Debian, RHEL, CentOS and Windows agents.Read 30 Sep 2026 · docs.coroot.com
Deployment tracking
Coroot discovers Kubernetes rollouts, compares releases and can show the cloud-cost effect of a deployment.Read 19 Oct 2026 · github.com
Distributed tracing
The node agent can capture outbound requests with eBPF and export them as OpenTelemetry spans when applications lack instrumentation.Read 19 Oct 2026 · docs.coroot.com
Documentation depth
The public documentation includes installation guides, architecture, alerting, profiling, tracing, cost monitoring, risk monitoring, configuration and MCP/API authentication.Read 19 Oct 2026 · docs.coroot.com
Funding
Crunchbase lists Coroot as private, pre-seed and records one pre-seed funding round with NC Tweener Fund as investor.Read 19 Oct 2026 · crunchbase.com
Legal name
Crunchbase identifies the legal name as Coroot Inc.Read 19 Oct 2026 · crunchbase.com
Limit: access controls
A G2 reviewer says authentication and authorization would be useful additions.Read 19 Oct 2026 · g2.com
Limit: log and trace storage
G2 reviewers report missing or insufficient backend storage for logs and traces, and one reports log data not appearing as expected.Read 19 Oct 2026 · g2.com
Limit: scalability maturity
A G2 reviewer cites a lack of production-ready configurations for larger deployments.Read 19 Oct 2026 · g2.com
Linux requirement
Coroot requires a minimum supported Linux kernel version of 5.1 because it relies heavily on eBPF.Read 30 Sep 2026 · docs.coroot.com
MCP interface
Coroot exposes topology, health signals, traces, PromQL, logs and metric discovery through an MCP endpoint authenticated by OAuth or API keys.Read 19 Oct 2026 · docs.coroot.com
Notable news: Percona partnership
Percona announced a September 10, 2026 partnership to offer Coroot Percona Edition with full-stack observability and Percona database support.Read 19 Oct 2026 · globenewswire.com
Notable release
GitHub release 1.27.0 on September 29, 2026 added an interactive Topology mode to the Service Map.Read 19 Oct 2026 · github.com
Open source license
The Community Edition is Apache 2.0 licensed with full source-code transparency and can be deployed on premises or in a customer's cloud.Read 30 Sep 2026 · coroot.com
Performance behavior
A documented test at about 10,000 requests per second reported roughly 20% of one CPU core for the node agent and no noticeable application latency impact.Read 19 Oct 2026 · docs.coroot.com
Praise: installation and automation
G2 reviewers praise efficient installation and automatic instrumentation with a detailed monitoring interface.Read 19 Oct 2026 · g2.com
Praise: visibility
G2 reviewers repeatedly praise the comprehensive service-flow, pod-dependency and network-traffic views.Read 19 Oct 2026 · g2.com
Public API
Customers may access service data through Coroot's API, while excessive or abusive request rates can trigger API suspension.Read 19 Oct 2026 · coroot.com
Rating on Capterra
No Coroot user rating or review count is shown on the product pageRead 19 Oct 2026 · capterra.com
Rating on G2
4.6 out of 5 from 5 reviewsRead 19 Oct 2026 · g2.com
Rating on GetApp
0 out of 5 from 0 reviewsRead 19 Oct 2026 · getapp.sg
Rating on Software Advice
No rating available from 0 reviewsRead 19 Oct 2026 · softwareadvice.com
Risk detection
Risk monitoring checks availability scenarios such as single-instance applications and unreplicated databases, plus publicly exposed databases.Read 19 Oct 2026 · docs.coroot.com
Security controls
Enterprise advertises single sign-on, role-based access control and granular permission management.Read 19 Oct 2026 · coroot.com
Security limitation
Coroot's risk documentation warns that it currently validates only one security risk and should not replace dedicated security-audit tools.Read 19 Oct 2026 · docs.coroot.com
Security model
Coroot is self-hosted so data stays within the customer's infrastructure, and Enterprise provides SSO, RBAC and granular permissions.Read 30 Sep 2026 · coroot.com
Self-hosting
Coroot can run as a Docker container or in Kubernetes, including deployments managed by its Kubernetes operator.Read 19 Oct 2026 · github.com
Service map
Coroot automatically maps services and dependencies, with the product describing coverage for every service.Read 19 Oct 2026 · coroot.com
Service maps
Coroot automatically maps services and dependencies, with a service map advertised as having 100% coverage.Read 30 Sep 2026 · coroot.com
Supported environments
Documentation lists Kubernetes, OpenShift, K3s, MicroK8s, Docker Swarm, standalone containers, systemd services and Amazon ECS on EC2 as supported environments.Read 19 Oct 2026 · github.com
Supported orchestrators
Supported orchestrators include self-managed Kubernetes, EKS, GKE, AKS, OKE, OpenShift, K3s, MicroK8s and Docker Swarm.Read 30 Sep 2026 · docs.coroot.com
System requirement
The installation documentation states that Coroot requires a Linux kernel version of at least 4.16 because it relies heavily on eBPF.Read 19 Oct 2026 · docs.coroot.com
Webhook extensibility
Webhook integrations support basic authentication, custom headers, static fields and Go-template payloads for incidents, deployments and alerts.Read 19 Oct 2026 · docs.coroot.com
Zero-instrumentation telemetry
Its eBPF agents collect metrics, logs, traces and profiling data without application code changes or library installation.Read 19 Oct 2026 · coroot.com

Plans and prices

Community Edition Free core features · Apache 2.0 · self-hosted Read 30 Sep 2026 · coroot.com
Community Edition / Free Open Source Free Core observability features · self-hosted Read 19 Oct 2026 · getapp.com
Enterprise Edition $1 a month per monitored CPU core/month All observability features · unlimited users · enterprise support · self-hosted Read 19 Oct 2026 · coroot.com
Standard $1 a month per monitored CPU core/month volume discounts · business-hours support · no ingestion fees Read 30 Sep 2026 · coroot.com
Pro $25 a month per month Plan details not provided Read 19 Oct 2026 · softwareadvice.com
Enterprise Priced on request contact sales Custom terms Read 19 Oct 2026 · getapp.com
Premium Priced on request 24×7 support · phone support · premium onboarding · air-gapped installation support Read 30 Sep 2026 · coroot.com

Every Coroot plan and price →

Strong points and limits

Strong points

  • Collects telemetry without code changes.
  • AI analysis correlates telemetry and events for incident causes.
  • Community Edition is Apache 2.0 licensed.
  • Standard has no ingestion fees.

Limits

  • Linux requires kernel version 5.1 or later.
  • Standard costs $1 CPU core per month.

Who it suits

Coroot suits teams seeking self-hosted observability across container, Linux, and Windows environments, especially those needing service maps, profiling, or incident analysis. Its Linux deployment requires kernel 5.1 or later.

Coroot in depth

Read the full write-up

Coroot is a self-hosted observability platform for teams that want broad telemetry and infrastructure analysis without adding instrumentation to application code. It is best suited to operators running Kubernetes, containers or mixed cloud environments who can accommodate eBPF’s Linux requirements. The strongest case is its combination of automatic visibility, risk detection and incident evidence; the main trade-offs are operational ownership and per-core billing on the paid tier.

Overview

Founded in 2021, Coroot collects metrics, logs, traces and profiling data through eBPF, while also accepting OpenTelemetry SDK traces. Its service maps, cost analysis and infrastructure checks extend it beyond a conventional metrics dashboard. Because the platform is self-hosted, telemetry remains in the customer’s infrastructure, whether deployed on premises or in the customer’s cloud.

The Community Edition is Apache 2.0 licensed and exposes the full source code. That makes Coroot a credible choice for organizations requiring control over data location or wanting to inspect and modify the platform. It also means the customer owns deployment and ongoing operation rather than delegating those responsibilities to a hosted service.

Key features

Service visibility and tracing

Coroot automatically maps services and dependencies, advertising 100% coverage for its service map. In practice, that gives teams a starting point for understanding traffic paths and ownership without maintaining diagrams manually. Distributed tracing combines eBPF auto-instrumentation with OpenTelemetry SDK traces, allowing automatic request tracking to complement instrumentation already present in applications.

Profiling and incident analysis

Continuous profiling can identify CPU spikes down to the exact line of code, which is materially more actionable than a service-wide utilization graph when performance degrades. Coroot’s AI root-cause analysis correlates metrics, logs, traces, events and profiles, then presents likely causes, supporting evidence and suggested fixes. It is aimed at shortening investigation across several signal types, rather than replacing an engineer’s judgment.

Infrastructure and cost controls

Risk detection flags single-instance applications, unreplicated databases, poor replica placement and publicly exposed services. These checks are useful for teams trying to find resilience and exposure problems before an outage. Cloud-cost tracking works without cloud-account access and supports AWS, GCP, Azure and other cloud or on-premises environments, giving infrastructure teams a cost view without granting Coroot direct account permissions.

Container metrics, resource alerts, image monitoring, runtime events and container log collection cover the operational basics. Notifications can go to Slack, Microsoft Teams, PagerDuty, Opsgenie or webhooks, so Coroot can feed existing response processes.

Pricing

Community Edition

Community Edition costs nothing. It includes the core features, Apache 2.0 licensing and self-hosted deployment. It is the logical starting point for small teams, evaluation environments and organizations that can provide their own support and operations.

Standard

Standard costs $1 a month, billed per monitored CPU core/month, with volume discounts and no ingestion fees. It adds business-hours support by email, chat or ticket. Per-core billing makes the price track infrastructure capacity rather than data volume, but large fleets should model monitored cores carefully before committing.

Premium

Premium uses custom pricing. It adds 24×7 and phone support, premium onboarding and air-gapped installation support. This is the appropriate tier for teams whose deployment isolation or support-hours requirements exceed Standard’s coverage.

A 14-day trial is available. The published plans do not state seat quotas, retention caps or renewal terms, so those should be confirmed during procurement.

Platforms

Coroot supports Kubernetes, OpenShift, Docker, Docker Swarm, Ubuntu, Debian, RHEL, CentOS and Windows agents. Supported orchestrators include self-managed Kubernetes, EKS, GKE, AKS, OKE, OpenShift, K3s, MicroK8s and Docker Swarm. The central Linux requirement is a minimum supported kernel version of 5.1 because Coroot relies heavily on eBPF; that can exclude older hosts or require kernel upgrades. APIs and a web interface are supported, alongside Linux and Windows deployment options.

Who it's for

Choose Coroot if you operate containerized or orchestrated systems and want one self-hosted platform for telemetry, dependency mapping, profiling, cost signals and infrastructure-risk checks. It is especially compelling where code changes for instrumentation are impractical, or where keeping operational data inside your own environment is mandatory.

Look elsewhere if your estate cannot meet the Linux kernel requirement, if you want a fully managed service, or if per-monitored-core pricing does not fit how you budget observability.

Pros and cons

Pro: eBPF collection gathers metrics, logs, traces and profiles without application code changes.

Pro: Service maps, risk checks and cross-signal incident analysis connect day-to-day monitoring with diagnosis and resilience work.

Pro: Apache 2.0 Community Edition and self-hosting support strict data-control requirements.

Con: A minimum Linux kernel version of 5.1 is a hard prerequisite for eBPF-heavy deployments.

Con: Standard bills per monitored CPU core, which can become significant as infrastructure scales.

Con: Community users provide their own operational support; business-hours support starts with Standard.

Alternatives

Pick DeepFlow instead if a free, open-source edition covering Linux servers and selected Kubernetes, cloud and container environments is the priority.

Kubeshark suits teams that need a free community tier capped at three nodes or 60 pods and unlimited API-call capacity, with internet connectivity required.

Choose Odigos for Apache 2.0 OpenTelemetry tracing with a free open-source tier and community support.

Elastic Observability is the alternative for teams prepared for usage-based observability pricing, with logs and traces ingestion starting at $0.09.

Choose groundcover when a free-forever BYOC plan with 12-hour retention and Slack Community support is sufficient.

Metoro Kubernetes Profiling is better for a narrowly focused free tier covering one cluster, one user and two nodes with 28-day retention.

For list-based comparisons, see eBPF Observability Tools, Continuous Profiling Tools, Container Monitoring and Kubernetes Monitoring.

Verdict

Coroot is a strong choice for infrastructure and platform teams that want self-hosted, eBPF-driven observability with service maps, profiling, risk detection and incident correlation in one system. Choose it for breadth, source transparency and data control; look elsewhere if kernel constraints, self-management or per-core Standard billing are deal-breakers.

Verdict

Coroot brings telemetry collection, infrastructure risk detection, and incident analysis into a self-hosted platform. Community Edition is free; Standard has a per-core monthly price, and Linux deployments have a stated kernel requirement.

Where Specifiction places it

Alternatives to CorootAll alternatives →