IoT Anomaly Responder hero
Strongly Certified · Streaming Workflow

IoT Anomaly Responder

Subscribes to MQTT. Drafts an incident summary on anomaly. POSTs to your incident webhook.

Long-running MQTT subscriber wired into a small LLM that drafts a two-paragraph incident summary on anomalies. Healthy readings drop at the conditional - the LLM is never invoked on noise.

Pre-LLM
Conditional drops healthy traffic
Per-msg
JSON canonicalised on emit
Audited
Verdict + payload on every span

The voice loop, end-to-end.

No black box. Each step is a typed-frame node you can edit, monitor, and replace.

01

MQTT broker publishes a sensor reading. The streaming-mqtt-source emits a TextFrame with the topic, QoS, and retain flag attached.

02

The streaming-conditional matches anomaly markers (alarm/alert/anomaly true, or severity critical/high) on the JSON payload via regex.

03

Anomalies route to the streaming-prompt-template and a small LLM. Healthy readings drop at a streaming-filter sink - zero LLM cost.

04

The drafted incident summary fans out to streaming-webhook-response. Routes through STRONGLY_SERVICES (Slack, PagerDuty, ServiceNow) - no raw URLs in the workflow.

Built for production. Day Two-ready.

Streaming graph contract, observability, and cost discipline come standard. The agent ships with a full test suite that runs in CI on every node version bump.

MQTT subscriber

aiomqtt-backed long-running subscriber. QoS 0/1/2, TLS via the addon, configurable client_id prefix. Topic patterns honour MQTT wildcards (+, #).

aiomqttQoS configurableWildcards

Cost-bounded by anomalies

The LLM only runs on payloads matching the anomaly regex. Healthy heartbeat traffic - 99% of broker volume in most factory deployments - costs nothing.

Pre-LLM filterBounded costNo noise

Canonical JSON envelopes

When payloadFormat=json the source parses and re-serialises with sorted keys + tight separators, so downstream regex / context-projection nodes see a stable shape regardless of broker quirks.

Stable shapeSorted keysTight separators

Predicate-driven routing

streaming-conditional supports the full predicate vocabulary: regex, contains, gt/lt, in/not_in, dotted field paths. Swap the default regex for a typed predicate after lifting JSON onto a ContextFrame.

regex / field pathPer-condition portConfigurable

Webhook via STRONGLY_SERVICES

streaming-webhook-response routes every incident through your registered HTTP datasource. Slack incoming webhooks, PagerDuty events API, ServiceNow incident endpoints - same node, different datasource alias.

No raw URLsDatasource-routedHMAC-signed

Live span tree

Topic / QoS / verdict / latency land on every span. Filter the canvas overlay by topic to find the device that's flapping or the policy gap that's letting noise through.

ADR-S14Per-messageCanvas overlay

Real services. Your stack.

Every dependency is a registered Strongly service or a model you control. Swap any one of them in the install wizard. The graph stays intact.

MQTT addon
Broker connection + auth + TLS
Conditional
streaming-conditional - predicate-driven branch
LLM model
gpt-4o-mini default - swap any registered chat model
Webhook out
streaming-webhook-response - STRONGLY_SERVICES-routed

Tune it. Don't fork it.

The marketplace template is the graph. Every customisation below is a config change or a single-node addition - never a rewrite.

Topic pattern

Edit mqtt_in.config.topics. One topic per line. Wildcards honoured.

Anomaly criteria

Replace the regex with a typed predicate after lifting JSON onto a ContextFrame (gt / lt / in).

Per-device prompt

Edit prompt.config.template to inject your equipment list, tagging conventions, or runbook references.

Multi-channel fan-out

Add streaming-conditional after the LLM to route by severity into different webhook nodes - critical to PagerDuty, high to Slack, low to email.

Audit trail

Add streaming-conversation-store between LLM and webhook so every drafted incident lands alongside the original sensor payload.

Production. Not pilots.

We don't leave until it runs. Talk to a forward-deployed engineer about deploying IoT Anomaly Responder into your environment with your STT, your LLM, your TTS, your data.

Schedule a Demo