# Explain this failure

> Open a failed deploy and choose **Explain this failure**: built-in signatures name the likely cause at once. Add your own Anthropic API key in **Settings → AI** to use **Ask AI**, which runs the diagnosis on the failing server and returns the cause, the evidence and the next steps.

URL: https://unrent.dev/docs/ai/

## Add your key

1. An owner or admin opens **Settings → AI** and pastes an Anthropic API key.
2. **Seal and save** encrypts it in the browser to every server’s key. Unrent stores only the ciphertexts and the last four characters.
3. **Test** checks the key from a server. Servers added later need the key sealed to them too; the page shows which.

Removing the key deletes every ciphertext and cancels AI jobs that have not started.

## What runs where

The diagnosis runs on the server that failed. The agent gathers the failure output, container state and recent logs, redacts secrets, runs the signatures, and calls `api.anthropic.com` directly. The root helper has no internet access of its own: it reaches the model through a tunnel that allows only `api.anthropic.com:443`, and TLS runs end to end, so the tunnel never sees the key or the prompt.

Never sent: secret values, plain variable values, other services’ data. Unrent receives a structured result, checks it, shows it as plain text and keeps it for 30 days.

## Answers and actions

The answer gives the root cause, a confidence, the log lines it cites (highlighted in the output) and next steps. If it suggests restarting, rolling back or starting the service, that is a button that runs the normal job, with its usual approvals.

Log lines are treated as untrusted data: a line that says “ignore previous instructions” stays inside the evidence, and an answer that proposes anything else, or cites lines it was not shown, is refused.

## Budget

Each organisation has a monthly token budget, shown with a usage bar in **Settings → AI**. You pay Anthropic directly; Unrent charges nothing for AI.