Can a Tares agent restart a service or open a ticket on its own?

By default a Tares agent reads and concludes but does not act, so it does not restart, deploy or open tickets. It has the read and stats tools, plus skill when its projects have skills, and it ends runs with conclude. When you connect an external MCP server to an agent, that one agent can use the server’s tools, and each run records which external tools it called.

How it works

Every Tares agent starts with the same small set of tools, all routed through the Tares read path. They cover the sources of the projects the run is for, unless the agent names other sources with sources.

• read returns one correlated timeline for an entity.
• stats counts per value of one label, this window against the window before, largest change first. It suits a busy stream where reading lines would only show the latest few.
• skill loads one skill’s instructions by name. The agent gets it when a project the run is for has skills, and each run records the skills it loaded.
• conclude ends the run.

None of these change anything outside Tares. That is the default boundary: the agent reads evidence, reasons about it and concludes.

Connecting external MCP servers moves the boundary. Tools from an MCP server can act on whatever the server exposes, such as creating an issue. The change applies to the one agent you opt in, not to every agent. At run time the selected servers’ tools are offered to the model next to read and stats, prefixed by the server name, for example github__create_issue.

The Tools and MCP servers page covers the full detail. For the wider picture of how agents fit into incident work, see AI SRE.

Set it up

To let one agent act, register a server and then opt that agent in.

1. Open Settings → MCP servers in a project’s Advanced setup and register the server. Any project’s agents can then use it. You give it a name, a streamable-HTTP URL and, if needed, an auth header. Tares stores the header value as a secret and never shows it again. Stdio servers are not supported.
2. If the server is GitHub’s hosted MCP server, point the auth value at a stored GitHub credential. Rotating the token in one place then rotates the server too.
3. Under Advanced: extra headers, add any non-secret headers that Tares sends with every request. GitHub’s hosted MCP server takes these two:

X-MCP-Toolsets: repos,pull_requests
X-MCP-Readonly: true

The first limits the tools the server offers. The second gives you a read-only agent. 4. Select Test. Tares connects live and lists the server’s tools, so you see what the agent could call before you opt it in. 5. Open the agent’s form, go to External tools and pick the registered servers it may use. Each selection shows as a removable tag. Remove a tag and the agent goes back to reading and concluding only. 6. After the agent runs, open the run under Runs and check which external tools it called.

What you get

• A safe default. A new agent investigates and concludes without touching your services or your ticket tracker.
• Control per agent. You choose which servers each agent may use, so one agent can open tickets while the others stay read-only.
• An audit trail. Each run records the external tools it called, shown on the run under Runs. That is the record of what an agent touched outside Tares.
• Bounded tool output. A tool result is capped at 8,000 characters, so a verbose server cannot crowd out the evidence.
• Resilient runs. If a server is down when a run starts, Tares skips it and logs that. The run continues with the tools that remain. A failed call goes back to the model as an error it can reason about.

When something else fits

• If you only want diagnosis and a written conclusion, leave External tools empty. The default read, stats, skill and conclude tools are all the agent needs.
• If you want an agent to reach a server but never change anything, use a read-only setup such as the X-MCP-Readonly: true header on GitHub’s hosted MCP server, and check the run record afterward.
• If a tool lives behind a stdio-only server, Tares cannot call it today, because only streamable-HTTP servers are supported.

Related