How do I use Claude Code to investigate Alertmanager alert groups with Tares?

Tares lets Claude Code investigate Alertmanager alerts by connecting over MCP and asking about the service that alerted. Alertmanager pushes each alert to a Tares ingest URL, and Claude Code reads it together with the logs, metrics and findings for the same service in one correlated timeline. You connect the client once and then ask in plain language, for example what happened to a service in the last 15 minutes.

How it works

Two pieces work together: the Alertmanager receiver that feeds Tares, and the MCP connection that lets Claude Code read.

• Alertmanager has already evaluated, grouped and deduped the alerts. With send_resolved on, it also tracks firing to resolved. Tares records what it pushes.
• Alertmanager POSTs a batch. Tares splits the alerts array into one event per alert. The event_type is the alert name, the text is its summary, and the alert labels become Tares labels plus a status of firing or resolved. The full alert, including fingerprint, stays in the payload.
• Tares keys each event to an entity from a label, in this order: namespace, service, job, instance. A declared primary label overrides that.
• Any other source that carries the same label, such as logs or metrics, lands on the same timeline.
• Claude Code connects to the Tares MCP endpoint and uses the read tool with a selector such as service equals api-server. It gets a time-ordered timeline across all matching sources, so the alert arrives with the evidence around it. Findings that agents recorded earlier appear there too.

See the Alertmanager connector for the receiver details and AI SRE for the full incident-response setup.

Set it up

1. Start Tares and the MCP endpoint, each in its own terminal:

tares up
tares mcp

The MCP endpoint is then http://127.0.0.1:8788/mcp.

2. Create the Alertmanager source. Ask a connected agent to create an Alertmanager source and give you the webhook URL, or use Sources, Add source, Alertmanager alerts in the console. The source page shows a ready receiver block with the ingest URL filled in.

3. Add the receiver to your alertmanager.yml and reload Alertmanager:

receivers:
  - name: tares
    webhook_configs:
      - url: http://localhost:8787/ingest/<ingest_key>
        send_resolved: true
route:
  receiver: tares

If Tares has auth on, Alertmanager sends a Bearer Authorization header holding an ingest-scoped API key. Add it to the webhook_configs entry through the receiver’s http_config, as the source page shows. Without auth, no header is needed.

4. Send a test alert and check Recent events on the source page:

curl -X POST http://localhost:8787/ingest/<ingest_key> \
  -H 'Content-Type: application/json' \
  -d '{"alerts":[{"status":"firing","labels":{"alertname":"PostgresDown","severity":"critical","namespace":"prod"},"annotations":{"summary":"Postgres is down"},"startsAt":"2024-01-01T00:00:00Z"}]}'

The Fields view shows the alert labels, so you can promote namespace or service as the label to correlate on.

5. Connect Claude Code. The Tares plugin is the default path. It wires the MCP read-back and session capture in one install:

/plugin marketplace add glassflow/tares
/plugin install tares@tares

To connect without capturing sessions, add the endpoint directly:

claude mcp add --transport http tares http://localhost:8788/mcp

On a secured instance, the MCP surface needs a credential. Pass an API key with the read scope as an Authorization Bearer header. Tares Cloud shows the exact command under Connect in the console. See Connecting agents for every client.

6. Verify by asking Claude Code: Use tares: what are you ingesting right now? It should call catalog_list and list your sources.

7. Investigate. Ask about the service that alerted, for example: Use tares: what happened to api-server in the last 15 minutes? Claude Code calls read with a service selector and answers from the correlated timeline.

What you get

• One read that puts the Alertmanager alert next to the logs, metrics and findings for the same service, on one clock.
• Firing and resolved states on the timeline, because each alert carries a status.
• A starting point for each investigation. Findings recorded earlier show up in the read, so Claude Code begins from the previous conclusion.
• A way to write back. Claude Code can use record_finding to leave its conclusion for the next investigation, and remember to store an observation. Both need a key with the matching scope.
• Alertmanager keeps owning alerting. Grouping, silencing and resolved semantics stay where they are, and Tares ingests what Alertmanager sends and correlates it.
• Every read appears under Reads in the console, tagged client = mcp.

When something else fits

• If you do not run Alertmanager and want alerts straight from Prometheus rules, use the prometheus_alerts connector. It polls instead of receiving pushes.
• If you want an agent woken the moment an alert fires, rather than asking interactively, add a trigger and a Tares agent as the AI SRE guide describes.
• If you use Cursor, Codex or another MCP client instead of Claude Code, the same endpoint works. Connecting agents lists the setup for each.

Related