How do I use Claude Code to investigate Datadog monitors with Tares?

With Tares, Claude Code investigates a Datadog monitor by reading the alert and the evidence for the same service in one timeline over MCP. Datadog sends each alert to a Tares webhook source, and you ask Claude Code about the service that alerted. It answers from the correlated read, not from the alert alone.

How it works

Datadog reaches Tares through the webhook connector and a vendor setup on the Datadog side. Tares has no connector of its own for Datadog today, so the webhook connector is the path.

• Datadog calls a webhook whose URL is the Tares ingest URL. You write the payload as JSON in the webhook Payload field from Datadog variables such as $ALERT_ID, $EVENT_MSG and $LINK, so the shape is yours.
• Tares stores the payload lossless. The labels you declare map payload fields into the event, and one label is primary.
• Your other Tares sources carry the same label, for example service. Events that share the label merge into one timeline per service, on one clock.
• Claude Code connects to the Tares MCP endpoint. When you ask about a service, it calls read with a selector such as the service name and gets the alert, logs, metrics and findings together. See connecting agents for every client.

Keep the Datadog payload flat. event_type_field and text_template read top-level fields only.

Set it up

1. Start Tares and the MCP server. On your machine, run each in its own shell:

   tares up
   tares mcp

   The MCP endpoint is http://127.0.0.1:8788/mcp. On your own server or Tares Cloud, the MCP server is already running and you use your own endpoint.

2. Create a webhook source in the console under Sources → Add source → webhook, or ask a connected agent to create it. Declare a label for each payload field you want to correlate on, such as the service name, and mark one primary. Use the same label name as your other sources so the timelines merge. Copy the ingest endpoint from the source page. A webhook source looks like this:

   - name: ci-events
     connector: webhook
     config:
       event_type_field: action
       text_template: '{action} by {sender}'
       labels:
         - { name: pipeline, field: pipeline, primary: true }

3. In Datadog, open the Webhooks integration and add a webhook whose URL is the Tares ingest URL. Write the payload as flat JSON from Datadog variables, and include a field that carries the service name.

4. If Tares has auth on, add custom headers as JSON in the Datadog webhook, with an Authorization Bearer header that holds an ingest-scoped API key.

5. Put @webhook- followed by your webhook name in the monitor message, so the monitor calls the webhook.

6. Check delivery. Open Recent events on the source and use Fields to confirm which payload fields arrive. You can also post a test payload with curl:

   curl -X POST http://localhost:8787/ingest/<ingest_key> \
     -H 'Content-Type: application/json' \
     -d '{"action": "deploy", "sender": "ci", "pipeline": "web"}'

7. Connect Claude Code. The Tares plugin is the default path. It wires the MCP read-back and session capture in one install:

   /plugin marketplace add glassflow/tares
   /plugin install tares@tares

   The install asks for the MCP endpoint and an optional auth token. To connect without capturing sessions, add the endpoint with the claude CLI over MCP instead. On a secured instance, give the client a scoped API key with the read scope.

8. Ask about the service that alerted:

   Use tares: what happened to checkout in the last 15 minutes?

   Claude Code calls read with the service label and answers from the correlated timeline. Replace checkout with the service name your payload carries.

What you get

• Claude Code starts from the Datadog alert and the surrounding evidence for that service, so you do not copy context between tools.
• One read returns logs, metrics, alerts and findings on a single clock, which lets the agent tie the alert to what happened around it.
• Every client that speaks MCP gets the same view: Claude Code, Codex, Cursor and your own agents.
• The investigation can end with a finding. Claude Code can record it with record_finding, and the next investigation reads it, so it starts from the last conclusion.
• On a secured instance, the Authorization Bearer header is the credential for Datadog. A scoped API key gives Claude Code read access without the root token.

The AI SRE guide shows the full loop, including triggers that wake an agent when an alert arrives.

When something else fits

• If you only need to look at Datadog data itself, Datadog’s own tools already cover it. Tares adds value when you want the alert next to logs, metrics and deploys from your other systems.
• If you do not use Claude Code, the same MCP endpoint works with Codex, Cursor and any MCP client. See connecting agents.
• If you want an agent to start on its own when a monitor fires, instead of you asking, use a trigger and a Tares agent. The AI SRE guide walks through it.
• If your alerts come from Prometheus rules or Alertmanager, Tares has connectors for those, so you do not need a webhook setup.

Related