Can an AI agent read Grafana alert rules through Tares and explain them?

Yes, Tares lets an AI agent read the Grafana alerts your contact point sends and explain them from labels, annotations and start time. Grafana reaches Tares through the webhook connector and a vendor setup, so the agent needs no Grafana connector of its own. The agent connects to Tares once over MCP and reads Grafana alerts next to your logs, metrics and findings.

How it works

Two links make this work: Grafana to Tares, and your agent to Tares.

• Grafana to Tares. Grafana Alerting posts a notification to a webhook source. Tares has no connector of its own for Grafana Alerting today, so the webhook connector receives it. The notification arrives as one event, and the full payload is stored lossless. The alerts list inside it carries each alert’s status, labels, annotations, startsAt, endsAt and fingerprint. Top-level fields such as status, receiver and title can become labels and feed a text template.
• Agent to Tares. Claude Code, Codex, Cursor or any MCP client connects to the Tares MCP endpoint, as described in Connecting agents. The client discovers the Tares tools. It does not talk to Grafana, so it needs no Grafana connector, credentials or plugin.
• The read. The read tool returns a correlated, time-ordered timeline across all sources that match a label selector. A Grafana alert sits in that timeline with its labels, annotations and start time, alongside logs, metrics and findings for the same entity. catalog_list and catalog_describe show the agent what the Grafana source holds, including sample events and which payload fields arrive.

Tares serves the data and the agent writes the explanation. It reads what the alert says, such as the alert name label, the summary annotation and when it started, and relates it to what else happened around that time.

The agent sees the alerts Grafana notifies, as delivered to the contact point. Rule definitions that never produce a notification are not part of the read.

Set it up

1. Start Tares and the MCP endpoint. On a local Tares the daemon alone does not serve MCP, so run the MCP server as a second process.

tares up
tares mcp --transport streamable-http

2. Create a webhook source for Grafana. Add it in the console under Sources, or ask a connected agent to create it. Declare labels for the top-level fields you want to correlate on, and mark one as primary.

- name: grafana-alerts
  connector: webhook
  config:
    event_type_field: status
    text_template: '{title}: {status}'
    labels:
      - { name: receiver, field: receiver, primary: true }
      - { name: status, field: status }

3. Copy the ingest URL from the source page.
4. In Grafana, add a Webhook contact point with the Tares ingest URL and the POST method.
5. When Tares has auth on, set the Authorization header scheme to Bearer in the contact point and put an ingest-scoped API key in the credentials. An open local instance needs no header.
6. Route alerts to that contact point from a notification policy.
7. Connect your agent to the MCP endpoint, which is http://localhost:8788/mcp on a local Tares. The Connecting agents page has the exact steps for Claude Code, Codex and Cursor. On a secured instance, give the agent an API key with the read scope.
8. Ask the agent: “Use tares: what Grafana alerts fired in the last hour, and what do their annotations say?” It calls catalog_list, then read, and answers from the timeline.

The notification arrives as one event with the alerts list inside the payload. If you want one event per alert, the default Grafana payload is Alertmanager compatible. A separate alertmanager source has its own ingest URL and takes the same payload.

What you get

• An agent that can answer “why did this alert fire?” from the alert’s labels, annotations and start time, with no Grafana access of its own.
• Alerts in one correlated timeline with logs, metrics and findings for the same entity, so the explanation includes what else changed.
• The lossless payload, including fingerprint and end time, so the agent can tell a firing alert from a resolved one.
• One MCP connection that covers Grafana and every other source you ingest, instead of one integration per alert vendor.
• Read-only access for the agent when you give it a read key. For more on how AI SRE fits together, see that guide.

When something else fits

• If you need the agent to browse or edit Grafana rule definitions themselves, Tares does not do that. Use Grafana’s own tools for it.
• If you want one event per alert rather than one per notification, use an alertmanager source with the Grafana payload instead of the webhook source.

Related