Can an AI agent read PagerDuty incidents through Tares and explain them?

Yes, Tares lets an AI agent read PagerDuty incidents and explain them. PagerDuty delivers incidents to a Tares webhook source, and the agent reads them over MCP. Tares has no connector of its own for PagerDuty today, so PagerDuty reaches Tares through the webhook connector and a PagerDuty-side setup. The client only needs the Tares MCP endpoint.

How it works

PagerDuty posts each v3 webhook event to the ingest URL of a Tares webhook source. Tares stores the payload lossless, so the event id, event_type, resource_type, occurred_at and the agent, client and data objects are all kept. The labels you declare map payload fields into the envelope, and those labels are what the agent selects on.

The agent connects to Tares over MCP, from Claude Code, Codex, Cursor or any MCP client (see Connecting agents). Its read tool returns a correlated, time-ordered timeline across all matching sources. You pick a label and a value, and project or sources narrows the read. An incident from PagerDuty appears in that timeline with the labels you declared, its stored payload and its time, next to whatever else Tares ingests for the same entity.

The client needs no PagerDuty connector because the vendor-specific work sits on the Tares side. PagerDuty reaches Tares through the webhook connector, and the client sees only the Tares MCP tools. catalog_list shows the source, and catalog_describe returns its schema, entities, freshness, lineage and sample events.

The explanation is the agent’s own work. It reads the incident events and their surroundings from Tares and writes the account in plain language. For the wider picture, see AI SRE.

Set it up

1. Create a webhook source in Tares. Use labels with one-level dotted fields such as event.event_type, and set a fixed event_type, because event_type_field reads top-level fields only. Copy the ingest endpoint from the source page.

- name: pagerduty-incidents
  connector: webhook
  config:
    event_type: incident
    labels:
      - { name: event_type, field: event.event_type, primary: true }
      - { name: resource_type, field: event.resource_type }

2. In PagerDuty, create a v3 webhook subscription, in the console or with the Webhook Subscriptions API. Set its delivery URL to the Tares ingest URL.
3. Choose the events, such as incident.triggered and incident.resolved, and the scope: account, team or service.
4. When Tares has auth on, add a custom header Authorization: Bearer followed by an ingest-scoped API key to the delivery method. Do not set signature_scheme on the source. PagerDuty signs with a v1= prefixed header that hmac_sha256 does not accept, so the Bearer header is the credential.
5. Start Tares locally if you have not already.

tares up

6. Connect your agent to the Tares MCP endpoint. Locally, start the MCP server with tares mcp first. Then add the endpoint to Claude Code.

claude mcp add --transport http tares http://localhost:8788/mcp

On a secured instance, the client also sends a read-scoped API key as a Bearer Authorization header. Each client tab on the agents page shows where it goes.

7. Ask your agent: “Use tares: what are you ingesting right now?” It calls catalog_list and lists the PagerDuty source. Then ask it to explain the latest incident.

What you get

• An agent that answers questions about PagerDuty incidents from a time-ordered timeline instead of a pasted alert.
• Incident events with the labels you declared and a lossless payload, so fields such as data, agent and client stay available for the agent to read.
• Incidents correlated by label with other data in Tares, so the agent can explain an incident in context.
• One client setup, the Tares MCP endpoint, whichever alert vendor feeds Tares.
• A way to confirm what arrives: Recent events and Fields on the source page show the events and which payload fields come in.

When something else fits

• If your alerts come from Alertmanager, the dedicated alertmanager connector turns each alert into its own event. It needs a webhook receiver in Alertmanager pointed at a Tares ingest URL.
• If you want an agent that wakes on its own when an incident arrives, build a trigger and a Tares agent instead of asking an external client to read after the fact.

Related