How do I use the Cursor agent to investigate Grafana alert rules with Tares?

Tares lets Cursor investigate Grafana alert rules by reading the alert and the evidence around it in one timeline. You send Grafana notifications to a Tares webhook source, connect Cursor to the Tares MCP endpoint, and ask about the service that alerted. Cursor answers from the correlated read of the alert, logs and metrics for that service.

How it works

Tares has no connector of its own for Grafana Alerting today. Grafana reaches Tares through the webhook connector and a vendor setup on the Grafana side.

• Grafana side. A Webhook contact point posts each notification to the Tares ingest URL. A notification policy decides which alert rules go to that contact point.
• Tares side. The notification arrives as one event, stored lossless, with the alerts list inside the payload. Top-level fields such as status, receiver and title work for labels and for text_template.
• Correlation. The Tares read tool returns a time-ordered timeline across all sources that match a label selector. If the Grafana source carries the same service label as your metric and log sources, one read returns the alert next to the evidence for that service.
• Cursor side. Cursor connects to the Tares MCP endpoint, discovers the Tares tools and calls read for you. This is the pull path described in Build an AI SRE.

Set it up

1. Start Tares and the MCP endpoint. On a local Tares the daemon alone does not serve /mcp, so run the MCP server as a second process in another terminal.

   tares up
   tares mcp

2. Create a webhook source for the service your Grafana rules cover. A top-level payload field can feed a label, and a constant label ties the source to a service. Use the same label name your other sources use, here service. Create one source per service and give each its own constant value.

   - name: grafana-checkout
     connector: webhook
     config:
       text_template: '{title} is {status}'
       labels:
         - { name: service, const: checkout, primary: true }
         - { name: status, field: status }
         - { name: receiver, field: receiver }

   Copy the ingest URL from the source page.

3. In Grafana, add a Webhook contact point with the Tares ingest URL and the POST method. When Tares has auth on, set the Authorization header scheme to Bearer and the credentials to an ingest-scoped API key. Then route the alert rules for that service to the contact point from a notification policy.

4. Connect Cursor. Add the Tares server to ~/.cursor/mcp.json for all projects, or to .cursor/mcp.json for one project, then approve it under Settings → MCP.

   {
     "mcpServers": {
       "tares": {
         "url": "http://localhost:8788/mcp"
       }
     }
   }

   For a server or Tares Cloud instance, use your own endpoint instead. A secured instance needs a credential, and a key with the read scope is the one to prefer. The console’s Connect page generates the exact setup with the endpoint and token filled in. The Connecting agents page lists every client.

5. Verify. Ask Cursor:

   Use tares: what are you ingesting right now?

   Cursor calls catalog_list and lists your sources, including the Grafana one. Then ask about the service that alerted:

   Use tares: what happened to checkout in the last 15 minutes? Which Grafana alert fired and what do the logs and metrics show?

What you get

• Cursor reads the Grafana alert together with the logs and metrics for the same service, on one clock, instead of you switching between tools.
• Each Grafana notification is stored in full, so the alerts list, labels and annotations are available to the read.
• Every read shows up in the console under Reads, tagged client = mcp.
• Cursor can record what it finds. The record_finding and remember tools write the conclusion back to Tares, so the next investigation starts from it.
• The same MCP connection works for any other question about your systems, not only Grafana alerts.

When something else fits

• If you run Alertmanager, or want one event per alert, a separate alertmanager source can take the same Grafana payload, because the default Grafana payload is Alertmanager compatible. It has its own ingest URL.
• If you want an agent woken the moment an alert arrives rather than asking Cursor yourself, add a trigger and a Tares agent as described in Build an AI SRE.

Related