How do I use Claude Code to investigate PagerDuty incidents with Tares?

Tares lets Claude Code investigate a PagerDuty incident by reading the alert together with the logs, metrics and deploys for the same service. PagerDuty delivers incidents through the webhook connector and a PagerDuty setup, and Claude Code connects over MCP. You ask about the service that alerted and Claude Code answers from one correlated timeline. Tares has no connector of its own for PagerDuty today.

How it works

• PagerDuty sends a v3 webhook subscription to the ingest URL of a Tares webhook source. Each delivery is stored as an event, with the full payload kept lossless.
• The source carries a primary service label. Your other sources use the same service label, so the incident sits on the same timeline as the metrics, logs and deploys for that service.
• Claude Code connects to the Tares MCP endpoint. The read tool returns a time-ordered timeline across all sources that match a label selector such as service. catalog_list shows what Tares is ingesting.
• Because the alert and the evidence arrive in one read, Claude Code does not need a separate tool for each system. See AI SRE for how correlation by service works end to end.

Set it up

1. Start Tares and the MCP endpoint. On a local Tares, run each command in its own terminal:

   tares up
   tares mcp

2. Create a webhook source for the service. Give it a primary service label with a constant value, so every PagerDuty event joins that service’s timeline. Add a second label for the PagerDuty event type. PagerDuty nests fields under event, so use one-level dotted fields, and set a fixed event_type because event_type_field reads top-level fields only. The webhook connector page covers the full configuration.

   - name: pagerduty-checkout
     connector: webhook
     config:
       event_type: incident
       labels:
         - { name: service, const: checkout, primary: true }
         - { name: event_type, field: event.event_type }

   Save the source and copy its ingest URL. Create one source per service, with the matching service value in each.

3. In PagerDuty, create a v3 webhook subscription, in the console or with the Webhook Subscriptions API. Set its delivery URL to the Tares ingest URL. Choose events such as incident.triggered and incident.resolved. Set the scope to the service that source covers, so the constant label is accurate. If Tares has auth on, add a custom header on the delivery method: Authorization with a Bearer value holding an ingest-scoped API key. Do not set a signature scheme on the source. PagerDuty signs with a v1= prefixed header, so the Bearer header is the credential.

4. Label your other sources for that service with the same service label, for example metrics, logs and a deploy webhook. This is what lets one read return the alert next to its evidence.

5. Connect Claude Code to the MCP endpoint:

   claude mcp add --transport http tares http://localhost:8788/mcp

   The Tares plugin is the default path and also captures sessions. On a secured instance, pass a read-scoped API key as an Authorization Bearer header. Per-client details are on the connecting agents page.

6. Ask Claude Code about the service that alerted:

   Use tares: what happened to checkout in the last 15 minutes?

   Claude Code calls read with the service selector and answers from the correlated timeline.

7. To check the source, open its Recent events list after PagerDuty delivers a test event. Fields shows which payload fields arrive.

What you get

• One answer that puts the PagerDuty incident next to the logs, metrics and deploys for the same service, ordered in time.
• A question that starts from the service name, not from a list of tools for each system.
• A lossless record of every PagerDuty delivery, with the event type available as a label for filtering.
• Triggers on the PagerDuty source too, since it is an ordinary Tares source. You can wake a Tares agent or your own agent when an incident event arrives.
• Findings written back to the timeline. Claude Code can record a finding, so the next investigation starts from the last conclusion.

When something else fits

• If you want an agent to investigate without you asking, put a trigger on the PagerDuty source and wake a Tares agent. See AI SRE.
• If one PagerDuty subscription must cover many services, a constant service label no longer fits, because one source carries one value. Use one source per service, or label from a payload field that names the service.
• If you work in Cursor or Codex instead of Claude Code, the same endpoint and tools apply. Only the client command changes.

Related