How do I use Claude Code to investigate alerts from Prometheus with Tares?

Connect Claude Code to Tares over MCP, ingest your Prometheus alerts, and ask about the service that alerted to get the alert and its evidence in one timeline. Tares polls the alerts your Prometheus rules fire and correlates them with your other sources by label. Claude Code calls the Tares read tool and answers from that merged timeline instead of from the alert alone.

How it works

• The prometheus_alerts connector polls Prometheus’s own alerts endpoint every 30 seconds by default. Prometheus keeps deciding what counts as an alert. You need no Alertmanager and no PromQL. See Prometheus alerts.
• Each active alert becomes one event. The event_type is the alert name, the text is its summary, and the alert’s labels become Tares labels, plus a state of firing, pending or resolved.
• Tares tracks state across polls. An alert fires once, re-emits only when its state changes, and produces a resolved event when it clears.
• When your alert source and your metrics and log sources share a label such as service, they form one timeline per service.
• Claude Code connects over MCP and discovers the Tares tools. Its read tool returns a time-ordered timeline across all sources that match a label selector, such as service equal to api-server.
• Findings join the same timeline. Claude Code can read earlier findings with list_findings and write its own conclusion with record_finding or remember, so the next investigation starts from it.

For the wider picture of metrics, logs, alerts, triggers and agents, see Build an AI SRE.

Set it up

1. Install Tares and start it. The daemon listens on port 8787.

   uv tool install tares          # or: brew install glassflow/tap/tares
   tares up

2. Add the alerts source. In the console, go to Sources, then Add source, then Prometheus alerts, enter the Prometheus url and click Discover. You can also ask a connected agent to do it. The YAML form is:

   - name: alerts
     connector: prometheus_alerts
     poll: 30s
     config:
       url: http://localhost:9090
       severities: critical,warning   # blank = all
       labels:
         - { name: severity, field: labels.severity, primary: true }
         - { name: state, field: state }

3. Once real alerts have been ingested, open the source’s Fields tab and promote per-alert labels such as namespace or service. Use the same label name your metric and log sources use, so the alert lands on the same timeline as its evidence.

4. Start the MCP server in a second shell. The daemon alone does not serve /mcp.

   tares mcp

   The endpoint is http://127.0.0.1:8788/mcp. On your own server or Tares Cloud, the MCP server is already running. Use your own endpoint, shown under Connect in the Tares Cloud console.

5. Connect Claude Code. The Tares plugin is the default path. It wires the MCP read-back and session capture in one install, and it asks for the Tares URL, an optional auth token and a capture toggle.

   /plugin marketplace add glassflow/tares
   /plugin install tares@tares

   To connect without capturing sessions, add Tares as an HTTP MCP server with the claude CLI. The connecting agents page lists the exact command, and the console’s Connect page fills in your endpoint and token. On a secured instance, use an API key with the read scope.

6. Verify the connection by asking Claude Code:

   Use tares: what are you ingesting right now?

   It calls catalog_list and answers with your sources, triggers and projects.

7. Investigate. Ask about the service that alerted:

   Use tares: what happened to api-server in the last 15 minutes?

   Claude Code calls read with the service label set to api-server and answers from the merged timeline of alerts, metrics and logs.

What you get

• An answer that reads the alert together with the evidence around it, in one time-ordered read, instead of an alert name with no context.
• One event per active alert, plus a resolved event when it clears, so you can see when a problem started and when it ended.
• Alerts that stay where they are. Prometheus keeps owning alerting, and Tares ingests what fired and correlates it.
• An investigation that carries forward. Findings Claude Code records appear on the timeline, so the next question starts from the previous conclusion.
• Visibility into the reads. In the console, Reads lists each read as it happens, tagged client = mcp.

When something else fits

• If you already route alerts through Alertmanager, use the alertmanager connector. It receives what a webhook receiver pushes to a Tares ingest URL, and you keep your routing as it is. The AI SRE guide compares it with this connector.
• If you want nobody to ask at all, use a trigger. A trigger can wake a Tares agent when an alert event arrives, and the agent writes a finding before you open the console. The same guide walks through this end to end.
• If you use Cursor, Codex or another MCP client instead of Claude Code, the steps are the same apart from the client config. See connecting agents for each client’s setup.
• If your alerts do not come from Prometheus rules, add the source that matches where they come from and keep the shared service label.

Related