Are secrets and thinking blocks in my Claude Code session transcripts stored in Tares?

Tares redacts obvious secrets and tokens from your Claude Code session transcripts before anything is stored, because redact is true by default. Assistant thinking blocks are left out by default, because include_thinking is false. Redaction runs server-side in the connector, so it applies on every session the plugin streams in.

How it works

The Tares plugin for Claude Code ships each session’s transcript to Tares over HTTP as the session progresses. The claude_code connector receives those lines and turns them into events, one per message, keyed by session.

Two fields tune what the connector stores:

• redact (bool, default true): redacts obvious secrets and tokens before storing.
• include_thinking (bool, default false): includes assistant thinking blocks in the rendered text when it is on.

Redaction runs server-side in the connector. It happens before the message is stored, not after, so the unredacted text is never written to the data plane. The same applies whether your daemon is local or remote, because the plugin sends transcripts the same way in both cases.

With the defaults, you get:

• Secrets and tokens that the redaction recognizes are replaced before storage.
• Thinking blocks are not part of the stored text.
• User messages, assistant replies and tool activity are stored as events with the labels session, project, branch, model, type and sidechain.

Redaction targets obvious secrets and tokens. Keep that in mind for anything unusual that you paste into a session, and do not rely on redaction as the only guard for highly sensitive values.

Set it up

You do not create the source by hand. The plugin creates the push source on the daemon the first time it runs, with the safe defaults already in place. These are the steps to get sessions flowing.

1. In Claude Code, install the plugin with /plugin marketplace add glassflow/tares and then /plugin install tares@tares.
2. Answer the install prompts. Tares URL defaults to http://127.0.0.1:8787, which matches tares up. MCP endpoint defaults to http://127.0.0.1:8788/mcp locally, and you run tares mcp --transport streamable-http next to tares up. The last prompt is Stream this session into Tares, the capture toggle, which is on by default.
3. On Tares Cloud, sign in instead of copying a URL or key into the plugin. Run the command below, pick your workspace in the browser, then set MCP endpoint to the address it prints.

tares login

4. Start a Claude Code session and do some work. Capture is forward-only, so sessions stream from the moment the plugin is installed. Transcripts already on disk are not backfilled.
5. Check what was stored. In the console, Explore lists sessions under the session key, and the source’s Recent events shows messages as they ship. You can also ask Claude Code: “Use tares to show me my current session’s timeline.”

Open Recent events on a session where you handled a token or key and confirm the stored text shows it redacted. Thinking blocks do not appear in the message text under the defaults.

The full plugin walkthrough is on the Claude Code sessions connector page.

What you get

• Session transcripts you can query like any other source, without raw secrets that the redaction recognizes landing in storage.
• A stored history that holds what you and the agent did, not the agent’s internal reasoning, unless include_thinking is on.
• Messages grouped by session, with project, branch and model as labels, plus token-usage fields. Sub-agent messages roll up into the same source and carry the sidechain label.
• Correlation between what the agent did and what your systems did, which is the reason to capture sessions in the first place. See AI SRE for how that fits an investigation.
• Read-back through the same install, so the agent can ask Tares about its own earlier sessions over the MCP endpoint.

Because redaction is server-side in the connector, you do not depend on each client machine to scrub text before it leaves.

When something else fits

• If you do not want a particular session stored at all, turn off the Stream this session into Tares capture toggle for it, rather than relying on redaction.
• If you need thinking blocks or unredacted text in stored sessions, those are governed by include_thinking and redact, so check their values against what your team wants stored before you roll the plugin out widely.
• If you want transcripts that already exist on disk, note that Tares does not backfill them. Only sessions from the plugin install onward are captured.

Related