What do I need set up for the AI monitoring demo agent to run, and how long until the finding shows up?

Tares needs the demo stack running, the AI SRE demo template started under Projects, and an Anthropic API key pasted in so the built-in agent can run. After you cause an incident, the alert fires and the trigger wakes the agent within about 30 seconds. The finding lands on the timeline when the agent’s run finishes.

How it works

The demo runs on a laptop. It stands up a small api-server with Prometheus and a traffic generator, and wires Tares to them. Once you cause an incident, the flow from the AI monitoring guide runs in four steps:

• Source. The alert lands on the service’s timeline next to the metric that tripped it and the logs around it.
• Trigger. A trigger watches the sources for that service. In the demo it fires when an alert event arrives.
• Agent. The trigger wakes the built-in Tares agent, which starts with the correlated timeline already in front of it.
• Finding. The agent writes what broke, since when, the likely cause tied to evidence lines and a next action onto the timeline.

The timing has two parts. The alert fires and the trigger wakes the agent within about 30 seconds of the incident. The finding appears when the agent’s run finishes, so it shows up after the wake, not at the same moment.

Set it up

1. Start the demo stack and Tares. This brings up the api-server, Prometheus and the traffic generator, then installs and starts the Tares CLI:

curl -O https://raw.githubusercontent.com/glassflow/tares/main/demo/docker-compose.yml
docker compose up -d
uv tool install tares          # or: brew install glassflow/tap/tares
tares up

2. Open the console at http://127.0.0.1:8787 and go to Projects.
3. Pick the AI SRE demo template.
4. Paste an Anthropic API key so the built-in agent can run.
5. Click Start.
6. Cause an incident. Click Cause an incident on the project page, or post the error_spike scenario to the demo inject endpoint from a shell:

curl -s -XPOST localhost:8080/demo/inject -H 'content-type: application/json' \
  -d '{"scenario": "error_spike"}'

7. Wait about 30 seconds for the alert to fire and the trigger to wake the agent. Then watch the service’s timeline for the finding, which appears when the agent’s run finishes.

If you also want an MCP client such as Claude Code to read the same timeline, start the MCP endpoint in a second shell:

tares mcp

For a longer walkthrough that connects an MCP client and then points the same setup at your real systems, read Build an AI SRE.

What you get

• A running demo where you cause an incident on purpose and see the whole path from alert to diagnosis.
• A trigger that wakes the built-in agent within about 30 seconds of the alert.
• A finding on the service’s timeline that states what broke, since when, the likely cause tied to evidence lines and a next action.
• A timeline that Claude Code, Cursor or any other MCP client can read when you want to investigate yourself. The next investigation, yours or another agent’s, starts from that finding.
• A feel for how an incident starts with a diagnosis instead of a blank page, before you connect your own systems.

When something else fits

• If you want to wake your own agent service instead of the built-in agent, a trigger can post the timeline to it over a webhook. The AI monitoring guide describes both options.
• If you are ready to use real systems, connect your own metrics, logs, alerts and deploys as sources with the same service label, and follow Build an AI SRE from the demo to production.

Related