How do I ask Claude Code to investigate crash loops with Tares?

Tares lets you connect Claude Code over MCP and ask what happened to the crash-looping service in the last 15 minutes. Claude Code calls the read tool and answers from one correlated timeline of logs, metrics, alerts and findings. You install the Tares plugin, point it at your MCP endpoint, and ask in plain language.

How it works

Tares ingests your sources and labels them, for example by service. Every source that carries the same label lands on one timeline for that service, ordered by time.

The Tares MCP server exposes that timeline to Claude Code as tools. When you ask about a crash-looping service, Claude Code calls read with a label selector such as {"service": "api-server"}. It gets back one time-ordered read across all matching sources, so the restart messages in the container logs, the alerts that fired and the metrics sit side by side on one clock.

The read also includes findings that earlier investigations recorded. Claude Code starts from the previous conclusion instead of from scratch.

The tools Claude Code uses for this:

• catalog_list shows your sources, triggers and projects.
• read returns the correlated timeline for a selector.
• list_findings shows findings already recorded in a project.
• record_finding writes a conclusion back so the next investigation finds it.

The Connecting agents (MCP) page covers the other clients and transports. The AI SRE guide shows the full loop, where a trigger wakes an agent and the agent writes its finding back.

Set it up

1. Start Tares locally, with your sources already sending logs, metrics or alerts for the service that crash loops, all labeled with the same service value.

   tares up

2. In a second terminal, start the MCP endpoint. A local daemon does not serve /mcp on its own.

   tares mcp

   The endpoint is http://127.0.0.1:8788/mcp. On your own server it is https://<your-domain>/mcp. On Tares Cloud, the console shows it under Connect, and nothing needs starting.

3. In Claude Code, install the Tares plugin. It wires the MCP read-back and session capture in one install.

   /plugin marketplace add glassflow/tares
   /plugin install tares@tares

   The install prompts for the Tares URL (your MCP endpoint), an optional auth token and a capture toggle. If you prefer to connect without capturing sessions, register the endpoint with the claude CLI over HTTP instead. The Connect page in the console generates the exact command with your endpoint filled in.

4. On a secured instance, which includes every server and Tares Cloud instance, give the client a scoped API key with the read scope. An open local instance needs no credential.

5. Verify the connection by asking Claude Code:

   Use tares: what are you ingesting right now?

   It should call catalog_list and answer with your sources, triggers and projects.

6. Ask about the crash loop. Use your own service name:

   Use tares: what happened to api-server in the last 15 minutes?

   Claude Code calls read with {"service": "api-server"} and answers from the correlated timeline. You can follow up with a narrower question, such as what changed just before the first restart, or whether an alert fired for the service.

7. Ask Claude Code to record its conclusion with record_finding, if your key allows project writes. The finding then shows up on the service’s timeline for the next investigation.

What you get

• One answer built from logs, metrics, alerts and findings for the service, merged on a single clock, instead of one query per system.
• A conversational way to dig in. You ask what happened, then narrow down, and Claude Code reads the same evidence each time.
• Continuity. Findings recorded earlier are part of the read, so a repeat crash loop starts from the last diagnosis.
• Visibility. In the console, Reads lists each read as it happens, tagged client = mcp.
• An easy path to the push side. Claude Code can use create_trigger to be woken when the problem happens again, and remember to write back what it found. Both are write tools, so the key needs the matching scope.

The answer is only as complete as the sources you connect. Add the logs, alerts and metrics for the crash-looping service and give them the same label, and the timeline carries them.

When something else fits

• If you want the investigation to start without you asking, use a trigger that wakes an agent when an alert fires. The AI SRE guide walks through it.
• If you prefer to stay in the browser, the Ask chat in the Tares console reads the same data without wiring up an external client.
• If you use Codex, Cursor or another MCP client instead of Claude Code, the agents page has the connection steps for each.

Related