How do I ask Claude Code to investigate a disk filling up with Tares?

Tares lets Claude Code investigate a disk filling up by connecting it over MCP and asking what happened to the affected service in the last 15 minutes. Claude Code calls the read tool and answers from one correlated timeline of logs, metrics, alerts and findings. You connect once with the Tares plugin, then ask in plain language.

How it works

Claude Code discovers the Tares tools over MCP. When you ask about a service, it calls read with a label selector such as the service name. Tares returns a time-ordered timeline across every source that carries that label, so one answer covers what the metrics, logs and alerts did on the same clock.

For a disk problem, the evidence is whatever you have ingested for that service:

• Disk and filesystem metrics you pick by name or label from a Prometheus server, through the prometheus connector.
• Request or application logs tailed from a container.
• Alerts that your Prometheus rules have fired, such as a disk-space rule.
• Findings that earlier investigations recorded on the same timeline.

The timeline is only as complete as your sources. Label every source with the same service label so they merge into one timeline per service.

Where your endpoint lives depends on where Tares runs:

• On your machine, it is http://localhost:8788/mcp, after you start the MCP server.
• On your own server, it is your domain with /mcp on the end.
• On Tares Cloud, the console shows it under Connect.

Set it up

1. Start Tares and the MCP endpoint. Run the first command in one terminal and the second in another. The daemon alone does not serve /mcp.

tares up
tares mcp

2. Install the Tares plugin in Claude Code. One install wires the MCP read-back and session capture into the claude_code source.

/plugin marketplace add glassflow/tares
/plugin install tares@tares

3. Answer the prompts. The plugin asks for the Tares URL, which is the MCP endpoint from step 1 (default http://127.0.0.1:8788/mcp). It also asks for an optional auth token, which it stores in the OS keychain, and a capture toggle. If you want to connect without capturing sessions, register the endpoint with the claude CLI over MCP instead. The agents page has the exact command.

4. Secure it if needed. On a secured instance or a Tares Cloud instance, the MCP surface needs a credential. Prefer an API key with the read scope over the root token. On an open local instance you need nothing.

5. Verify the connection. Ask Claude Code:

Use tares: what are you ingesting right now?

Claude Code should call catalog_list and list your sources, triggers and projects. In the console, Reads shows each read as it happens, tagged client = mcp.

6. Ask about the disk. Name the service that is running out of space:

Use tares: what happened to api-server in the last 15 minutes?

Replace api-server with your own service. Claude Code calls read with that service as the selector and answers from the correlated timeline. Ask follow-ups that stay on the evidence, such as which log lines appeared as the metric climbed, or whether an alert fired and when.

If the disk metrics are not in Tares yet, ask Claude Code to set up the source for you. The setup tools let it discover an upstream, dry-run the config and create the source, and ingestion starts immediately. The AI SRE guide shows how to key sources by service and wire the whole loop.

What you get

• One answer built from logs, metrics, alerts and findings on one clock, instead of a query against each system.
• A starting point that includes earlier conclusions. If an agent already recorded a finding on the service, your read includes it, so the investigation does not start from scratch.
• A record of every read. The console lists each MCP read, so you can see what Claude Code asked for.
• A way to write back. Claude Code can call record_finding or remember so the next investigation finds what this one learned.
• A way to be woken next time. Claude Code can call create_trigger over the sources that matter, so you hear about the next occurrence when it happens.

When something else fits

• If you want an investigation to start the moment a disk alert fires, without anyone asking, use a trigger that wakes a Tares agent or your own agent service. The AI SRE guide covers both halves.
• If you use Cursor, Codex or another MCP client instead of Claude Code, the agents page has the connection step for each. The question and the read call are the same.

Related