How do I ask the Cursor agent to investigate a disk filling up with Tares?

Tares lets the Cursor agent investigate a disk filling up once you connect Cursor over MCP and ask what happened to the affected service in the last 15 minutes. Cursor calls the read tool and answers from one correlated timeline of logs, metrics, alerts and findings for that service. Whatever your sources carry for the service, such as disk metrics from a Prometheus source, appears on that timeline.

How it works

This is the pull side. You ask, and the agent reads.

• Tares ingests your sources and labels them by service, so each service gets one time-ordered timeline.
• Cursor connects to the Tares MCP endpoint and discovers the Tares tools.
• When you ask what happened to a service, Cursor calls read with a selector such as {"service": "api-server"}. The selector is a {label: value} match, and every part must match.
• read returns the timeline across all matching sources, so logs, metrics, alerts and earlier findings arrive in one read, ordered by time.
• Cursor reasons over that timeline and answers in the chat.

A disk filling up shows on the timeline only if a source for it is ingested and labeled with the same service label as your logs and alerts. A Prometheus source, for example, lets you pick metrics by name or label with no PromQL. Alerts that Prometheus rules fire reach the same timeline through the prometheus_alerts or alertmanager connector. For the full picture of how sources, timelines and agents fit together, see AI SRE.

Set it up

1. Start Tares on your machine, then start the MCP server in a second terminal. The daemon alone does not serve /mcp.

tares up
tares mcp

The MCP endpoint is http://127.0.0.1:8788/mcp, also reachable as http://localhost:8788/mcp.

2. Add the endpoint to ~/.cursor/mcp.json for all projects, or to .cursor/mcp.json for one project:

{
  "mcpServers": {
    "tares": {
      "url": "http://localhost:8788/mcp"
    }
  }
}

3. In Cursor, open Settings → MCP and approve the tares server.

4. Verify the connection by asking Cursor:

   Use tares: what are you ingesting right now?

   Cursor calls catalog_list and answers with your sources, triggers and projects. Check that the sources behind the disk, such as its metrics, logs and alerts, are listed and labeled with a service.

5. Ask about the service whose disk is filling up. Swap in your own service name:

   Use tares: what happened to api-server in the last 15 minutes?

   Cursor calls read with the service label and answers from the correlated timeline. In the console, Reads lists each read as it happens, tagged client = mcp.

6. Follow up in the same chat. Ask when the metric started climbing, which log lines came with it, and whether an alert fired. If a finding from an earlier investigation sits on that service’s timeline, Cursor reads it too and starts from that conclusion.

Running Tares on your own server or on Tares Cloud? Use the endpoint for your instance instead of the local URL. Tares Cloud shows it in your console under Connect, and the Connect page generates the Cursor snippet with the endpoint and token filled in. A secured instance needs a credential. Use an API key with the read scope, sent as an Authorization Bearer header. Details for every client are on Connecting agents (MCP).

What you get

• One question gives Cursor the logs, metrics, alerts and findings for the service on a single clock, so the agent does not query each system separately.
• You can narrow or widen the question in plain words. Ask about the last 15 minutes, about a single entity, or about what changed before the disk started filling.
• The agent answers from evidence on the timeline, so you can ask it to point to the specific lines and metrics behind its conclusion.
• Every read appears in the console under Reads, tagged client = mcp, so you can see what Cursor looked at.
• With a key that has write scope, Cursor can also write back what it found. remember stores an observation, and record_finding records a finding on the entity, so the next investigation starts from it. A read key covers reading only.
• The same setup works for any service you label, not only the one with the disk problem.

When something else fits

• If you want an investigation to start without anyone asking, use a trigger. It wakes a Tares agent, or your own agent over a webhook, with the timeline already attached. That is the push side, covered in AI SRE.
• If you would rather not wire up an external client, use Ask in the console, which has the same read tools inside Tares.
• Other clients connect the same way: Claude Code, Codex, or any MCP client. See Connecting agents (MCP).

Related