How do I ask Claude Code to investigate error spikes with Tares?

You investigate error spikes with Tares by connecting Claude Code over MCP and asking what happened to a service in the last 15 minutes. Claude Code calls the read tool and answers from one correlated timeline of logs, metrics, alerts and findings. You get the evidence for the spike in a single read, with no per-system queries.

How it works

Tares exposes an MCP server. Claude Code discovers its tools and uses them when you ask a question in plain language.

• One read, all sources. The read tool returns a time-ordered timeline across every source that matches a label selector. The selector is a strict AND of label and value pairs. For the question “what happened to api-server in the last 15 minutes?”, Claude Code calls read with {"service": "api-server"}.
• One timeline per service. When your metrics, logs and alerts sources carry the same service label, they merge on one clock. A burst of 5xx errors, the alert that fired and the log lines around it sit next to each other.
• Findings included. The timeline also carries findings that Tares agents or outside agents recorded earlier. Claude Code starts from the previous conclusion instead of from scratch.
• Visible reads. In the console, Reads lists each read as it happens, tagged client = mcp.

This is the pull side: you ask when you want to look. To have an agent woken automatically when a trigger fires, see Build an AI SRE.

Set it up

1. Start Tares and the MCP endpoint. The daemon alone does not serve /mcp, so run the MCP server in a second shell. The endpoint is http://localhost:8788/mcp.

tares up

tares mcp

2. Connect Claude Code. The Tares plugin is the default path. It wires the MCP read-back and also captures your Claude Code sessions into Tares. Run these in Claude Code:

/plugin marketplace add glassflow/tares
/plugin install tares@tares

The install prompts for the Tares URL (default http://127.0.0.1:8788/mcp), an optional auth token and a capture toggle. If you want the MCP connection without session capture, add the server from your terminal instead:

claude mcp add --transport http tares http://localhost:8788/mcp

3. Use a credential on a secured instance. A server or Tares Cloud instance needs one. Replace the URL with your own endpoint and pass an API key. Prefer a key with the read scope. On Tares Cloud, the console’s Connect page shows your endpoint and generates the exact command.

claude mcp add --transport http tares https://<your-host>/mcp \
  --header "Authorization: Bearer <api-key>"

4. Verify the connection. Ask Claude Code:

Use tares: what are you ingesting right now?

It calls catalog_list and answers with your sources, triggers and projects.

5. Ask about the spike. Name the service and the window:

Use tares: what happened to api-server in the last 15 minutes?

Claude Code calls read and answers from the correlated timeline. Swap in your own service name.

6. Dig in. Ask follow-up questions, such as which alert fired first or which log lines match the rise in errors. Claude Code can narrow a read to the sources that matter with sources, or look at one project with project.

If you want to see a spike on a laptop first, the Build an AI SRE guide includes a demo system with an error_spike scenario you can trigger. For other clients and transports, see Connecting agents (MCP).

What you get

• A direct answer from one read. Claude Code gives you what happened to the service, in order, with the logs, metrics and alerts side by side.
• No per-system wiring in the agent. Tares does the ingestion and correlation. Claude Code only needs the MCP endpoint.
• Continuity between investigations. Findings on the timeline mean the next question builds on the last conclusion.
• Least-privilege access. A read scoped API key limits what the client can do. For an agent that should work in one project only, a project key reads that project and records findings in it, and nothing else.
• An audit trail. Every read shows up under Reads in the console.

When something else fits

• You want to be woken, not to ask. If an error spike should start an investigation on its own, use a trigger that wakes an agent. Build an AI SRE walks through it end to end, and the same MCP client can read the finding afterwards.
• You prefer another client. Codex, Cursor, Claude Desktop and any MCP client connect to the same endpoint. The setup for each is on the agents page.
• You do not want to wire an external client. The console includes Ask, a chat loop inside Tares with the same read tools, so you can explore and debug your data without connecting anything.
• Your agent only supports stdio. Tares also offers a stdio transport through tares-mcp for an agent on the same machine as the daemon.

Related