How do I ask the Codex CLI to investigate a cron job that stopped with Tares?

Tares lets you ask the Codex CLI about a stopped cron job by connecting Codex to the Tares MCP endpoint and asking what happened to that service in the last 15 minutes. Codex calls the read tool and answers from the correlated timeline of logs, metrics, alerts and findings for that entity. You add the connection once with codex mcp add, and every later question is a plain sentence in Codex.

How it works

Tares correlates every source that carries the same label value, such as service, into one time-ordered timeline. The MCP server exposes that timeline to Codex through the read tool.

• read returns a correlated, time-ordered timeline across all sources matching a label selector. The match is a strict AND, and project or sources narrows it.
• When you ask what happened to a service, Codex calls read with that service label and answers from what comes back.
• catalog_list and catalog_describe show Codex which sources, triggers and projects exist, so it can learn what is there before it reads.
• If an earlier investigation recorded a finding on the same entity, read includes it. Codex then starts from the previous conclusion instead of from scratch.

This is the pull side. You decide when to ask, and Codex reads the evidence on demand. To have Tares wake an agent when something fires, see the push side in Build an AI SRE.

Name the entity with the label value your sources carry. If the sources for your job are labeled service: nightly-backup, ask about nightly-backup.

Set it up

1. Start Tares on your machine.

   tares up

2. In a second terminal, start the MCP server. A local daemon does not serve /mcp on its own. By default the endpoint is http://127.0.0.1:8788/mcp.

   tares mcp

3. Add Tares to Codex. Keep --url before the URL, because a bare URL registers a stdio server.

   codex mcp add tares --url http://localhost:8788/mcp

4. Verify the connection. In Codex, ask:

   Use tares: what are you ingesting right now?

   Codex calls catalog_list and answers with your sources, triggers and projects. In the console, Reads lists each read as it happens, tagged client = mcp.

5. Ask about the job. Use the label value of the service your job’s sources carry:

   Use tares: what happened to nightly-backup in the last 15 minutes?

   Codex calls read for that entity and answers from the timeline. If you want to narrow the read, tell Codex which sources to look at. It passes them as sources.

6. On a secured instance, such as your own server or Tares Cloud, use your instance’s endpoint and give Codex a credential through an environment variable. Prefer an API key with the read scope over the root token. Tares Cloud shows the exact endpoint and token under Connect in your console.

   export TARES_API_KEY=<api-key>
   codex mcp add tares --url https://<your-host>/mcp \
     --bearer-token-env-var TARES_API_KEY

   To let Codex work inside one project only, use a project key. It reads that project and records findings in it, and nothing else.

For other clients and transports, see Connecting agents (MCP).

What you get

• A Codex session that can answer questions about your systems from Tares, in plain sentences, without you pasting logs or metrics into the prompt.
• One correlated read per question. Logs, metrics, alerts and findings for the entity come back merged on a single clock, so Codex works from one view instead of querying each system separately.
• A way to confirm the wiring. Every read shows up in the console under Reads with client = mcp.
• A trail for the next investigation. Codex can use remember to write an observation back, or record_finding with a project key to record a finding on the entity. The next question about that entity starts from that conclusion.
• A follow-up path. Once you know what to watch for, Codex can use create_trigger to be woken when it happens again.

When something else fits

• If you want Tares to wake an agent the moment something fires, instead of asking by hand, use a trigger and the push flow in Build an AI SRE.
• If you want to explore the same data without wiring up an external client, use Ask in the Tares console, which has the same read tools.
• If you use Claude Code, Cursor or another MCP client rather than Codex, the same endpoint works. Connecting agents (MCP) lists the setup for each.

Related