How do I ask the Cursor agent to investigate a cron job that stopped with Tares?

Tares lets the Cursor agent investigate a stopped cron job once you add the Tares MCP server to Cursor and ask what happened to the job’s service in the last 15 minutes. Cursor calls the read tool and answers from one correlated, time-ordered timeline of logs, metrics, alerts and findings. You get the evidence for the job in a single read instead of checking each system by hand.

How it works

This is the pull side: you ask, the agent reads.

• Tares ingests your sources and groups events by label, for example a service label. All sources that carry the same label value land on one timeline.
• The Tares MCP server exposes tools to any MCP client, Cursor included. The read tool returns a correlated, time-ordered timeline across all sources that match a label and value selector.
• When you ask Cursor about your cron job’s service, it calls read with that selector and answers from the merged logs, metrics, alerts and findings.
• Cursor can also call catalog_list and catalog_describe to see which sources exist and how fresh they are, then read with sources to look at just the ones that matter.

For the full picture of pull and push investigation, see Build an AI SRE.

Set it up

1. Start Tares and the MCP server. The daemon alone does not serve the MCP endpoint, so run the second command in another terminal:

tares up
tares mcp

Locally, your endpoint is http://localhost:8788/mcp. On your own server it is the /mcp path on your domain. On Tares Cloud the console shows your endpoint under Connect, and each instance has its own hostname.

2. Add Tares to Cursor. Edit ~/.cursor/mcp.json for a global setup, or .cursor/mcp.json for one project:

{
  "mcpServers": {
    "tares": {
      "url": "http://localhost:8788/mcp"
    }
  }
}

3. Approve the server in Cursor under Settings, then MCP.

4. Verify the connection. Ask Cursor:

   Use tares: what are you ingesting right now?

   Cursor should call catalog_list and list your sources, triggers and projects. If your cron job’s logs or alerts are not in that list, add them as sources first. Each connector page shows the setup.

5. Ask about the cron job. Use the label value your sources carry for that job:

   Use tares: what happened to nightly-report in the last 15 minutes?

   Cursor calls read with that service as the selector and answers from the correlated timeline. Replace nightly-report with your own service name.

6. Securing the connection. On a secured instance, including every server and Tares Cloud instance, the MCP surface needs a credential. Create an API key with the read scope and send it as an Authorization Bearer header. The console’s Connect page generates the exact client command with the endpoint and token filled in. An open local instance needs no credential.

Other clients connect the same way. See Connecting agents (MCP) for the per-client setup.

What you get

• One answer built from the evidence for the job: logs, metrics, alerts and findings on a single clock, so you see what happened around the time it stopped.
• No tool-per-system digging. Cursor reads one correlated timeline instead of querying each system.
• A trail you can check. In the console, Reads lists each read as it happens, tagged client = mcp.
• A way to carry the conclusion forward. With a key that has the right scope, the agent can write back what it found with record_finding or remember, so the next investigation starts from that conclusion. A read key covers the read surface only.
• Follow-up options. The agent can call create_trigger to be woken when the same thing happens again.

When something else fits

• If you want the investigation to start without anyone asking, use the push side: a trigger wakes an agent with the timeline when something fires. The AI SRE guide walks through it.
• If an agent should work inside one project only, give it a project key. It reads that project and records findings in it, and nothing else.
• If you would rather not wire up an external client, use Ask in the console, which has the same read tools hosted inside Tares.

Related