Can an AI agent find the cause of a disk filling up without me running the queries?

Yes, Tares lets an agent trace a disk filling up without you running queries, because one read returns the correlated timeline. You connect an MCP client such as Claude Code, Codex or Cursor to Tares and ask in plain words. The agent needs no per-system tools, since Tares does the correlation across your sources.

How it works

The agent calls one Tares tool, read. It passes a label and value selector, for example the service or host the disk belongs to. Tares returns a time-ordered timeline across all sources that match the selector (strict AND). Metrics, logs, alerts and findings arrive together, already lined up in time.

This is why the agent needs no tool for each system:

• It does not query your metrics store, your log store and your alert system separately.
• It does not join their outputs itself. Tares has already correlated them.
• It can narrow the read with project or sources when one part of the timeline matters most.

To learn what exists first, the agent calls catalog_list for your sources, triggers and projects, and catalog_describe for one object’s schema, entities, freshness and sample events. Findings that you or other agents recorded with record_finding show up as well, so earlier conclusions are part of the picture. See Connecting agents (MCP) for the full tool list.

The read covers the sources you have connected. Tares can read Prometheus metrics, Docker container logs, Prometheus or Alertmanager alerts, and GitHub commits and pull requests. If you want a deploy or commit next to the disk growth, connect those sources. Give each source a label with the same name, such as service, so one selector matches them all.

Set it up

1. Start Tares locally and connect the sources that describe the system. On a server or Tares Cloud instance this is already running.

   tares up

2. Running locally? Start the MCP server in a second terminal. On a server or Tares Cloud instance there is nothing to start.

   tares mcp --transport streamable-http

3. Connect your client. For Claude Code, run this in your terminal:

   claude mcp add --transport http tares http://localhost:8788/mcp

   For a secured instance or Tares Cloud, use your own endpoint from the console’s Connect page and pass a read-scoped API key as a Bearer Authorization header. Codex, Cursor and other MCP clients connect with the same endpoint, and the agents page shows each one.

4. Verify the connection by asking your client: Use tares: what are you ingesting right now? It calls catalog_list and answers with your sources, triggers and projects.

5. Ask the real question in plain words, for example: Use tares: what happened to this host in the last hour, and why is its disk filling up? The agent reads the correlated timeline and answers from it. In the console, Reads lists each read as it happens, tagged client = mcp.

For the wider picture of how agents investigate incidents on Tares, start from AI SRE.

What you get

• An answer drawn from one read, not a chain of queries you have to write or paste.
• Metrics, logs, alerts and changes lined up in time, so the agent can point to what moved before the disk started to grow.
• No tool wiring per system. A new source you connect joins the same read once its labels match.
• A visible trail. Every read appears under Reads in the console.
• The option to write back. The agent can call record_finding to leave its conclusion on the entity, or create_trigger to be woken if it happens again.

When something else fits

• If no connected source carries the signal you need, such as the disk metric itself, connect that source first. The agent can only correlate what Tares ingests.
• If you want to explore without an external client, use Ask in the console, an in-app agent with the same read tools. Open it under Ask or with ⌘K.
• If you want the agent to act only inside one project, give it a project key. It reads that project and records findings in it, and nothing else.

Related