How do I let my own Claude Code session investigate failed deploys with a project key?

Tares lets your own Claude Code session investigate failed deploys through a project key that you create under Settings, Keys and pass to claude mcp add as an Authorization Bearer header. The key reads that one project only and records findings there under the name you gave it. Claude Code then uses the project’s sources, skills and earlier findings to work out why a deploy failed.

How it works

A project key ties one outside agent to one Tares project. Once Claude Code connects with it, the project is implied, so the tools need no project argument.

• The key reads the project it belongs to and records findings in it. Any other call answers 403.
• The name you give the key is stamped on every finding it records, so you can tell your Claude Code session from the Tares agents.
• Claude Code reaches Tares through the MCP endpoint that tares mcp serves at http://127.0.0.1:8788/mcp.
• When you ask about a failed deploy, it loads a matching skill with list_skills and get_skill. It calls stats to see which values moved and read for the entity’s timeline across the project’s sources. list_findings and project_timeline show what the Tares agents already concluded. It ends with record_finding(entity, finding, verdict).

The instance must run with auth on so that keys are checked. This means starting it with auth or setting TARES_AUTH_TOKEN. On an open instance there are no keys. Skip the key step there and name the project in your prompts instead.

Set it up

You need a running Tares instance with a project that has sources and a trigger, with auth on, and the MCP endpoint running. The AI SRE demo is a good project to try this on.

1. Start the MCP endpoint in its own terminal:

   tares mcp

2. Open the project in Tares, go to Settings, Keys, and choose New key.

3. Name the key after the agent that will hold it, for example claude-code. Copy the secret right away, because it is shown once.

4. Connect Claude Code with the key as a Bearer header:

   claude mcp add --transport http tares http://localhost:8788/mcp \
     --header "Authorization: Bearer <project key>"

   If you run over stdio instead, start tares-mcp with TARES_AUTH_TOKEN set to the project key in its environment.

5. Check the connection from a Claude Code session:

   Use tares: which project can you work in?

   It calls list_projects and names the one project your key belongs to.

6. Ask about the deploys:

   Use tares: which deploys failed in the last hour, and why? Check the project’s skills first, and record what you conclude.

The answer is only as good as the data in the project. Your deploy events need to reach one of its sources first. For the full walkthrough, see Connect an outside agent to a project.

What you get

• A Claude Code session that investigates failed deploys with the project’s own sources, skills and history, and cannot touch any other project.
• A finding recorded under your key’s name. It appears as a card under What the agents found on the project’s Overview.
• A separate thread in Advanced setup’s Activity, marked as recorded from outside Tares.
• An entry on the entity’s timeline in Explore. The next Tares agent that reads that entity starts from your conclusion instead of repeating the work.
• A clean way to cut access. Revoke the key under Settings, Keys and the session loses access to the project. Revoking also removes the key’s subscriptions.

When something else fits

• If you want an agent that runs on its own, such as a service with a webhook, have it call join_project(url). Tares then sends it every trigger firing in the project, including triggers added later.
• If your client is Codex, Cursor or your own agent, the same key works. Only the connect command differs, and Connect an outside agent to a project points you to the per-client setup.
• If your instance has no auth, there are no keys to create. Name the project in your prompts instead.

Related