Tares
PYPI · TARES
Always-on AI agents: a software factory for Claude Code, or an AI SRE that watches your systems.
Available components
Last scanned (22 hours ago)
Scores higher than 57% of PyPI servers
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security43
- Malware scan not yet available for this package.Unverified
- Known CVEs were checked across the 48 of 59 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- Dependency health was assessed across the 48 of 59 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to glassflow/tares). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability61
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 8291 tokens (~125/item across 66 items; 66 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "desk_withdraw" implies "withdraw" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 66 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −17
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → partial ▼ security
- Dependency health: 0.99 → partial functional
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 1.55.0 → 1.55.1 functional
- 1 Nov 26 75
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/tares@1.55.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | glassflow/tares |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/glassflow/tares/.github/workflows/release.yml@refs/tags/v1.55.1 |
| Rekor log index | 3643956808 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:481364a80baf7198734ec3371cf130f8faaab566180814251dd84ce692bae2da |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 48 packages
| Packages resolved | 48 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Partial |
The dependency tree was only partially resolved, so these counts may be incomplete.
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
remember ~83
Write an observation back to Tares's agent-memory lane. It becomes a source like any other: joined into correlated reads, so what you learned this incident appears in the timeline next time the same key acts up. memory_type: observation | aggregation | decision.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | – |
| key | string | yes | – |
| memory_type | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
remember_for_project ~87
Keep one thing you learned about this project (for example "tests need the dev database running") in its memory, dated and signed; every session on the project reads it. A rule worth keeping for every project goes to the orchestrator instead (an FYI); only it adds to the shared memory.
| Name | Type | Req | Description |
|---|---|---|---|
| line | string | yes | – |
| project | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
review_brief ~131
Start every review here: the pull request as GitHub has it (it says STOP when the PR is merged or its head moved past `head`), the ticket and its working doc, the builder's checks compared with its recorded session (unmatched first: check those yourself), Codex's findings and the waivers to judge, earlier rounds and their open findings, assumptions and decisions, and what keeps coming back in this repo. Then review to your own bar.
| Name | Type | Req | Description |
|---|---|---|---|
| head | string | – | – |
| project | string | – | – |
| ticket | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
review_queue ~59
The pull requests waiting for review across every project, in the order to take them: those blocking their milestone first, then the longest waiting. Each says whether the builder's Codex layer is clean and whether an earlier verdict is for an older commit.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
set_crew_settings ~134
Save the crew's settings the person chose (only the ones given change). Only the person's own session or the orchestrator may. `idle_wake` true has the watch wake idle stations when they have work, instead of each ticking on its own. `pace` true slows the crew before the plan's limits are hit.
| Name | Type | Req | Description |
|---|---|---|---|
| autonomy | string | – | – |
| builders_max | – | – | – |
| challenger | – | – | – |
| claude_update | – | – | – |
| idle_wake | – | – | – |
| pace | – | – | – |
| prod_pattern | – | – | – |
| release_profile | – | – | – |
| releaser | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
set_session_flow ~114
Mark this Claude Code session as running a named flow, e.g. "challenger" (a second model challenges your plan and every commit; Tares keeps the whole exchange and writes the session summary). Pass an empty string to clear it. Call it when the user asks for the flow at the start of a session. This tool only acknowledges: the Tares plugin sees the call in the transcript and marks the session on both the laptop and Tares.
| Name | Type | Req | Description |
|---|---|---|---|
| flow | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
set_stage ~221
Move a ticket you hold: `stage` is doing (you started), review (its PR is up: pass `pr`, the pull request's URL), changes (the reviewer asked for changes), merged, or blocked (say why in `reason`). Only the releaser marks a ticket shipped. A ticket held by another station is refused; ask the orchestrator. For a ticket that lives in Linear or GitHub, also move it there (Linear's own tools, `gh` for GitHub). Name your branch factory/<ticket> (factory/T3) so Tares finds the pull request on its own too. Asking for review, pass the checks you ran as `checks` ([{command, result, commit, broke_test}, ...]) instead of one add_check call each; they are recorded before the stage moves.
| Name | Type | Req | Description |
|---|---|---|---|
| checks | – | – | – |
| pr | string | – | – |
| project | string | – | – |
| reason | string | – | – |
| stage | string | yes | – |
| ticket | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
source_fields ~100
Profile a source's real fields from recent events: every candidate field with its coverage, distinct count, and top values, plus which are already declared as labels/keys. Call this BEFORE choosing labels for a source — a label's `field` MUST be one of these exact field names (never invent one). The `labels` block echoes the source's current declared axes.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
stats ~107
Counts per value of the label `by` over the project's sources, the last `window` against the window before, largest change first. `where` {label: value} narrows the events counted, `sources` narrows the sources. Use it to see what moved before reading one entity.
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | yes | – |
| project | string | – | – |
| sources | – | – | – |
| top | integer | – | – |
| where | – | – | – |
| window | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
subscribe ~42
Register a webhook to be woken (pushed) when a trigger fires. Returns a subscription id.
| Name | Type | Req | Description |
|---|---|---|---|
| trigger | string | yes | – |
| url | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
test_source ~75
Dry-run a source config without creating it: poll connectors do one live poll and return a sample; push connectors return their ingest endpoint. Use before create_source to check the config works.
| Name | Type | Req | Description |
|---|---|---|---|
| config | object | yes | – |
| connector | string | yes | – |
| name | string | yes | – |
| poll | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_trigger ~152
Edit an EXISTING trigger in place: replace its sources, filters, key_field, condition, emit and cooldown, and move it to another `project` when given. Create new triggers with create_trigger(); this only updates one that already exists (renaming isn't supported, so keep `name` the same). `description` left out keeps the current one, "" clears it. See create_trigger for the shapes.
| Name | Type | Req | Description |
|---|---|---|---|
| condition | object | yes | – |
| cooldown | string | – | – |
| description | – | – | – |
| emit | – | – | – |
| filters | – | – | – |
| key_field | string | – | – |
| name | string | yes | – |
| project | string | – | – |
| sources | array | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
write_doc ~229
Write a markdown doc into the project, or replace one when `id` is given. `kind` is one of: `start` (the prompt a session that builds the project starts with: what to read first, which ticket to take, how to work), `spec` (what is built and why), `plan` (milestones and the order of work), `agents` (the AGENTS.md of the build: conventions, commands, how to test), `working` (the working doc of one ticket: context, steps, files likely touched, how to verify; link it with attach_working_doc), `note` (anything else). Working docs and every other doc stay in Tares; they never go to Linear or GitHub. A rule or fact that holds for every project goes in the shared docs with add_to_global instead. Returns the doc's id.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | – |
| id | string | – | – |
| kind | string | yes | – |
| project | string | – | – |
| title | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
write_milestone ~216
Write one of the project's milestones, or change it when one with this `name` exists (names are unique). Each milestone ships something a person can check: `goal` says what in one line, `checks` are its acceptance checks, [{"check": "<command or short manual step>", "expect": "<what it should show>"}], that the releaser runs when the milestone ships. `position` orders them (a new one goes last). To rename one, pass its current name or id as `id` and the new `name`. Give tickets a milestone with write_ticket(milestone=<name>). When the project's tickets live in Linear or GitHub, its milestones come from there (for GitHub, the milestones its issues sit in): add and rename them there and write only the goal and checks here.
| Name | Type | Req | Description |
|---|---|---|---|
| checks | – | – | – |
| goal | – | – | – |
| id | string | – | – |
| name | string | yes | – |
| position | – | – | – |
| project | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
write_repo_map ~233
Write the map of a GitHub repo (owner/name) that the builder and reviewer briefs serve: layout, entry points, how to install, build, test and lint, conventions, the files tickets touch most, known traps. One map per repo, shared by every project on it, at most 8,000 characters (about 2,000 tokens). `body` replaces the whole map, so start from the one in your brief and pass its `version` as `base` (leave it empty when the repo has no map). If someone wrote the map since, nothing is written and the answer is the map now: fold your change into it and write again. `note` says what changed and becomes a dated line in its history. Write it when the brief says the repo has none; update it when a merged PR changes the layout or the build, test or lint commands.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | – |
| body | string | yes | – |
| note | string | yes | – |
| project | string | – | – |
| repo | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
write_ticket ~277
Add a ticket to the project's list, or change one when `id` is given (its id or T<n>). Only for a project whose tickets live in Tares: when they live in Linear or GitHub, create and change them there (milestones and "blocks" or "blocked by" relations included; `gh` for GitHub) and Tares picks them up on its next sync. `status` is todo, in_progress, done or canceled; `position` orders the list (a new ticket goes to the end); `milestone` is the name of a milestone written with write_milestone ("" takes it out of its milestone); `depends_on` lists the tickets (T<n> or id) that must be done first ([] clears them); `repo` is the GitHub repo the ticket changes (owner/name), for a project that spans several repos ("" clears it; a Linear or GitHub ticket takes only this, and attach_working_doc). Returns the ticket with its label (T<n>).
| Name | Type | Req | Description |
|---|---|---|---|
| depends_on | – | – | – |
| id | string | – | – |
| milestone | – | – | – |
| position | – | – | – |
| project | string | – | – |
| repo | – | – | – |
| status | string | – | – |
| title | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
How do I install the Tares MCP server?
Tares runs locally as a PyPI package, launched with uvx tares. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · tares
claude mcp add ai-glassflow-tares -- uvx tares
What is the Tares MCP server?
Tares is an MCP server listed in the public MCP registry as ai.glassflow/tares. Always-on AI agents: a software factory for Claude Code, or an AI SRE that watches your systems. This page covers its PyPI package (tares).
Is the Tares MCP server safe to use?
Tares scores 59 out of 100 on VerifyMCP. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Tares MCP server expose?
Tares exposes 66 tools: read, create_trigger, update_trigger, subscribe, catalog_list, and 61 more. Their descriptions and schemas cost roughly 8,291 tokens of context every time the server is loaded.
Is the Tares MCP server still maintained?
Tares is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Tares MCP server under?
Tares declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.