Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Tares

PYPI · TARES

Always-on AI agents: a software factory for Claude Code, or an AI SRE that watches your systems.

Available components

59 Trust /100

Last scanned (22 hours ago)

Scores higher than 57% of PyPI servers

Category AI and Machine Learning

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security43
  • Malware scan not yet available for this package.Unverified
  • Known CVEs were checked across the 48 of 59 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • Dependency health was assessed across the 48 of 59 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to glassflow/tares). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability61
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 8291 tokens (~125/item across 66 items; 66 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
  • Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "desk_withdraw" implies "withdraw" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 66 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 −17
    • Malware scan: pass → unverified ▼ security
    • Known CVEs: pass → partial ▼ security
    • Dependency health: 0.99 → partial functional
  • 3 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 2 Nov 26 −14
    • Malware scan: pass → unverified ▼ security
    • Package version: 1.55.0 → 1.55.1 functional
  • 1 Nov 26 75

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed pypi/tares@1.55.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo glassflow/tares
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/glassflow/tares/.github/workflows/release.yml@refs/tags/v1.55.1
Rekor log index 3643956808
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:481364a80baf7198734ec3371cf130f8faaab566180814251dd84ce692bae2da

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 48 packages
Packages resolved 48
Stale 1
No linked repository 1
Tree resolution Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

Background: SBOMs and build attestations, explained →

MCP tools · 66 exposed · ~8,291 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
remember ~83

Write an observation back to Tares's agent-memory lane. It becomes a source like any other: joined into correlated reads, so what you learned this incident appears in the timeline next time the same key acts up. memory_type: observation | aggregation | decision.

NameTypeReqDescription
contentstringyes–
keystringyes–
memory_typestring––
NameTypeReqDescription
resultstringyes–

No examples provided.

remember_for_project ~87

Keep one thing you learned about this project (for example "tests need the dev database running") in its memory, dated and signed; every session on the project reads it. A rule worth keeping for every project goes to the orchestrator instead (an FYI); only it adds to the shared memory.

NameTypeReqDescription
linestringyes–
projectstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

review_brief ~131

Start every review here: the pull request as GitHub has it (it says STOP when the PR is merged or its head moved past `head`), the ticket and its working doc, the builder's checks compared with its recorded session (unmatched first: check those yourself), Codex's findings and the waivers to judge, earlier rounds and their open findings, assumptions and decisions, and what keeps coming back in this repo. Then review to your own bar.

NameTypeReqDescription
headstring––
projectstring––
ticketstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

review_queue ~59

The pull requests waiting for review across every project, in the order to take them: those blocking their milestone first, then the longest waiting. Each says whether the builder's Codex layer is clean and whether an earlier verdict is for an older commit.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

set_crew_settings ~134

Save the crew's settings the person chose (only the ones given change). Only the person's own session or the orchestrator may. `idle_wake` true has the watch wake idle stations when they have work, instead of each ticking on its own. `pace` true slows the crew before the plan's limits are hit.

NameTypeReqDescription
autonomystring––
builders_max–––
challenger–––
claude_update–––
idle_wake–––
pace–––
prod_pattern–––
release_profile–––
releaser–––
NameTypeReqDescription
resultstringyes–

No examples provided.

set_session_flow ~114

Mark this Claude Code session as running a named flow, e.g. "challenger" (a second model challenges your plan and every commit; Tares keeps the whole exchange and writes the session summary). Pass an empty string to clear it. Call it when the user asks for the flow at the start of a session. This tool only acknowledges: the Tares plugin sees the call in the transcript and marks the session on both the laptop and Tares.

NameTypeReqDescription
flowstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

set_stage ~221

Move a ticket you hold: `stage` is doing (you started), review (its PR is up: pass `pr`, the pull request's URL), changes (the reviewer asked for changes), merged, or blocked (say why in `reason`). Only the releaser marks a ticket shipped. A ticket held by another station is refused; ask the orchestrator. For a ticket that lives in Linear or GitHub, also move it there (Linear's own tools, `gh` for GitHub). Name your branch factory/<ticket> (factory/T3) so Tares finds the pull request on its own too. Asking for review, pass the checks you ran as `checks` ([{command, result, commit, broke_test}, ...]) instead of one add_check call each; they are recorded before the stage moves.

NameTypeReqDescription
checks–––
prstring––
projectstring––
reasonstring––
stagestringyes–
ticketstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

source_fields ~100

Profile a source's real fields from recent events: every candidate field with its coverage, distinct count, and top values, plus which are already declared as labels/keys. Call this BEFORE choosing labels for a source — a label's `field` MUST be one of these exact field names (never invent one). The `labels` block echoes the source's current declared axes.

NameTypeReqDescription
limitinteger––
namestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

stats ~107

Counts per value of the label `by` over the project's sources, the last `window` against the window before, largest change first. `where` {label: value} narrows the events counted, `sources` narrows the sources. Use it to see what moved before reading one entity.

NameTypeReqDescription
bystringyes–
projectstring––
sources–––
topinteger––
where–––
windowstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

subscribe ~42

Register a webhook to be woken (pushed) when a trigger fires. Returns a subscription id.

NameTypeReqDescription
triggerstringyes–
urlstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

test_source ~75

Dry-run a source config without creating it: poll connectors do one live poll and return a sample; push connectors return their ingest endpoint. Use before create_source to check the config works.

NameTypeReqDescription
configobjectyes–
connectorstringyes–
namestringyes–
pollstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

update_trigger ~152

Edit an EXISTING trigger in place: replace its sources, filters, key_field, condition, emit and cooldown, and move it to another `project` when given. Create new triggers with create_trigger(); this only updates one that already exists (renaming isn't supported, so keep `name` the same). `description` left out keeps the current one, "" clears it. See create_trigger for the shapes.

NameTypeReqDescription
conditionobjectyes–
cooldownstring––
description–––
emit–––
filters–––
key_fieldstring––
namestringyes–
projectstring––
sourcesarrayyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

write_doc ~229

Write a markdown doc into the project, or replace one when `id` is given. `kind` is one of: `start` (the prompt a session that builds the project starts with: what to read first, which ticket to take, how to work), `spec` (what is built and why), `plan` (milestones and the order of work), `agents` (the AGENTS.md of the build: conventions, commands, how to test), `working` (the working doc of one ticket: context, steps, files likely touched, how to verify; link it with attach_working_doc), `note` (anything else). Working docs and every other doc stay in Tares; they never go to Linear or GitHub. A rule or fact that holds for every project goes in the shared docs with add_to_global instead. Returns the doc's id.

NameTypeReqDescription
bodystringyes–
idstring––
kindstringyes–
projectstring––
titlestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

write_milestone ~216

Write one of the project's milestones, or change it when one with this `name` exists (names are unique). Each milestone ships something a person can check: `goal` says what in one line, `checks` are its acceptance checks, [{"check": "<command or short manual step>", "expect": "<what it should show>"}], that the releaser runs when the milestone ships. `position` orders them (a new one goes last). To rename one, pass its current name or id as `id` and the new `name`. Give tickets a milestone with write_ticket(milestone=<name>). When the project's tickets live in Linear or GitHub, its milestones come from there (for GitHub, the milestones its issues sit in): add and rename them there and write only the goal and checks here.

NameTypeReqDescription
checks–––
goal–––
idstring––
namestringyes–
position–––
projectstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

write_repo_map ~233

Write the map of a GitHub repo (owner/name) that the builder and reviewer briefs serve: layout, entry points, how to install, build, test and lint, conventions, the files tickets touch most, known traps. One map per repo, shared by every project on it, at most 8,000 characters (about 2,000 tokens). `body` replaces the whole map, so start from the one in your brief and pass its `version` as `base` (leave it empty when the repo has no map). If someone wrote the map since, nothing is written and the answer is the map now: fold your change into it and write again. `note` says what changed and becomes a dated line in its history. Write it when the brief says the repo has none; update it when a merged PR changes the layout or the build, test or lint commands.

NameTypeReqDescription
basestring––
bodystringyes–
notestringyes–
projectstring––
repostringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

write_ticket ~277

Add a ticket to the project's list, or change one when `id` is given (its id or T<n>). Only for a project whose tickets live in Tares: when they live in Linear or GitHub, create and change them there (milestones and "blocks" or "blocked by" relations included; `gh` for GitHub) and Tares picks them up on its next sync. `status` is todo, in_progress, done or canceled; `position` orders the list (a new ticket goes to the end); `milestone` is the name of a milestone written with write_milestone ("" takes it out of its milestone); `depends_on` lists the tickets (T<n> or id) that must be done first ([] clears them); `repo` is the GitHub repo the ticket changes (owner/name), for a project that spans several repos ("" clears it; a Linear or GitHub ticket takes only this, and attach_working_doc). Returns the ticket with its label (T<n>).

NameTypeReqDescription
depends_on–––
idstring––
milestone–––
position–––
projectstring––
repo–––
statusstring––
titlestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

Install

How do I install the Tares MCP server?

Tares runs locally as a PyPI package, launched with uvx tares. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · tares

# add to Claude Code
claude mcp add ai-glassflow-tares -- uvx tares
Common questions

What is the Tares MCP server?

Tares is an MCP server listed in the public MCP registry as ai.glassflow/tares. Always-on AI agents: a software factory for Claude Code, or an AI SRE that watches your systems. This page covers its PyPI package (tares).

Is the Tares MCP server safe to use?

Tares scores 59 out of 100 on VerifyMCP. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Tares MCP server expose?

Tares exposes 66 tools: read, create_trigger, update_trigger, subscribe, catalog_list, and 61 more. Their descriptions and schemas cost roughly 8,291 tokens of context every time the server is loaded.

Is the Tares MCP server still maintained?

Tares is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Tares MCP server under?

Tares declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.