Which integrations are available for this server?

Enables GitHub Copilot to query Azure Log Analytics workspaces using KQL for incident investigation, performance analysis, and cross-resource correlation.

How do I use Log Analytics MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Log Analytics MCP Server Show me errors from the last hour" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Log Analytics MCP Server

by BandaruDheeraj

Overview Schema Related Servers Score Discussions

Python

Hybrid

Log Analytics MCP Server

License: MIT Python 3.10+ MCP

A Model Context Protocol (MCP) server that enables AI agents to query Azure Log Analytics workspaces using KQL (Kusto Query Language). This bridges AI assistants like GitHub Copilot, Claude, and Azure SRE Agent with your observability data.

Supports both local (stdio) and remote (Streamable HTTP) deployment modes.

🎯 Use Cases

Private VNet Observability: Query logs from workspaces protected by Private Link—when public queries are blocked, deploy this server inside the VNet as a trusted query proxy
Incident Investigation: Query logs from VMs, containers, and Azure resources during incidents
Cross-Resource Correlation: Query multiple VMs/resources in a single natural language request
Performance Analysis: Analyze CPU, memory, disk metrics across your infrastructure

Related MCP server: Azure Resource Graph MCP Server

✨ Features

Tool	Description
`query_logs`	Execute any KQL query against Log Analytics
`list_tables`	Discover available tables in a workspace
`get_workspace_info`	Get data volume and usage statistics
`analyze_errors`	Pre-built error pattern analysis from Syslog
`check_vm_health`	VM health check (heartbeat, CPU, memory, errors)

📋 Prerequisites

Python 3.10+
Azure CLI logged in (az login)
Log Analytics Reader role on target workspace(s)

🚀 Quick Start

1. Clone and Install

git clone https://github.com/yourusername/log-analytics-mcp-server.git
cd log-analytics-mcp-server

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .\.venv\Scripts\Activate.ps1

# Install dependencies
pip install -r requirements.txt

2. Configure

# Set your Log Analytics workspace ID (the GUID from Azure Portal)
export LOG_ANALYTICS_WORKSPACE_ID="your-workspace-guid"

# Ensure you're logged into Azure
az login

3. Test

# Run the test script
python test_mcp.py

Expected output:

============================================================
LOG ANALYTICS MCP SERVER - VALIDATION TEST
============================================================

[1] MCP Server Info:
    Server name: log-analytics-mcp-server
    Tools registered: 5

[2] Testing list_tables()...
    ✅ SUCCESS - Retrieved table list
    Found 5 tables: ['Syslog', 'Perf', 'Heartbeat', ...]

[3] Testing query_logs()...
    ✅ SUCCESS - Query executed

============================================================
VALIDATION COMPLETE
============================================================

🔌 Integration

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

{
  "servers": {
    "log-analytics": {
      "type": "stdio",
      "command": "python",
      "args": ["-c", "from server import mcp; mcp.run(transport='stdio')"],
      "cwd": "/path/to/log-analytics-mcp-server",
      "env": {
        "LOG_ANALYTICS_WORKSPACE_ID": "your-workspace-guid"
      }
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "log-analytics": {
      "command": "python",
      "args": ["-c", "from server import mcp; mcp.run(transport='stdio')"],
      "cwd": "/path/to/log-analytics-mcp-server",
      "env": {
        "LOG_ANALYTICS_WORKSPACE_ID": "your-workspace-guid"
      }
    }
  }
}

Azure SRE Agent

Add to your agent's MCP configuration:

mcp_servers:
  - name: log-analytics
    command: python
    args: ["-c", "from server import mcp; mcp.run(transport='stdio')"]
    cwd: /path/to/log-analytics-mcp-server
    transport: stdio
    environment:
      LOG_ANALYTICS_WORKSPACE_ID: "your-workspace-guid"

📝 Example Usage

Once configured, you can ask your AI assistant:

"Show me errors from my Log Analytics workspace in the last hour"

"What VMs are sending heartbeats to my workspace?"

"Query Syslog for any critical errors from web-vm"

"Analyze the performance metrics for my database server"

Direct Python Usage

from server import query_logs, list_tables, check_vm_health

# List available tables
print(list_tables())

# Query for recent errors
result = query_logs(
    query="Syslog | where SeverityLevel == 'err' | take 10",
    timespan="PT1H"  # Last 1 hour
)
print(result)

# Check VM health
print(check_vm_health())

🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│                    AI Assistant                              │
│         (GitHub Copilot, Claude, SRE Agent)                 │
│                                                             │
│  "Show me errors from app-vm in the last hour"              │
└─────────────────────┬───────────────────────────────────────┘
                      │ MCP Protocol (JSON-RPC over STDIO)
                      ▼
┌─────────────────────────────────────────────────────────────┐
│              Log Analytics MCP Server                        │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Tools:                                              │   │
│  │  • query_logs        - Execute KQL queries           │   │
│  │  • list_tables       - Show available tables         │   │
│  │  • get_workspace_info - Workspace metadata           │   │
│  │  • analyze_errors    - Error pattern analysis        │   │
│  │  • check_vm_health   - VM health dashboard           │   │
│  └─────────────────────────────────────────────────────┘   │
│                           │                                 │
│                           │ azure-monitor-query SDK         │
│                           ▼                                 │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Azure Monitor Query Client                          │   │
│  │  (DefaultAzureCredential)                            │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────┬───────────────────────────────────────┘
                      │ Azure Monitor Query API
                      ▼
┌─────────────────────────────────────────────────────────────┐
│              Log Analytics Workspace                         │
│                                                             │
│  Tables: Syslog, Perf, Heartbeat, ContainerLog, Event, etc. │
│                                                             │
│  Data from: VMs, Containers, Azure resources                │
│  (including private VNet resources via Private Link)        │
└─────────────────────────────────────────────────────────────┘

🔐 Authentication

This server uses DefaultAzureCredential which tries these methods in order:

Environment variables (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET)
Azure CLI (az login)
Azure Developer CLI (azd auth login)
Managed Identity (when running in Azure)
Visual Studio Code credential
Azure PowerShell (Connect-AzAccount)

For local development, az login is the easiest option.

📊 Common KQL Queries

Find recent errors

Syslog
| where SeverityLevel in ('err', 'crit', 'alert', 'emerg')
| project TimeGenerated, Computer, Facility, SyslogMessage
| order by TimeGenerated desc
| take 20

Check VM heartbeats

Heartbeat
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| extend MinutesAgo = datetime_diff('minute', now(), LastHeartbeat)
| order by MinutesAgo desc

Performance analysis

Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| order by TimeGenerated desc

Container logs

ContainerLog
| where LogEntrySource == 'stderr'
| project TimeGenerated, ContainerID, LogEntry
| order by TimeGenerated desc
| take 50

🔧 Configuration Options

Environment Variable	Required	Description
`LOG_ANALYTICS_WORKSPACE_ID`	Yes	The GUID of your Log Analytics workspace
`MCP_API_KEY`	No*	API key for authentication (required for remote deployment)
`MCP_API_KEY_HEADER`	No	Custom header name for API key (default: `X-API-Key`)
`AZURE_TENANT_ID`	No	Azure AD tenant ID (for service principal auth)
`AZURE_CLIENT_ID`	No	Service principal client ID
`AZURE_CLIENT_SECRET`	No	Service principal secret

🌐 Remote Deployment (Azure Container Apps)

For production use with Azure SRE Agent or other remote MCP clients, deploy this server to Azure Container Apps.

Prerequisites

Azure CLI installed and logged in (az login)
Docker (for local testing only)
An Azure subscription

Step 1: Create Azure Resources

# Set variables
RESOURCE_GROUP="log-analytics-mcp-rg"
LOCATION="eastus2"
ACR_NAME="yourregistryname"  # Must be globally unique
CONTAINER_APP_NAME="log-analytics-mcp"
WORKSPACE_ID="your-log-analytics-workspace-guid"
API_KEY=$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)

# Create resource group
az group create --name $RESOURCE_GROUP --location $LOCATION

# Create container registry
az acr create --resource-group $RESOURCE_GROUP --name $ACR_NAME --sku Basic --admin-enabled true

# Create container apps environment
az containerapp env create \
  --name "${CONTAINER_APP_NAME}-env" \
  --resource-group $RESOURCE_GROUP \
  --location $LOCATION

Step 2: Build and Push Container Image

# Build image in ACR (from the log-analytics-mcp-server directory)
az acr build --registry $ACR_NAME --image log-analytics-mcp:v1 .

Step 3: Deploy Container App

# Get ACR credentials
ACR_PASSWORD=$(az acr credential show --name $ACR_NAME --query "passwords[0].value" -o tsv)

# Create container app with managed identity
az containerapp create \
  --name $CONTAINER_APP_NAME \
  --resource-group $RESOURCE_GROUP \
  --environment "${CONTAINER_APP_NAME}-env" \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:v1" \
  --target-port 8000 \
  --ingress external \
  --min-replicas 1 \
  --max-replicas 10 \
  --cpu 0.5 \
  --memory 1.0Gi \
  --registry-server "${ACR_NAME}.azurecr.io" \
  --registry-username $ACR_NAME \
  --registry-password "$ACR_PASSWORD" \
  --env-vars \
    "LOG_ANALYTICS_WORKSPACE_ID=$WORKSPACE_ID" \
    "MCP_API_KEY=$API_KEY" \
  --system-assigned

# Get the container app URL
FQDN=$(az containerapp show --name $CONTAINER_APP_NAME --resource-group $RESOURCE_GROUP --query "properties.configuration.ingress.fqdn" -o tsv)
echo "MCP Server URL: https://${FQDN}/mcp/"
echo "Health Check: https://${FQDN}/health"
echo "API Key: $API_KEY"

Step 4: Grant Log Analytics Access

# Get managed identity principal ID
PRINCIPAL_ID=$(az containerapp show --name $CONTAINER_APP_NAME --resource-group $RESOURCE_GROUP --query "identity.principalId" -o tsv)

# Grant Log Analytics Reader role on the workspace
# Replace with your Log Analytics workspace resource ID
LA_RESOURCE_ID="/subscriptions/YOUR_SUB/resourceGroups/YOUR_RG/providers/Microsoft.OperationalInsights/workspaces/YOUR_WORKSPACE"

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Log Analytics Reader" \
  --scope $LA_RESOURCE_ID

Step 5: Test the Deployment

# Test health endpoint
curl "https://${FQDN}/health"

# Test MCP initialization
curl -X POST "https://${FQDN}/mcp/" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

# List available tools
curl -X POST "https://${FQDN}/mcp/" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

Remote Integration Examples

Azure SRE Agent

Configure in the SRE Agent portal:

Setting	Value
Name	`LogAnalyticsMCP`
Transport	`Streamable HTTP`
URL	`https://your-app.azurecontainerapps.io/mcp/`
Authentication	`API Key`
Header Name	`X-API-Key`
API Key	Your generated API key

Remote MCP Client Configuration

For any MCP client that supports HTTP transport:

{
  "servers": {
    "log-analytics": {
      "type": "http",
      "url": "https://your-app.azurecontainerapps.io/mcp/",
      "headers": {
        "X-API-Key": "your-api-key"
      }
    }
  }
}

Updating the Deployment

# Build new version
az acr build --registry $ACR_NAME --image log-analytics-mcp:v2 .

# Update container app
az containerapp update \
  --name $CONTAINER_APP_NAME \
  --resource-group $RESOURCE_GROUP \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:v2"

🔒 VNet Deployment (Private Link Scenarios)

When your Log Analytics workspace is protected by Private Link with publicNetworkAccessForQuery: Disabled, external queries are blocked. Deploy this MCP server inside the VNet to act as a trusted query proxy.

Why This Matters

External Query → Log Analytics  ❌ BLOCKED by Private Link
VNet MCP → Log Analytics        ✅ ALLOWED via Private Endpoint  
SRE Agent → VNet MCP            ✅ HTTPS (Streamable HTTP)

VNet-Integrated Deployment

# Create VNet-integrated Container Apps environment
az containerapp env create \
  --name vnet-test-env \
  --resource-group $RESOURCE_GROUP \
  --location eastus \
  --infrastructure-subnet-resource-id "/subscriptions/.../subnets/infrastructure"

# Create ACR (VNet environments can't pull from public registries)
az acr create --resource-group $RESOURCE_GROUP --name $ACR_NAME --sku Basic

# Build and push image to ACR
az acr build --registry $ACR_NAME --image log-analytics-mcp:latest .

# Deploy with Managed Identity
az containerapp create \
  --name log-analytics-mcp-vnet \
  --resource-group $RESOURCE_GROUP \
  --environment vnet-test-env \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:latest" \
  --target-port 8000 \
  --ingress external \
  --env-vars "LOG_ANALYTICS_WORKSPACE_ID=$WORKSPACE_ID" "MCP_API_KEY=$API_KEY" \
  --system-assigned \
  --registry-server "${ACR_NAME}.azurecr.io"

# Grant Log Analytics Reader role to Container App's Managed Identity
PRINCIPAL_ID=$(az containerapp show --name log-analytics-mcp-vnet --resource-group $RESOURCE_GROUP --query "identity.principalId" -o tsv)
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Log Analytics Reader" \
  --scope "/subscriptions/.../workspaces/$WORKSPACE_NAME"

Testing Private Link Blocking

# Test from OUTSIDE VNet (should fail if Private Link is properly configured)
curl -X POST "https://log-analytics-mcp-outside.azurecontainerapps.io/mcp/" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-API-Key: $API_KEY" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_tables"},"id":1}'

# Result: InsufficientAccessError - blocked by Private Link ❌

# Test from INSIDE VNet (should succeed)
curl -X POST "https://log-analytics-mcp-vnet.azurecontainerapps.io/mcp/" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-API-Key: $API_KEY" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_tables"},"id":1}'

# Result: SUCCESS ✅ - tables returned

Private Link Configuration

For complete query blocking, configure:

# 1. Create AMPLS with Private Only mode
az monitor private-link-scope create --name my-ampls --resource-group $RESOURCE_GROUP
az monitor private-link-scope update --name my-ampls --resource-group $RESOURCE_GROUP \
  --query-access PrivateOnly

# 2. Disable public query access on workspace
az monitor log-analytics workspace update \
  --resource-group $RESOURCE_GROUP \
  --workspace-name $WORKSPACE_NAME \
  --set properties.publicNetworkAccessForQuery=Disabled

🧪 Development

Run tests

python test_mcp.py

Run with SSE transport (for web integrations)

python -c "from server import mcp; mcp.run(transport='sse')"
# Server starts on http://localhost:8000/sse

Test with MCP Inspector

npx @modelcontextprotocol/inspector python -c "from server import mcp; mcp.run(transport='stdio')"

📄 License

MIT License - see LICENSE for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly
Lightport: Open-Sourcing Glama's AI Gateway
By punkpeye on April 27, 2026.
OpenAI
open source

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/BandaruDheeraj/log-analytics-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

Log Analytics MCP Server

🎯 Use Cases

✨ Features

📋 Prerequisites

🚀 Quick Start

1. Clone and Install

2. Configure

3. Test

🔌 Integration

VS Code / GitHub Copilot

Claude Desktop

Azure SRE Agent

📝 Example Usage

Direct Python Usage

🏗️ Architecture

🔐 Authentication

📊 Common KQL Queries

Find recent errors

Check VM heartbeats

Performance analysis

Container logs

🔧 Configuration Options

🌐 Remote Deployment (Azure Container Apps)

Prerequisites

Step 1: Create Azure Resources

Step 2: Build and Push Container Image

Step 3: Deploy Container App

Step 4: Grant Log Analytics Access

Step 5: Test the Deployment

Remote Integration Examples

Azure SRE Agent

Remote MCP Client Configuration

Updating the Deployment

🔒 VNet Deployment (Private Link Scenarios)

Why This Matters

VNet-Integrated Deployment

Testing Private Link Blocking

Private Link Configuration

🧪 Development

Run tests

Run with SSE transport (for web integrations)

Test with MCP Inspector

📄 License

🤝 Contributing

📚 Related Resources

Maintenance

Resources

Looking for Admin?

Latest Blog Posts

MCP directory API