Log Analyzer MCP
Enables parsing and analysis of Apache web server logs to identify request patterns and troubleshoot errors.
Provides tools to analyze Docker container logs, including support for timestamp extraction and log stream identification.
Facilitates debugging in containerized environments by parsing and analyzing Kubernetes-formatted log files.
Enables parsing and analysis of NGINX web server logs to identify request patterns and troubleshoot errors.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Log Analyzer MCPFind and group the most frequent errors in /var/log/app.log"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Log Analyzer MCP
🔍 Stop copy-pasting logs into AI. Let Claude read them directly.
An MCP server for AI-powered log analysis. Parse, search, and debug log files across 9+ formats — right from Claude Code.
📊 At a Glance
14 MCP tools | 9+ log formats |
280 tests | 81%+ coverage |
Related MCP server: Log Analyzer MCP
🎬 Demo

Analyzing logs with 14 specialized tools
🤔 Why?
Without log-analyzer-mcp | With log-analyzer-mcp |
Copy-paste chunks of logs | Point Claude at the file |
Lose context between pastes | Full file access |
Manual format parsing | Auto-detection |
Miss related errors | Smart correlation |
✨ Features
Auto-Detection — Identifies format from 9+ common log types
Smart Search — Pattern matching with context, regex, and time filtering
Error Extraction — Groups similar errors, captures stack traces
Natural Language — Ask questions like "what errors happened today?"
Sensitive Data Scan — Detect PII, credentials, and secrets
Multi-File Analysis — Correlate events across distributed systems
Streaming — Handles 1GB+ files without memory issues
🚀 Quick Start
# Install (adds to Claude Code automatically)
uvx codesdevs-log-analyzer installThen in Claude Code:
Analyze /var/log/app.log and tell me what's causing the errors📦 Installation
One-liner (Recommended)
uvx codesdevs-log-analyzer installManual
# pip
pip install codesdevs-log-analyzer
# uv
uv tool install codesdevs-log-analyzerAdd to ~/.claude/settings.json:
{
"mcpServers": {
"log-analyzer": {
"command": "uvx",
"args": ["codesdevs-log-analyzer"]
}
}
}📋 Supported Formats
Format | Example |
Syslog |
|
Apache/Nginx |
|
JSON Lines |
|
Docker |
|
Python |
|
Java/Log4j |
|
Kubernetes |
|
Generic | Any line with recognizable timestamp |
⚡ Performance
Metric | Value |
100MB log file | < 10 seconds |
Memory footprint | Streaming (no full load) |
Max tested size | 1GB+ |
Format detection | < 100ms |
🛠️ Available Tools
Tool | Description |
| Detect format and extract metadata |
| Search with context lines |
| Extract and group errors |
| Generate debugging summary |
| Find related events |
| Monitor for new entries |
| Natural language queries |
| Detect PII/credentials |
+ 6 more |
💡 Examples
Find errors:
Extract all errors from /var/log/app.log, group similar onesSearch with context:
Search for "timeout" in app.log with 5 lines of contextCorrelate events:
What happened 60 seconds before each OutOfMemoryError?Scan for secrets:
Check /var/log/app.log for accidentally logged credentials🔧 Development
git clone https://github.com/Fato07/log-analyzer-mcp
cd log-analyzer-mcp
uv sync
uv run pytest -v --cov📈 Star History
📄 License
MIT License - see LICENSE for details.
Available Tools
14 toolslog_analyzer_askARead-onlyIdempotent
Answer questions about log files using AI-assisted analysis.
Translates natural language questions into appropriate log analysis
operations and provides intelligent, contextual answers.
Example questions:
- "Why did the database connection fail?"
- "How many errors occurred in the last hour?"
- "What happened before the server crashed?"
- "Show me all authentication failures"
- "When did the first timeout occur?"
Args:
file_path: Path to the log file to analyze
question: Natural language question about the logs
max_results: Maximum supporting entries to include (10-200, default: 50)
response_format: Output format - 'markdown' or 'json'
Returns:
Natural language answer with supporting log entries and suggestions.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| question | Yes | ||
| max_results | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and idempotentHint=true, and the description adds context by stating it provides 'intelligent, contextual answers' with 'supporting log entries and suggestions'. It also specifies parameter constraints like max_results range (10-200) and output format options, which are not in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a brief introductory paragraph, a list of example questions, and an Args section. It is appropriately sized for the tool's complexity, though the example list could be slightly trimmed. No unnecessary sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (AI-assisted log analysis), the description covers purpose, usage, parameter semantics, and output format. Since an output schema exists, the description does not need to detail return values. It is complete for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% description coverage, but the description's Args section provides meaningful explanations for all four parameters: file_path, question, max_results (with range and default), and response_format (with enumeration). This adds significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it answers questions about log files using AI-assisted analysis, with concrete examples that distinguish it from sibling tools like log_analyzer_search or log_analyzer_correlate. The verb 'ask' and resource 'log files' are specific and differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a list of example questions illustrating use cases, and implies it is for natural language queries rather than structured searches. However, it does not explicitly state when not to use or mention alternative tools for specific scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_correlateARead-onlyIdempotent
Correlate events around anchor points in a log file.
Args:
file_path: Path to the log file
anchor_pattern: Pattern to anchor correlation around (regex)
window_seconds: Time window in seconds around anchor (1-3600, default: 60)
max_anchors: Maximum anchor points to analyze (1-50, default: 10)
response_format: Output format - 'markdown' or 'json'
Returns:
Correlated events around each anchor point, showing what happened
before and after the anchor event.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| anchor_pattern | Yes | ||
| window_seconds | No | ||
| max_anchors | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, non-destructive, and idempotent behavior. The description adds valuable context that the tool returns correlated events with before/after information and specifies constraints on window_seconds and max_anchors, which enhances transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections, front-loading the core functionality. While detailed, it could be slightly more concise, but it earns its length by providing necessary constraints and output details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters with ranges, defaults, and constraints) and the presence of an output schema, the description covers everything needed: purpose, all parameters with semantics, and return format. Sibling tools are diverse, and this description fully characterizes the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining each parameter: anchor_pattern is a regex, window_seconds has a range and default, max_anchors has a range and default, and response_format accepts markdown or json. This adds significant meaning beyond the schema's titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool correlates events around anchor points in a log file, which is a specific verb-resource combination. Among sibling tools focused on log analysis, 'correlate' stands out as distinct from search, summarize, or scan, making it easily distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for correlation but does not explicitly state when to use this tool over alternatives like log_analyzer_search or log_analyzer_summarize. No when-not-to-use or prerequisites are provided, leaving the agent to infer context from the purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_diffARead-onlyIdempotent
Compare log files or time periods within a log file.
Args:
file_path_a: First log file path
file_path_b: Second log file path (optional - for comparing two files)
time_range_a_start: Start time for first period (ISO format, for time comparison)
time_range_a_end: End time for first period (ISO format)
time_range_b_start: Start time for second period (ISO format)
time_range_b_end: End time for second period (ISO format)
response_format: Output format - 'markdown' or 'json'
Returns:
Comparison showing new errors, resolved errors, and volume changes.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path_a | Yes | ||
| file_path_b | No | ||
| time_range_a_start | No | ||
| time_range_a_end | No | ||
| time_range_b_start | No | ||
| time_range_b_end | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false. Description adds value by detailing return content (new errors, resolved errors, volume changes). No contradictions. Could mention idempotency implications but not required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with Args and Returns sections. Each parameter gets a one-line explanation. Slightly verbose due to listing all parameters, but necessary given no schema descriptions. Front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Describes two comparison modes (file vs time) but does not clarify mutual exclusivity: whether file_path_b and time_range_* should be used together or separately. The schema allows both, but description omits guidance. Output schema exists but return description is brief.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description fully compensates by explaining each parameter's purpose, including ISO format for time ranges, optionality of file_path_b, and the response_format options. Critical for correct usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'compare' and resource 'log files or time periods within a log file'. Distinguishes from siblings by focusing on diff/comparison, which is unique among the listed siblings (ask, search, summarize, etc.).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool over siblings like log_analyzer_search or log_analyzer_summarize. Does not mention when-not to use or provide alternative suggestions. The two comparison modes (file vs time) are described but not contrasted with other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_extract_errorsARead-onlyIdempotent
Extract all errors and exceptions from a log file with stack traces.
Args:
file_path: Path to the log file
include_warnings: Include WARN level entries (default: False)
group_similar: Group similar error messages (default: True)
max_errors: Maximum errors to return (1-500, default: 100)
response_format: Output format - 'markdown' or 'json'
Returns:
Extracted errors grouped by similarity with occurrence counts,
timestamps, and sample stack traces.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| include_warnings | No | ||
| group_similar | No | ||
| max_errors | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and idempotentHint=true. The description adds useful behavioral details: grouping similar errors, returning counts/timestamps/samples. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise docstring-style description with args and returns sections. No wasted words; every sentence provides necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, 0% schema coverage, and an output schema exists, the description fully covers behavior and return details (grouped errors with counts, timestamps, samples). Complete enough for agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains each parameter: file_path path, include_warnings default and meaning, group_similar behavior, max_errors range, and response_format options. Adds significant value beyond schema titles and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Extract all errors and exceptions from a log file with stack traces,' which is a specific verb and resource. It distinguishes from sibling tools like log_analyzer_search and log_analyzer_parse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives or provide exclusions. Usage is implied by the purpose but not guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_multiARead-onlyIdempotent
Analyze multiple log files together for cross-file debugging.
Supports three operations:
- merge: Interleave entries by timestamp (like 'sort -m')
- correlate: Find events happening across files within time window
- compare: Diff error patterns between files
Args:
file_paths: List of log file paths to analyze (2-10 files)
operation: Analysis operation - 'merge', 'correlate', or 'compare' (default: 'merge')
time_window: Time window in seconds for correlation (1-3600, default: 60)
max_entries: Maximum entries to return (100-5000, default: 1000)
response_format: Output format - 'markdown' or 'json'
Returns:
Combined analysis results based on the selected operation.
| Name | Required | Description | Default |
|---|---|---|---|
| file_paths | Yes | ||
| operation | No | merge | |
| time_window | No | ||
| max_entries | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare safety, but description adds operational details (operations, parameter constraints, output format options) that go beyond annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise and well-organized: intro, bullet list of operations, Args table, Returns. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Coverage is strong for parameters and operations; output schema exists. Lacks prerequisites like file format or access permissions, but minimal impact given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has no descriptions (0% coverage), but the description provides clear semantics for all parameters including constraints (e.g., 2-10 files, 1-3600 seconds), defaults, and options.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Analyze multiple log files together for cross-file debugging' and details three specific operations, making the purpose explicit and distinct from single-file siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Lists operations but does not explain when to use this tool versus sibling tools like 'log_analyzer_correlate' or 'log_analyzer_diff'. Some guidance on context but lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_parseARead-onlyIdempotent
Parse and analyze a log file, detecting its format and extracting metadata.
Args:
file_path: Path to the log file to analyze
format_hint: Force specific format (syslog, apache_access, apache_error, jsonl,
docker, python, java, kubernetes, generic) or None for auto-detect
max_lines: Maximum lines to parse (100-100000, default 10000)
response_format: Output format - 'markdown' or 'json'
Returns:
Analysis results including detected format, time range, level distribution,
and sample entries.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| format_hint | No | ||
| max_lines | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only, idempotent behavior. Description adds what the tool returns (detected format, time range, level distribution, sample entries), providing good behavioral context. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Structured as a docstring with overview and parameter list. Front-loaded with purpose. Slightly verbose but efficient for the information needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main functionality and parameters. Output schema exists so return details are sufficient. Missing error conditions or file prerequisites, but overall comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully explains each parameter: file_path, format_hint (with list of values), max_lines (with range), response_format. This compensates entirely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it parses and analyzes log files, detecting format and extracting metadata. This separates it from sibling tools like search, summarize, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for initial log parsing but lacks explicit guidance on when to use alternatives or when not to use. Sibling tools provide context but no direct exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_scan_sensitiveARead-onlyIdempotent
Detect sensitive data in logs (PII, credentials, API keys).
Scans log files for potentially sensitive information including:
- Email addresses
- Credit card numbers (Visa, MasterCard, Amex)
- API keys and tokens (AWS, GitHub, Slack, generic)
- Passwords in URLs or config
- Social Security Numbers (SSN)
- JWT and Bearer tokens
- Database connection strings
- Private key markers
- Phone numbers
- IP addresses (optional)
Args:
file_path: Path to the log file to scan
redact: Redact sensitive data in output (default: False)
categories: Filter to specific categories. Options:
email, credit_card, api_key, token, password,
ssn, ip_address, phone, connection_string, private_key
include_ips: Include IP address detection (default: False)
max_matches: Maximum matches to return (1-500, default: 100)
max_lines: Maximum lines to scan (1-1000000, default: 100000)
response_format: Output format - 'markdown' or 'json'
Returns:
Sensitive data scan results with matches and statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| redact | No | ||
| categories | No | ||
| include_ips | No | ||
| max_matches | No | ||
| max_lines | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint true and destructiveHint false, indicating no side effects. The description reinforces this by stating it 'scans log files' and 'returns results and statistics.' It adds specifics like optional redaction and IP detection, providing behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by a structured list of arguments and return description. Every sentence adds value, though it is slightly lengthy. It earns a 4 because it balances completeness with readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, a required file_path, and no nested objects, the description covers all parameters, their options, and the return value. An output schema exists but is not provided; the description still states that returns contain matches and statistics, which together with the schema provides complete information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates fully by explaining each parameter in detail: file_path, redact, categories (with options list), include_ips, max_matches (range 1-500), max_lines (range 1-1000000), response_format. This adds significant meaning beyond the schema's type and default values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb-object pair 'Detect sensitive data in logs' and enumerates specific categories (PII, credentials, API keys). It distinguishes this tool from siblings like log_analyzer_search or log_analyzer_extract_errors by focusing exclusively on sensitive data detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description details when to use the tool via its parameter descriptions (e.g., categories filter, max_matches), but does not explicitly contrast it with sibling tools or state when not to use it. However, the context signals that no other sibling covers sensitive data scanning, so the use case is well implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_searchARead-onlyIdempotent
Search for patterns in a log file with context lines.
Args:
file_path: Path to the log file to search
pattern: Search pattern (regex or plain text)
is_regex: Treat pattern as regex (default: False, plain text)
case_sensitive: Case-sensitive search (default: False)
context_lines: Lines of context before/after match (0-10, default: 3)
max_matches: Maximum matches to return (1-200, default: 50)
level_filter: Filter by log level (ERROR, WARN, INFO, DEBUG)
response_format: Output format - 'markdown' or 'json'
Returns:
Search results with matches and surrounding context.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| pattern | Yes | ||
| is_regex | No | ||
| case_sensitive | No | ||
| context_lines | No | ||
| max_matches | No | ||
| level_filter | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false. The description merely restates the search action without adding behavioral details like file system access, performance implications, or response handling. It adds minimal value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening sentence, an Args list, and a Returns section. It is concise for the number of parameters, though some details (like default values) could be inferred from the schema. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (context signal), the description appropriately summarizes the return value. It covers all required parameters and optional filters. However, it omits edge cases (e.g., file not found, large files) and performance hints, which could be useful for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden. It explains all 8 parameters with clear meanings (e.g., 'file_path: Path to the log file to search'), valid ranges, and defaults. This adds significant meaning beyond the schema's type-only definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Search for patterns in a log file with context lines,' specifying the verb (search) and resource (log file). It distinguishes itself from sibling tools like log_analyzer_tail (tail logs) and log_analyzer_extract_errors (extract errors).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as log_analyzer_tail or log_analyzer_ask. It lacks explicit when-to-use or when-not-to-use context, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_suggest_formatARead-onlyIdempotent
Analyze a log file and suggest the best parsing approach.
Returns detailed format detection information including:
- Detected format with confidence score
- Alternative formats to try if confidence is low
- Sample of unparseable lines with suggestions
- Custom pattern suggestions for generic parser
Args:
file_path: Path to the log file to analyze
sample_size: Number of lines to sample for analysis (default: 100)
response_format: Output format - 'markdown' or 'json'
Returns:
Format suggestions and analysis results
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| sample_size | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is read-only, non-destructive, and idempotent. The description adds behavioral context beyond annotations by detailing what the tool returns (confidence scores, alternative formats, unparseable lines, custom patterns). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence states the purpose, followed by a bullet list of return items, then parameter explanations. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (3 parameters with defaults, annotations present, output schema exists), the description adequately covers what the tool does and returns, listing key output components. It does not explain the output schema but it is not required. Minor improvement could include typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description compensates by explaining each parameter's meaning and defaults (e.g., sample_size controls lines sampled, response_format accepts 'markdown' or 'json'). This adds significant value over the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: analyze a log file and suggest the best parsing approach. It lists specific return items (detected format, confidence score, alternatives) that distinguish it from sibling tools like log_analyzer_parse or log_analyzer_suggest_patterns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for determining log format before parsing, but it does not explicitly state when to use it versus alternatives or provide exclusions. No direct comparison with sibling tools is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_suggest_patternsARead-onlyIdempotent
Analyze a log file and suggest useful search patterns.
Scans the log content to identify patterns for:
- Common error templates (normalized messages)
- Identifiers (UUIDs, request IDs, user IDs, session IDs)
- Security indicators (auth failures, suspicious activity)
- Performance indicators (slow requests, high memory)
- HTTP endpoints with errors
Args:
file_path: Path to the log file to analyze
focus: Analysis focus - 'all', 'errors', 'security', 'performance',
or 'identifiers' (default: 'all')
max_patterns: Maximum patterns to suggest (1-20, default: 10)
max_lines: Maximum lines to analyze (100-100000, default: 10000)
response_format: Output format - 'markdown' or 'json'
Returns:
Suggested search patterns with descriptions, match counts, and examples.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| focus | No | all | |
| max_patterns | No | ||
| max_lines | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint and idempotentHint. The description adds behavioral context by detailing that it scans log content, identifies patterns, and returns suggestions with counts and examples. This supplements the annotation information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a clear one-line summary, a bullet list of pattern categories, and a brief Args section. Every sentence adds value without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (from context), the description provides complete context: what it does, what parameters are needed, and what it returns (patterns with descriptions, counts, examples). No gaps are evident.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description fully compensates by explaining each parameter's purpose, default values, and valid ranges (e.g., max_lines: 100-100000, response_format: markdown or json). This adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Analyze a log file and suggest useful search patterns', specifying the verb and resource. It lists distinct pattern categories (errors, identifiers, security, performance, HTTP) that differentiate it from sibling tools like log_analyzer_search or log_analyzer_extract_errors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when pattern suggestions are needed and provides a 'focus' parameter to narrow analysis, but does not explicitly contrast with alternatives or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_summarizeARead-onlyIdempotent
Generate a debugging summary of a log file.
Args:
file_path: Path to the log file
focus: Focus area - 'errors', 'performance', 'security', or 'all' (default)
max_lines: Maximum lines to analyze (100-100000, default: 10000)
response_format: Output format - 'markdown' or 'json'
Returns:
Summary including file overview, level distribution, top errors,
anomalies detected, and recommended investigation areas.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| focus | No | all | |
| max_lines | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, so the description adds little behavioral context. It describes the output but does not disclose auth needs, rate limits, or side effects beyond the obvious read-only nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with a clear front-loaded purpose statement, well-organized Args section, and a brief Returns summary. Every sentence adds value, no fluff, and the structure is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward summarization tool, the description covers usage, parameters, and return value well. It could be improved by noting file size limits or encoding assumptions, but the presence of an output schema reduces the burden. Overall, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description compensates with clear explanations for all four parameters: focus options, max_lines range, response_format enum, and required file_path. This adds significant meaning beyond the schema's bare titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Generate a debugging summary of a log file' with a specific verb and resource. It distinguishes this tool from siblings like log_analyzer_extract_errors or log_analyzer_search by focusing on generating a high-level summary with anomalies and recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool over alternatives. It implies usage for summarizing log files but lacks guidance on when not to use it (e.g., for detailed error extraction) or comparisons to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_tailBRead-onlyIdempotent
Get the most recent log entries from a file.
Args:
file_path: Path to the log file
lines: Number of lines to return (1-1000, default: 100)
level_filter: Filter by log level (ERROR, WARN, INFO, DEBUG)
response_format: Output format - 'markdown' or 'json'
Returns:
The last N log entries, parsed and formatted.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| lines | No | ||
| level_filter | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint true and idempotentHint true, so the description does not need to reiterate safety. It adds value by stating the output is parsed and formatted, but does not cover potential edge cases like missing files or large file handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with a one-sentence purpose followed by a structured list of parameters and return value. Every sentence is informative, though the returns section could be slightly more detailed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential parameter and return details but lacks context on error handling, file accessibility, or format assumptions. While an output schema exists, the description should still mention potential issues for a comprehensive understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description provides meaningful explanations for all four parameters, including constraints (e.g., lines 1-1000, level filter values, output formats). This compensates for the empty schema and helps the agent understand valid inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the most recent log entries from a file, which directly addresses its purpose. It implies a tail-like behavior, but does not explicitly differentiate from sibling tools like search or watch, which could lead to ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention any preconditions, exclusions, or scenarios where other sibling tools would be more appropriate, leaving the AI agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_traceARead-onlyIdempotent
Extract and follow trace/correlation IDs across log entries.
Automatically detects trace IDs (OpenTelemetry, X-Request-ID, AWS X-Ray, UUID)
and groups related log entries to show request flows through your system.
Args:
file_path: Path to the log file to analyze
trace_id: Specific trace ID to filter for (None for all traces)
max_traces: Maximum number of trace groups to return (1-500, default: 100)
max_lines: Maximum lines to process (100-100000, default: 10000)
response_format: Output format - 'markdown' or 'json'
Returns:
Trace groups showing request flows, including trace ID types detected,
entry counts, time spans, and error indicators.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| trace_id | No | ||
| max_traces | No | ||
| max_lines | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds behavioral context beyond these annotations: it explains automatic detection of trace ID formats (OpenTelemetry, X-Request-ID, AWS X-Ray, UUID) and grouping of related log entries. This enriches transparency without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening statement, followed by a bullet list of arguments and a return summary. It is concise (each sentence adds value) and front-loaded with the core purpose, making it efficient for an AI agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, output schema exists), the description covers input, output, and behavior comprehensively. It explains how trace IDs are detected and grouped, and describes the return value structure (trace groups, IDs, counts, time spans, errors). The output schema likely handles detailed return formatting, so this high-level description is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description provides detailed semantics for all 5 parameters: file_path (path to file), trace_id (specific ID to filter), max_traces (range 1-500, default 100), max_lines (range 100-100000, default 10000), response_format (options 'markdown' or 'json'). This adds crucial meaning beyond the raw schema, making the tool easy to use correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Extract and follow trace/correlation IDs across log entries' and explains it detects trace IDs and groups related entries to show request flows. This distinguishes it from siblings like log_analyzer_search or log_analyzer_summarize, which focus on different aspects of log analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for tracing request flows but does not explicitly state when to use this tool versus alternatives among the 13 sibling tools. No when-not-to-use or comparative guidance is provided, leaving the agent to infer based on the tool's focus on trace IDs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log_analyzer_watchARead-only
Watch a log file for new entries since a given position.
This enables polling-based log watching. First call with from_position=0
returns the current end-of-file position. Subsequent calls with the
returned position get new entries added since then.
Args:
file_path: Path to the log file to watch
from_position: File position to read from. Use 0 for initial call
(returns current end position), or use the returned
current_position from a previous call.
max_lines: Maximum lines to read per call (1-1000, default: 100)
level_filter: Filter by log levels, comma-separated (e.g., "ERROR,WARN")
pattern_filter: Regex pattern to filter messages
response_format: Output format - 'markdown' or 'json'
Returns:
New log entries since the last position, with updated position for
the next call.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| from_position | No | ||
| max_lines | No | ||
| level_filter | No | ||
| pattern_filter | No | ||
| response_format | No | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds behavioral context by detailing the polling workflow and position tracking. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise yet comprehensive, using a well-structured Args/Returns format. It front-loads the purpose and provides necessary details without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters (1 required), no enums, and presence of an output schema, the description thoroughly covers the workflow and parameter roles. It explains the polling mechanism fully, making the tool self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description fully compensates by explaining each parameter: file_path, from_position (with usage instructions), max_lines (with range), level_filter (comma-separated), pattern_filter (regex), and response_format (markdown or json). This adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a precise action: watching a log file for new entries since a position. The verb 'watch' and resource 'log file' are clear. It distinguishes from siblings like log_analyzer_tail by describing a polling mechanism.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage pattern: first call with from_position=0, then use returned position. It implies polling-based watching, contrasting with real-time alternatives. However, it doesn't explicitly state when not to use or compare to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose (Q&A, correlation, diff, error extraction, multi-file analysis, parsing, sensitive data scanning, search, format suggestion, pattern suggestion, summary, tail, trace, watch). No two tools overlap significantly in functionality.
All tools follow a consistent 'log_analyzer_verb' pattern in snake_case, with verbs accurately describing the operation. Perfect naming uniformity.
14 tools is well-scoped for a log analysis server. Each tool addresses a specific need without being excessive or insufficient.
The tool set covers all major log analysis tasks: parsing, searching, filtering, extracting errors, correlating events, comparing files, summarizing, tracing, watching, and detecting sensitive data. No obvious gaps for the domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
Analytics and debugging for your MCP server — explore usage and sessions, then root-cause errors.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Related MCP Servers
- AlicenseBqualityDmaintenanceA specialized MCP server that helps analyze and debug Model Context Protocol logs by providing Claude with direct access to log files across multiple platforms.116MIT
- FlicenseBqualityDmaintenanceA Python-based MCP server that enables AI-assisted log file analysis with features for filtering, parsing, and interpreting log outputs, plus executing and analyzing test runs with varying verbosity levels.1212
- AlicenseNot gradedqualityCmaintenanceAn MCP server that provides AI assistants with direct access to application logs for on-demand searching, filtering, and analysis. It enables tools like Cursor to summarize log entries and identify errors within the development environment to streamline debugging.197MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server for intelligent log analysis providing semantic search, error pattern clustering, and smart error detection. It enables users to process, vectorize, and query local logs to efficiently identify issues and generate AI-powered summaries.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Fato07/log-analyzer-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server