Skip to main content
Glama
Fato07
by Fato07

Log Analyzer MCP

MCP Registry PyPI version PyPI Downloads License: MIT Python 3.10+ GitHub stars

🔍 Stop copy-pasting logs into AI. Let Claude read them directly.

An MCP server for AI-powered log analysis. Parse, search, and debug log files across 9+ formats — right from Claude Code.

📊 At a Glance

14 MCP tools

9+ log formats

280 tests

81%+ coverage

Related MCP server: Log Analyzer MCP

🎬 Demo

Log Analyzer MCP Demo

Analyzing logs with 14 specialized tools

🤔 Why?

Without log-analyzer-mcp

With log-analyzer-mcp

Copy-paste chunks of logs

Point Claude at the file

Lose context between pastes

Full file access

Manual format parsing

Auto-detection

Miss related errors

Smart correlation

✨ Features

  • Auto-Detection — Identifies format from 9+ common log types

  • Smart Search — Pattern matching with context, regex, and time filtering

  • Error Extraction — Groups similar errors, captures stack traces

  • Natural Language — Ask questions like "what errors happened today?"

  • Sensitive Data Scan — Detect PII, credentials, and secrets

  • Multi-File Analysis — Correlate events across distributed systems

  • Streaming — Handles 1GB+ files without memory issues

🚀 Quick Start

# Install (adds to Claude Code automatically)
uvx codesdevs-log-analyzer install

Then in Claude Code:

Analyze /var/log/app.log and tell me what's causing the errors

📦 Installation

uvx codesdevs-log-analyzer install

Manual

# pip
pip install codesdevs-log-analyzer

# uv
uv tool install codesdevs-log-analyzer

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "log-analyzer": {
      "command": "uvx",
      "args": ["codesdevs-log-analyzer"]
    }
  }
}

📋 Supported Formats

Format

Example

Syslog

Jan 15 10:30:00 hostname process[pid]: message

Apache/Nginx

127.0.0.1 - - [15/Jan/2026:10:30:00] "GET /path" 200

JSON Lines

{"timestamp": "...", "level": "ERROR", "message": "..."}

Docker

2026-01-15T10:30:00.123Z stdout message

Python

2026-01-15 10:30:00,123 - module - ERROR - message

Java/Log4j

2026-01-15 10:30:00,123 ERROR [thread] class - message

Kubernetes

level=error msg="..." ts=2026-01-15T10:30:00Z

Generic

Any line with recognizable timestamp

⚡ Performance

Metric

Value

100MB log file

< 10 seconds

Memory footprint

Streaming (no full load)

Max tested size

1GB+

Format detection

< 100ms

🛠️ Available Tools

Tool

Description

log_analyzer_parse

Detect format and extract metadata

log_analyzer_search

Search with context lines

log_analyzer_extract_errors

Extract and group errors

log_analyzer_summarize

Generate debugging summary

log_analyzer_correlate

Find related events

log_analyzer_watch

Monitor for new entries

log_analyzer_ask

Natural language queries

log_analyzer_scan_sensitive

Detect PII/credentials

+ 6 more

Full reference →

💡 Examples

Find errors:

Extract all errors from /var/log/app.log, group similar ones

Search with context:

Search for "timeout" in app.log with 5 lines of context

Correlate events:

What happened 60 seconds before each OutOfMemoryError?

Scan for secrets:

Check /var/log/app.log for accidentally logged credentials

🔧 Development

git clone https://github.com/Fato07/log-analyzer-mcp
cd log-analyzer-mcp
uv sync
uv run pytest -v --cov

📈 Star History

Star History Chart

📄 License

MIT License - see LICENSE for details.


Available Tools

14 tools
log_analyzer_askA
Read-onlyIdempotent
Answer questions about log files using AI-assisted analysis.

Translates natural language questions into appropriate log analysis
operations and provides intelligent, contextual answers.

Example questions:
- "Why did the database connection fail?"
- "How many errors occurred in the last hour?"
- "What happened before the server crashed?"
- "Show me all authentication failures"
- "When did the first timeout occur?"

Args:
    file_path: Path to the log file to analyze
    question: Natural language question about the logs
    max_results: Maximum supporting entries to include (10-200, default: 50)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Natural language answer with supporting log entries and suggestions.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
questionYes
max_resultsNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and idempotentHint=true, and the description adds context by stating it provides 'intelligent, contextual answers' with 'supporting log entries and suggestions'. It also specifies parameter constraints like max_results range (10-200) and output format options, which are not in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a brief introductory paragraph, a list of example questions, and an Args section. It is appropriately sized for the tool's complexity, though the example list could be slightly trimmed. No unnecessary sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (AI-assisted log analysis), the description covers purpose, usage, parameter semantics, and output format. Since an output schema exists, the description does not need to detail return values. It is complete for an agent to correctly select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% description coverage, but the description's Args section provides meaningful explanations for all four parameters: file_path, question, max_results (with range and default), and response_format (with enumeration). This adds significant value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it answers questions about log files using AI-assisted analysis, with concrete examples that distinguish it from sibling tools like log_analyzer_search or log_analyzer_correlate. The verb 'ask' and resource 'log files' are specific and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a list of example questions illustrating use cases, and implies it is for natural language queries rather than structured searches. However, it does not explicitly state when not to use or mention alternative tools for specific scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_correlateA
Read-onlyIdempotent
Correlate events around anchor points in a log file.

Args:
    file_path: Path to the log file
    anchor_pattern: Pattern to anchor correlation around (regex)
    window_seconds: Time window in seconds around anchor (1-3600, default: 60)
    max_anchors: Maximum anchor points to analyze (1-50, default: 10)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Correlated events around each anchor point, showing what happened
    before and after the anchor event.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
anchor_patternYes
window_secondsNo
max_anchorsNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, and idempotent behavior. The description adds valuable context that the tool returns correlated events with before/after information and specifies constraints on window_seconds and max_anchors, which enhances transparency beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with Args and Returns sections, front-loading the core functionality. While detailed, it could be slightly more concise, but it earns its length by providing necessary constraints and output details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters with ranges, defaults, and constraints) and the presence of an output schema, the description covers everything needed: purpose, all parameters with semantics, and return format. Sibling tools are diverse, and this description fully characterizes the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining each parameter: anchor_pattern is a regex, window_seconds has a range and default, max_anchors has a range and default, and response_format accepts markdown or json. This adds significant meaning beyond the schema's titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool correlates events around anchor points in a log file, which is a specific verb-resource combination. Among sibling tools focused on log analysis, 'correlate' stands out as distinct from search, summarize, or scan, making it easily distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for correlation but does not explicitly state when to use this tool over alternatives like log_analyzer_search or log_analyzer_summarize. No when-not-to-use or prerequisites are provided, leaving the agent to infer context from the purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_diffA
Read-onlyIdempotent
Compare log files or time periods within a log file.

Args:
    file_path_a: First log file path
    file_path_b: Second log file path (optional - for comparing two files)
    time_range_a_start: Start time for first period (ISO format, for time comparison)
    time_range_a_end: End time for first period (ISO format)
    time_range_b_start: Start time for second period (ISO format)
    time_range_b_end: End time for second period (ISO format)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Comparison showing new errors, resolved errors, and volume changes.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_path_aYes
file_path_bNo
time_range_a_startNo
time_range_a_endNo
time_range_b_startNo
time_range_b_endNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false. Description adds value by detailing return content (new errors, resolved errors, volume changes). No contradictions. Could mention idempotency implications but not required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with Args and Returns sections. Each parameter gets a one-line explanation. Slightly verbose due to listing all parameters, but necessary given no schema descriptions. Front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Describes two comparison modes (file vs time) but does not clarify mutual exclusivity: whether file_path_b and time_range_* should be used together or separately. The schema allows both, but description omits guidance. Output schema exists but return description is brief.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description fully compensates by explaining each parameter's purpose, including ISO format for time ranges, optionality of file_path_b, and the response_format options. Critical for correct usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'compare' and resource 'log files or time periods within a log file'. Distinguishes from siblings by focusing on diff/comparison, which is unique among the listed siblings (ask, search, summarize, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over siblings like log_analyzer_search or log_analyzer_summarize. Does not mention when-not to use or provide alternative suggestions. The two comparison modes (file vs time) are described but not contrasted with other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_extract_errorsA
Read-onlyIdempotent
Extract all errors and exceptions from a log file with stack traces.

Args:
    file_path: Path to the log file
    include_warnings: Include WARN level entries (default: False)
    group_similar: Group similar error messages (default: True)
    max_errors: Maximum errors to return (1-500, default: 100)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Extracted errors grouped by similarity with occurrence counts,
    timestamps, and sample stack traces.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
include_warningsNo
group_similarNo
max_errorsNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and idempotentHint=true. The description adds useful behavioral details: grouping similar errors, returning counts/timestamps/samples. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise docstring-style description with args and returns sections. No wasted words; every sentence provides necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, 0% schema coverage, and an output schema exists, the description fully covers behavior and return details (grouped errors with counts, timestamps, samples). Complete enough for agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description explains each parameter: file_path path, include_warnings default and meaning, group_similar behavior, max_errors range, and response_format options. Adds significant value beyond schema titles and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Extract all errors and exceptions from a log file with stack traces,' which is a specific verb and resource. It distinguishes from sibling tools like log_analyzer_search and log_analyzer_parse.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives or provide exclusions. Usage is implied by the purpose but not guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_multiA
Read-onlyIdempotent
Analyze multiple log files together for cross-file debugging.

Supports three operations:
- merge: Interleave entries by timestamp (like 'sort -m')
- correlate: Find events happening across files within time window
- compare: Diff error patterns between files

Args:
    file_paths: List of log file paths to analyze (2-10 files)
    operation: Analysis operation - 'merge', 'correlate', or 'compare' (default: 'merge')
    time_window: Time window in seconds for correlation (1-3600, default: 60)
    max_entries: Maximum entries to return (100-5000, default: 1000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Combined analysis results based on the selected operation.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathsYes
operationNomerge
time_windowNo
max_entriesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare safety, but description adds operational details (operations, parameter constraints, output format options) that go beyond annotations. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise and well-organized: intro, bullet list of operations, Args table, Returns. No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Coverage is strong for parameters and operations; output schema exists. Lacks prerequisites like file format or access permissions, but minimal impact given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no descriptions (0% coverage), but the description provides clear semantics for all parameters including constraints (e.g., 2-10 files, 1-3600 seconds), defaults, and options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Analyze multiple log files together for cross-file debugging' and details three specific operations, making the purpose explicit and distinct from single-file siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Lists operations but does not explain when to use this tool versus sibling tools like 'log_analyzer_correlate' or 'log_analyzer_diff'. Some guidance on context but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_parseA
Read-onlyIdempotent
Parse and analyze a log file, detecting its format and extracting metadata.

Args:
    file_path: Path to the log file to analyze
    format_hint: Force specific format (syslog, apache_access, apache_error, jsonl,
                 docker, python, java, kubernetes, generic) or None for auto-detect
    max_lines: Maximum lines to parse (100-100000, default 10000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Analysis results including detected format, time range, level distribution,
    and sample entries.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
format_hintNo
max_linesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only, idempotent behavior. Description adds what the tool returns (detected format, time range, level distribution, sample entries), providing good behavioral context. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Structured as a docstring with overview and parameter list. Front-loaded with purpose. Slightly verbose but efficient for the information needed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers main functionality and parameters. Output schema exists so return details are sufficient. Missing error conditions or file prerequisites, but overall comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully explains each parameter: file_path, format_hint (with list of values), max_lines (with range), response_format. This compensates entirely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it parses and analyzes log files, detecting format and extracting metadata. This separates it from sibling tools like search, summarize, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for initial log parsing but lacks explicit guidance on when to use alternatives or when not to use. Sibling tools provide context but no direct exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_scan_sensitiveA
Read-onlyIdempotent
Detect sensitive data in logs (PII, credentials, API keys).

Scans log files for potentially sensitive information including:
- Email addresses
- Credit card numbers (Visa, MasterCard, Amex)
- API keys and tokens (AWS, GitHub, Slack, generic)
- Passwords in URLs or config
- Social Security Numbers (SSN)
- JWT and Bearer tokens
- Database connection strings
- Private key markers
- Phone numbers
- IP addresses (optional)

Args:
    file_path: Path to the log file to scan
    redact: Redact sensitive data in output (default: False)
    categories: Filter to specific categories. Options:
               email, credit_card, api_key, token, password,
               ssn, ip_address, phone, connection_string, private_key
    include_ips: Include IP address detection (default: False)
    max_matches: Maximum matches to return (1-500, default: 100)
    max_lines: Maximum lines to scan (1-1000000, default: 100000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Sensitive data scan results with matches and statistics.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
redactNo
categoriesNo
include_ipsNo
max_matchesNo
max_linesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint true and destructiveHint false, indicating no side effects. The description reinforces this by stating it 'scans log files' and 'returns results and statistics.' It adds specifics like optional redaction and IP detection, providing behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by a structured list of arguments and return description. Every sentence adds value, though it is slightly lengthy. It earns a 4 because it balances completeness with readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters, a required file_path, and no nested objects, the description covers all parameters, their options, and the return value. An output schema exists but is not provided; the description still states that returns contain matches and statistics, which together with the schema provides complete information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates fully by explaining each parameter in detail: file_path, redact, categories (with options list), include_ips, max_matches (range 1-500), max_lines (range 1-1000000), response_format. This adds significant meaning beyond the schema's type and default values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb-object pair 'Detect sensitive data in logs' and enumerates specific categories (PII, credentials, API keys). It distinguishes this tool from siblings like log_analyzer_search or log_analyzer_extract_errors by focusing exclusively on sensitive data detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description details when to use the tool via its parameter descriptions (e.g., categories filter, max_matches), but does not explicitly contrast it with sibling tools or state when not to use it. However, the context signals that no other sibling covers sensitive data scanning, so the use case is well implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_suggest_formatA
Read-onlyIdempotent
Analyze a log file and suggest the best parsing approach.

Returns detailed format detection information including:
- Detected format with confidence score
- Alternative formats to try if confidence is low
- Sample of unparseable lines with suggestions
- Custom pattern suggestions for generic parser

Args:
    file_path: Path to the log file to analyze
    sample_size: Number of lines to sample for analysis (default: 100)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Format suggestions and analysis results
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
sample_sizeNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate the tool is read-only, non-destructive, and idempotent. The description adds behavioral context beyond annotations by detailing what the tool returns (confidence scores, alternative formats, unparseable lines, custom patterns). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the first sentence states the purpose, followed by a bullet list of return items, then parameter explanations. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 parameters with defaults, annotations present, output schema exists), the description adequately covers what the tool does and returns, listing key output components. It does not explain the output schema but it is not required. Minor improvement could include typical use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description compensates by explaining each parameter's meaning and defaults (e.g., sample_size controls lines sampled, response_format accepts 'markdown' or 'json'). This adds significant value over the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: analyze a log file and suggest the best parsing approach. It lists specific return items (detected format, confidence score, alternatives) that distinguish it from sibling tools like log_analyzer_parse or log_analyzer_suggest_patterns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for determining log format before parsing, but it does not explicitly state when to use it versus alternatives or provide exclusions. No direct comparison with sibling tools is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_suggest_patternsA
Read-onlyIdempotent
Analyze a log file and suggest useful search patterns.

Scans the log content to identify patterns for:
- Common error templates (normalized messages)
- Identifiers (UUIDs, request IDs, user IDs, session IDs)
- Security indicators (auth failures, suspicious activity)
- Performance indicators (slow requests, high memory)
- HTTP endpoints with errors

Args:
    file_path: Path to the log file to analyze
    focus: Analysis focus - 'all', 'errors', 'security', 'performance',
           or 'identifiers' (default: 'all')
    max_patterns: Maximum patterns to suggest (1-20, default: 10)
    max_lines: Maximum lines to analyze (100-100000, default: 10000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Suggested search patterns with descriptions, match counts, and examples.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
focusNoall
max_patternsNo
max_linesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint and idempotentHint. The description adds behavioral context by detailing that it scans log content, identifies patterns, and returns suggestions with counts and examples. This supplements the annotation information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a clear one-line summary, a bullet list of pattern categories, and a brief Args section. Every sentence adds value without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (from context), the description provides complete context: what it does, what parameters are needed, and what it returns (patterns with descriptions, counts, examples). No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description fully compensates by explaining each parameter's purpose, default values, and valid ranges (e.g., max_lines: 100-100000, response_format: markdown or json). This adds significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Analyze a log file and suggest useful search patterns', specifying the verb and resource. It lists distinct pattern categories (errors, identifiers, security, performance, HTTP) that differentiate it from sibling tools like log_analyzer_search or log_analyzer_extract_errors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when pattern suggestions are needed and provides a 'focus' parameter to narrow analysis, but does not explicitly contrast with alternatives or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_summarizeA
Read-onlyIdempotent
Generate a debugging summary of a log file.

Args:
    file_path: Path to the log file
    focus: Focus area - 'errors', 'performance', 'security', or 'all' (default)
    max_lines: Maximum lines to analyze (100-100000, default: 10000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Summary including file overview, level distribution, top errors,
    anomalies detected, and recommended investigation areas.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
focusNoall
max_linesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, so the description adds little behavioral context. It describes the output but does not disclose auth needs, rate limits, or side effects beyond the obvious read-only nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a clear front-loaded purpose statement, well-organized Args section, and a brief Returns summary. Every sentence adds value, no fluff, and the structure is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward summarization tool, the description covers usage, parameters, and return value well. It could be improved by noting file size limits or encoding assumptions, but the presence of an output schema reduces the burden. Overall, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description compensates with clear explanations for all four parameters: focus options, max_lines range, response_format enum, and required file_path. This adds significant meaning beyond the schema's bare titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Generate a debugging summary of a log file' with a specific verb and resource. It distinguishes this tool from siblings like log_analyzer_extract_errors or log_analyzer_search by focusing on generating a high-level summary with anomalies and recommendations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool over alternatives. It implies usage for summarizing log files but lacks guidance on when not to use it (e.g., for detailed error extraction) or comparisons to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_tailB
Read-onlyIdempotent
Get the most recent log entries from a file.

Args:
    file_path: Path to the log file
    lines: Number of lines to return (1-1000, default: 100)
    level_filter: Filter by log level (ERROR, WARN, INFO, DEBUG)
    response_format: Output format - 'markdown' or 'json'

Returns:
    The last N log entries, parsed and formatted.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
linesNo
level_filterNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint true and idempotentHint true, so the description does not need to reiterate safety. It adds value by stating the output is parsed and formatted, but does not cover potential edge cases like missing files or large file handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a one-sentence purpose followed by a structured list of parameters and return value. Every sentence is informative, though the returns section could be slightly more detailed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential parameter and return details but lacks context on error handling, file accessibility, or format assumptions. While an output schema exists, the description should still mention potential issues for a comprehensive understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description provides meaningful explanations for all four parameters, including constraints (e.g., lines 1-1000, level filter values, output formats). This compensates for the empty schema and helps the agent understand valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the most recent log entries from a file, which directly addresses its purpose. It implies a tail-like behavior, but does not explicitly differentiate from sibling tools like search or watch, which could lead to ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description does not mention any preconditions, exclusions, or scenarios where other sibling tools would be more appropriate, leaving the AI agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_traceA
Read-onlyIdempotent
Extract and follow trace/correlation IDs across log entries.

Automatically detects trace IDs (OpenTelemetry, X-Request-ID, AWS X-Ray, UUID)
and groups related log entries to show request flows through your system.

Args:
    file_path: Path to the log file to analyze
    trace_id: Specific trace ID to filter for (None for all traces)
    max_traces: Maximum number of trace groups to return (1-500, default: 100)
    max_lines: Maximum lines to process (100-100000, default: 10000)
    response_format: Output format - 'markdown' or 'json'

Returns:
    Trace groups showing request flows, including trace ID types detected,
    entry counts, time spans, and error indicators.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
trace_idNo
max_tracesNo
max_linesNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool as readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds behavioral context beyond these annotations: it explains automatic detection of trace ID formats (OpenTelemetry, X-Request-ID, AWS X-Ray, UUID) and grouping of related log entries. This enriches transparency without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening statement, followed by a bullet list of arguments and a return summary. It is concise (each sentence adds value) and front-loaded with the core purpose, making it efficient for an AI agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, output schema exists), the description covers input, output, and behavior comprehensively. It explains how trace IDs are detected and grouped, and describes the return value structure (trace groups, IDs, counts, time spans, errors). The output schema likely handles detailed return formatting, so this high-level description is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description provides detailed semantics for all 5 parameters: file_path (path to file), trace_id (specific ID to filter), max_traces (range 1-500, default 100), max_lines (range 100-100000, default 10000), response_format (options 'markdown' or 'json'). This adds crucial meaning beyond the raw schema, making the tool easy to use correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Extract and follow trace/correlation IDs across log entries' and explains it detects trace IDs and groups related entries to show request flows. This distinguishes it from siblings like log_analyzer_search or log_analyzer_summarize, which focus on different aspects of log analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for tracing request flows but does not explicitly state when to use this tool versus alternatives among the 13 sibling tools. No when-not-to-use or comparative guidance is provided, leaving the agent to infer based on the tool's focus on trace IDs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_analyzer_watchA
Read-only
Watch a log file for new entries since a given position.

This enables polling-based log watching. First call with from_position=0
returns the current end-of-file position. Subsequent calls with the
returned position get new entries added since then.

Args:
    file_path: Path to the log file to watch
    from_position: File position to read from. Use 0 for initial call
                   (returns current end position), or use the returned
                   current_position from a previous call.
    max_lines: Maximum lines to read per call (1-1000, default: 100)
    level_filter: Filter by log levels, comma-separated (e.g., "ERROR,WARN")
    pattern_filter: Regex pattern to filter messages
    response_format: Output format - 'markdown' or 'json'

Returns:
    New log entries since the last position, with updated position for
    the next call.
ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
from_positionNo
max_linesNo
level_filterNo
pattern_filterNo
response_formatNomarkdown

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds behavioral context by detailing the polling workflow and position tracking. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet comprehensive, using a well-structured Args/Returns format. It front-loads the purpose and provides necessary details without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters (1 required), no enums, and presence of an output schema, the description thoroughly covers the workflow and parameter roles. It explains the polling mechanism fully, making the tool self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by explaining each parameter: file_path, from_position (with usage instructions), max_lines (with range), level_filter (comma-separated), pattern_filter (regex), and response_format (markdown or json). This adds significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies a precise action: watching a log file for new entries since a position. The verb 'watch' and resource 'log file' are clear. It distinguishes from siblings like log_analyzer_tail by describing a polling mechanism.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear usage pattern: first call with from_position=0, then use returned position. It implies polling-based watching, contrasting with real-time alternatives. However, it doesn't explicitly state when not to use or compare to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.2/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose (Q&A, correlation, diff, error extraction, multi-file analysis, parsing, sensitive data scanning, search, format suggestion, pattern suggestion, summary, tail, trace, watch). No two tools overlap significantly in functionality.

Naming Consistency5/5

All tools follow a consistent 'log_analyzer_verb' pattern in snake_case, with verbs accurately describing the operation. Perfect naming uniformity.

Tool Count5/5

14 tools is well-scoped for a log analysis server. Each tool addresses a specific need without being excessive or insufficient.

Completeness5/5

The tool set covers all major log analysis tasks: parsing, searching, filtering, extracting errors, correlating events, comparing files, summarizing, tracing, watching, and detecting sensitive data. No obvious gaps for the domain.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    D
    maintenance
    A Python-based MCP server that enables AI-assisted log file analysis with features for filtering, parsing, and interpreting log outputs, plus executing and analyzing test runs with varying verbosity levels.
    12
    12
  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that provides AI assistants with direct access to application logs for on-demand searching, filtering, and analysis. It enables tools like Cursor to summarize log entries and identify errors within the development environment to streamline debugging.
    19
    7
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server for intelligent log analysis providing semantic search, error pattern clustering, and smart error detection. It enables users to process, vectorize, and query local logs to efficiently identify issues and generate AI-powered summaries.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Fato07/log-analyzer-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server