victorialogs-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VICTORIALOGS_URL | Yes | VictoriaLogs query endpoint URL (required). | |
| VICTORIALOGS_DEBUG | No | Enable debug logging (true or false). | false |
| VICTORIALOGS_TOKEN | No | Bearer token for authentication. Cannot be used with VICTORIALOGS_USERNAME/PASSWORD. | |
| VICTORIALOGS_PASSWORD | No | Password for Basic authentication. Must be used together with VICTORIALOGS_USERNAME. | |
| VICTORIALOGS_USERNAME | No | Username for Basic authentication. Must be used together with VICTORIALOGS_PASSWORD. | |
| VICTORIALOGS_ACCOUNT_ID | No | VictoriaLogs storage tenant account ID. | 0 |
| VICTORIALOGS_PROJECT_ID | No | VictoriaLogs storage tenant project ID. | 0 |
| VICTORIALOGS_SSL_VERIFY | No | Whether to verify TLS certificates (true or false). | true |
| VICTORIALOGS_TIMEOUT_MS | No | Request timeout in milliseconds. | 30000 |
| VICTORIALOGS_MAX_RESPONSE_BYTES | No | Maximum response size in bytes. | 8388608 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| victorialogs.search_logsA | Search VictoriaLogs with LogsQL. Default: last hour, 150 latest rows; max 500. Use rangeSec or paired ISO start/end (end exclusive). filter is a separate LogsQL extra_filters constraint. offset paginates the selected window; keep start/end fixed across pages. |
| victorialogs.search_uuidB | Find a UUID, trace, request or correlation ID across common exact-value fields plus a phrase in _msg. Default window: last day. |
| victorialogs.search_streamA | Search a VictoriaLogs stream by its 48-character hex _stream_id. Discover IDs via list_streams. Default window: last hour. |
| victorialogs.list_streamsA | Discover stream IDs and hits. Values are _stream_id strings usable by search_stream. A limited subset can have zeroed hit counts. |
| victorialogs.field_namesB | Discover available log field names and hit counts. Results are bounded; use query/filter to narrow scope. |
| victorialogs.field_valuesC | Discover values and hit counts for a required field in a bounded time window. |
| victorialogs.hitsB | Count logs over time with stepSec buckets (default 60s), optionally grouped by fields. groupsLimit (default 20, max 100) returns top groups plus an overflow group. Maximum 10000 time buckets; default window last hour. |
| victorialogs.query_statsA | Execute a LogsQL aggregation pipeline, e.g. * | stats by (service) count() as errors. Returns original JSON rows without log normalization. Uses /select/logsql/query, not the Prometheus stats API. Default last hour, max 500 rows. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
The eight tools mostly target distinct outputs: raw log retrieval (search_logs), stream discovery, field discovery, value discovery, time-bucketed counts (hits), aggregation pipelines (query_stats), and a UUID lookup convenience wrapper. However, search_logs, query_stats, hits, and search_uuid all run LogsQL-style queries over logs with overlapping capability, and only the detailed descriptions keep them apart.
All names share the victorialogs. prefix and snake_case, which aids readability. But the internal pattern is mixed: search_stream/search_logs/search_uuid are verb_noun, list_streams is verb_noun, field_names/field_values are noun phrases, and hits/query_stats are bare noun/verb forms, so there is no single predictable convention.
Eight tools is well-scoped for a log-search backend, with each tool covering a distinct capability (search, discovery, aggregation, counting, ID lookup) rather than redundant variants. Nothing feels padded or missing.
The surface covers stream discovery, field/value discovery, raw search, UUID lookup, time-bucketed counting, and aggregation, which is broad lifecycle coverage for querying logs. Minor gaps exist (no explicit schema/field-type or export/tail tool), but agents can work around them via LogsQL.