papertrail-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@papertrail-mcpsearch prod logs for authentication failures in the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Papertrail MCP
A focused, read-only Model Context Protocol server for searching migrated Papertrail logs through the SolarWinds Observability API. It runs locally over stdio and works with Amp, Claude Code, Codex, and other stdio-capable MCP clients.
Tools
papertrail_list_environmentslists complete credential profiles without exposing API tokens or origins.papertrail_getperforms one bearer-authenticatedGETrequest to/v1/logsfor a selected profile.
The server does not expose writes, other SolarWinds Observability endpoints, relative-time parsing, filter composition, terminal formatting, or live-tail polling. Tool output is limited to 2,000 lines or 50 KiB.
Related MCP server: quickwit-mcp
Requirements
Node.js 20 or newer.
A SolarWinds Observability API Access token and regional public API origin for each Papertrail environment.
Configure profiles with environment variables:
export PAPERTRAIL_QA_API_TOKEN="your-qa-api-access-token"
export PAPERTRAIL_QA_API_BASE_URL="https://api.eu-01.cloud.solarwinds.com"
export PAPERTRAIL_STAGING_API_TOKEN="your-staging-api-access-token"
export PAPERTRAIL_STAGING_API_BASE_URL="https://api.na-02.cloud.solarwinds.com"
export PAPERTRAIL_PROD_API_TOKEN="your-prod-api-access-token"
export PAPERTRAIL_PROD_API_BASE_URL="https://api.na-01.cloud.solarwinds.com"The segment between PAPERTRAIL_ and the suffix becomes the lower-case profile name. Each profile needs both _API_TOKEN and _API_BASE_URL. The base URL must be a bare HTTPS origin for the account's SolarWinds Observability region, not a log-ingestion endpoint. The default profile is prod.
SolarWinds Observability API Access tokens currently have broader account access than this server exposes. Use a distinct token per environment where possible, store tokens as secrets, and never commit them to source control.
Run the published package with:
npx -y @andreimaxim/papertrail-mcpThe process communicates over stdio, so running it directly waits for an MCP client and may appear idle.
Amp
The distributable using-papertrail skill starts the MCP server only when Papertrail work loads the skill. Copy it into a project's skill directory:
mkdir -p .agents/skills/using-papertrail
cp skill/using-papertrail/SKILL.md .agents/skills/using-papertrail/SKILL.mdIn Amp, add the corresponding variables under personal, project, or workspace Secrets & Env Vars, storing each _API_TOKEN value as a secret. The bundled skill forwards conventional qa, staging, and prod profiles. Add another variable pair to its mcpServers.papertrail.env map when using a custom profile name.
Amp discovers the skill, launches the MCP process, and keeps its two tools hidden until the skill is loaded. The previous amp.papertrail.* settings are not read by this portable server.
Claude Code
Register the server at user scope:
claude mcp add --scope user --transport stdio papertrail -- \
npx -y @andreimaxim/papertrail-mcpLaunch Claude Code with the desired PAPERTRAIL_<ENVIRONMENT>_API_TOKEN and PAPERTRAIL_<ENVIRONMENT>_API_BASE_URL variables available. A project .mcp.json can declare the equivalent command while referring to securely managed environment variables.
Codex
Add the server to ~/.codex/config.toml or a trusted project's .codex/config.toml:
[mcp_servers.papertrail]
command = "npx"
args = ["-y", "@andreimaxim/papertrail-mcp"]
env_vars = [
"PAPERTRAIL_PROD_API_TOKEN",
"PAPERTRAIL_PROD_API_BASE_URL",
]
enabled_tools = ["papertrail_list_environments", "papertrail_get"]Add both variable names for every additional profile that Codex should forward.
Development
npm install
npm run check
npm pack --dry-runRepository layout:
src/papertrail.ts: profile discovery, URL validation, HTTP transport, redirect safety, and bounded output.src/server.ts: MCP schemas, read-only annotations, and tool handlers.src/index.ts: stdio executable.test/: client and MCP protocol tests.skill/using-papertrail/: optional Amp skill.
Available Tools
2 toolspapertrail_getGet Papertrail logsARead-onlyIdempotent
Make one authenticated GET request to the migrated Papertrail logs API at /v1/logs. This tool is read-only and may truncate large output.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Site-relative logs API path beginning with /v1/logs. It may include the exact query from pageInfo.nextPage. | |
| query | No | Optional query parameters. Array values are encoded as repeated parameters. | |
| environment | No | Credential environment. Use papertrail_list_environments to discover configured values. Defaults to prod. | prod |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior, but the description adds valuable context beyond that: it requires authentication, performs a single GET request, and cautions that large output may be truncated. This goes beyond the structured annotations and helps set expectations for API behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action and resource, and each sentence provides essential information without wasted words. Truncation warning and read-only note are succinctly included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple GET nature of the tool, the description is reasonably complete: it covers the action, endpoint, auth, read-only safety, and truncation risk. The lack of an output schema is partially mitigated by the 'logs' focus, but a brief note about the response format would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the parameter descriptions clearly explain 'path', 'query', and 'environment' including the note about pageInfo.nextPage. The main tool description adds no additional parameter semantics, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Make one authenticated GET request') and the specific resource ('migrated Papertrail logs API at /v1/logs'), making it obvious this tool fetches logs. It also notes that it is read-only, which aligns with the annotations and helps differentiate it from the sibling environment-listing tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus the sibling tool papertrail_list_environments. However, the tool name and resource path imply its purpose, and the environment parameter description mentions using list_environments to discover values, providing limited indirect guidance. Usage is implied but not formally articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
papertrail_list_environmentsList Papertrail environmentsARead-onlyIdempotent
List configured Papertrail credential environments without exposing their API tokens or URLs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only and idempotent behavior. The description adds the valuable guarantee that API tokens and URLs are not exposed, which is a behavioral trait beyond what the annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the action and includes no unnecessary words. It communicates the essential behavior clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and no output schema, the description covers the core behavior and the safety guarantee. It does not explicit mention the return format, but that is implied by the act of listing environment names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so schema coverage is effectively 100%. The description correctly omits parameter details, and the baseline score of 4 applies for the zero-parameter case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists configured Papertrail credential environments and specifically mentions the non-exposure of API tokens or URLs. It does not explicitly distinguish from the sibling papertrail_get, but the verb 'list' versus 'get' conveys a different scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus papertrail_get. The description is purely a statement of function, with no mention of use cases, exclusions, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
papertrail_get - First observed
papertrail_list_environments
TDQS
Scored across 2 tools
The two tools have entirely distinct purposes: one lists configured credential environments, the other executes a generic GET request to the Papertrail API. There is no overlap or confusion between them.
Both tools use snake_case and are prefixed with 'papertrail_', but one follows a verb_noun pattern (list_environments) while the other is a bare verb (get). This is mostly consistent but not perfectly uniform.
With only two tools, the server is at the low end of the acceptable range. For its narrow read-only purpose, the minimal set is understandable, but it still feels thin compared to typical MCP servers.
The tool pair covers the essential workflow of identifying an environment and making an authenticated GET request, which is sufficient for basic read-only access. However, there is no dedicated search or pagination tool, though agents can work around this via the generic GET.
Maintenance
Related MCP Connectors
Syslog receiver and MCP server for homelab log intelligence.
Syslog receiver and MCP server for homelab log intelligence.
- SupabaseOAuthcom.supabase
MCP server for interacting with the Supabase platform
Access New Relic observability data through MCP - query metrics, logs, traces, entities, and more
Related MCP Servers
- AlicenseBqualityCmaintenanceA read-only MCP server for OpenObserve Community Edition that works over the REST API. Provides tools for searching logs, traces, stream schemas, and dashboards - no Enterprise license required.8190 PyPI16GPL 3.0
- AlicenseNot gradedqualityFmaintenanceA read-only MCP server that exposes Quickwit log search and aggregations to LLM clients, enabling natural language log investigation.Apache 2.0
- AlicenseAqualityAmaintenanceMinimal MCP server that integrates with Graylog, enabling agents to search, analyze, and inspect log messages across streams, discover fields and streams, and query multiple Graylog instances.564 npmMIT
- AlicenseAqualityBmaintenanceA read-only MCP server for querying Sumo Logic logs, enabling AI assistants to search and investigate application logs with opinionated tools and secure credential handling.56 npm1MIT