loggly-mcp
Read-only MCP server for Loggly /apiv2/* APIs plus IP intelligence (RDAP, GreyNoise, AbuseIPDB), with write endpoints blocked.
Low-level Loggly wrappers —
connection_test,create_search,get_events,search_and_get_events,iterate_events_page,iterate_events_next,count_events,volume_metrics,stats_query,list_fields,field_facets,raw_api_call.Aggregation-first traffic tools —
search_logsreturns totals, top-N breakdowns, a bucketed timeline, and a small sample instead of raw dumps;traffic_by_ip/traffic_by_host/traffic_by_pathpre-scope that to one entity.Facet shortcuts —
group_by_ip,group_by_path,group_by_user_agentfor quick breakdowns;timelinefor bucketed counts;sample_eventsfor a few examples.Field discovery — field names are resolved discovery-first against
/apiv2/fields/, reportingdiscovered_fieldsorambiguous_fieldsrather than guessing; overridable via*_fieldargs orLOGGLY_FIELD_*env vars.IP intelligence —
rdap_lookup(ownership/netblock, no key),ip_reputation(GreyNoise + AbuseIPDB), andget_ip_contextwhich merges all sources with Loggly traffic across every configured account and flagscross_domain_correlation.Multiple Loggly accounts —
LOGGLY_ACCOUNTSlets every tool target a different subdomain/token via an optionalaccountargument.Two transports — stdio (npm/
npxor from source) and a stateless Streamable HTTP server (POST /mcpbehind a bearer token,GET /healthz), with Docker support.
Loggly MCP
Read-only Model Context Protocol (MCP) server for Loggly /apiv2/* APIs, plus IP
intelligence (RDAP, GreyNoise, AbuseIPDB). Exposes Loggly search/analytics/field tools,
aggregation-first traffic tools, and IP-context tools, while blocking write endpoints.
Skill Usage
For efficient log retrieval (less token use) and summarization, pair this server with a skill.
Quickstart
Install from npm
LOGGLY_SUBDOMAIN=your-subdomain LOGGLY_TOKEN=your-token npx -y @andrewbabu/loggly-mcpMCP client configuration:
{
"mcpServers": {
"loggly": {
"command": "npx",
"args": ["-y", "@andrewbabu/loggly-mcp"],
"env": {
"LOGGLY_SUBDOMAIN": "your-subdomain",
"LOGGLY_TOKEN": "your-token"
}
}
}
}Related MCP server: quickwit-mcp
Run from source
git clone https://github.com/andrewbabu/loggly-mcp.git
cd loggly-mcp
npm install
cp .env.example .envEdit .env with your Loggly credentials, then run:
npm startOnce the repo is trusted in Codex, the MCP server can also be started automatically via .codex/config.toml.
Configuration
The server loads .env from its working directory on startup.
Required
LOGGLY_SUBDOMAIN
Loggly account subdomain or full Loggly URL (e.g.your-subdomainorhttps://your-subdomain.loggly.com)LOGGLY_TOKEN
Loggly API token
Optional
LOGGLY_AUTH_MODEbearer(default) orbasicLOGGLY_MAX_RETRIES
Default:2LOGGLY_REQUEST_TIMEOUT_MS
Default:15000LOGGLY_LOG_LEVELerror,warn,info(default), ordebug
Remote (HTTP) Server
For a stdio server anyone on the team can reach from Claude Code without a local checkout, run the HTTP variant instead and host it on an internal server/VM.
cp .env.example .envEdit .env with your Loggly credentials plus MCP_BEARER_TOKEN (generate one with
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"), then:
npm run start:httpThis starts a stateless Streamable HTTP MCP server on MCP_HTTP_PORT (default 8787):
GET /healthz— unauthenticated liveness check.POST /mcp— the MCP endpoint. RequiresAuthorization: Bearer <MCP_BEARER_TOKEN>; every other request to/mcpgets401.
The Loggly credentials stay server-side — everyone connecting shares the same Loggly account
access. MCP_BEARER_TOKEN only gates access to the MCP server itself, so treat it as a secret
and rotate it if it leaks (e.g. re-generate and redistribute).
Only run this behind your internal network/VPN, not exposed directly to the public internet — there's a single shared token, not per-user auth.
Connecting from Claude Code
Each org member adds the remote server once:
claude mcp add --transport http loggly https://your-internal-host:8787/mcp \
--header "Authorization: Bearer <MCP_BEARER_TOKEN>"Swap in the internal hostname/port you deployed to and the token you were given.
Running with Docker
docker build -t loggly-mcp .
docker run -d --name loggly-mcp -p 8787:8787 --env-file .env loggly-mcpMultiple Accounts / Domains
The server can hold credentials for several Loggly accounts (different subdomains, different tokens) at once and target them per tool call.
Set LOGGLY_ACCOUNTS to a JSON object mapping an account name to its credentials:
LOGGLY_ACCOUNTS={"acme":{"subdomain":"acme","token":"acme_token","authMode":"bearer"},"beta":{"subdomain":"beta","token":"beta_token"}}When LOGGLY_ACCOUNTS is set, it replaces LOGGLY_SUBDOMAIN/LOGGLY_TOKEN/LOGGLY_AUTH_MODE.
Every tool then accepts an optional account argument (e.g. account: "acme") to pick which
account's credentials to use for that call.
If
accountis omitted, the server usesLOGGLY_DEFAULT_ACCOUNTif set, otherwise"default", otherwise the single configured account if there's only one.An unknown
accountvalue returns an error listing the configured account names.iterate_events_nextcan also infer the account from thenext_urlhost whenaccountis omitted, as long as exactly one configured account matches that host.
Existing single-account setups (just LOGGLY_SUBDOMAIN/LOGGLY_TOKEN) keep working unchanged —
they're treated as one account named "default".
Aggregation-First Traffic Tools
Raw event dumps are slow and expensive to reason about. These tools return a summary — totals, top-N breakdowns, a bucketed timeline, and a small representative sample — instead:
search_logs— the general-purpose version: query + time range in, aggregated summary out.traffic_by_ip/traffic_by_host/traffic_by_path— same aggregation, pre-scoped to one IP/hostname/path.group_by_ip/group_by_path/group_by_user_agent— facet counts only (thin wrappers overfield_facets), for when you just need a breakdown, not the full aggregate.timeline— bucketed counts over a range, computed client-side via repeated/apiv2/events/countcalls (Loggly'svolume-metricsendpoint doesn't accept a free-text query, so this is the only way to get a timeline for an arbitrary search).sample_events— a handful of representative raw events, when you need examples rather than the complete result set.
Field naming depends on how each Loggly source parses its logs, and can differ between accounts
and even between tags within one account — so these tools resolve field names discovery-first:
for any role not explicitly overridden (host_field/path_field/status_field/user_agent_field/
ip_field arguments, or the LOGGLY_FIELD_HOST/_PATH/_STATUS/_USER_AGENT/_IP env vars),
they check /apiv2/fields/ for the actual query and match candidates against known role patterns:
Exactly one match → used automatically, reported under
discovered_fieldsin the result.Multiple plausible matches (e.g. a source with both
ClientIpandCustIP) → never guessed between — reported underambiguous_fieldsinstead, falling back to the configured default. Pass the correct one explicitly via the matching*_fieldargument.No match → falls back to the configured default (
host,path,status,user_agent,ip).
Run list_fields yourself if you want to see every candidate before deciding on an override.
IP Intelligence
rdap_lookup— IP ownership/network registration (RIR, netblock, org, country) via public RDAP (rdap.org). No API key required.ip_reputation— GreyNoise (internet-wide scanning noise) + AbuseIPDB (community abuse reports) for an IP. RequiresGREYNOISE_API_KEY/ABUSEIPDB_API_KEY; either one missing just comes back asavailable: falsefor that source, not an error.get_ip_context— combines all of the above with Loggly traffic (1h/24h/30d counts, first/last seen, hosts, top paths) checked across every configured Loggly account unlessaccountis given, and flagscross_domain_correlationwhen the IP shows activity in more than one account. Per thebot-traffic-triageplaybook, that cross-domain pattern is the single strongest signal for distinguishing targeted reconnaissance from background noise.
Treat all IP-intel output as one input among several — identity/reputation data (who owns an
IP, third-party scanner reports) should carry less weight than behavioral evidence from your own
logs. See the bot-traffic-triage skill for the full investigation methodology.
Logging
Logs are written to stderr to avoid interfering with MCP stdio traffic.
Use LOGGLY_LOG_LEVEL to control verbosity. Default is info.
Timeouts, Retries & Concurrency
Requests enforce a per-call timeout of LOGGLY_REQUEST_TIMEOUT_MS (default 15000).
Transient failures (429, 500 with timeout-like body, 503, 504, or network timeouts) are retried up to LOGGLY_MAX_RETRIES times, honoring a Retry-After header on 429 when Loggly sends one, falling back to exponential backoff otherwise.
The aggregation tools (search_logs, traffic_by_*, get_ip_context, etc.) fan out several requests per call via Promise.all (facets + timeline buckets + a sample). LOGGLY_MAX_CONCURRENT_REQUESTS (default 4) caps how many of those run at once per account, so that fan-out doesn't trip Loggly's own rate limit by itself. If you still see 429s from a single aggregation call, lower this; if Loggly's limit is more generous, raise it.
Tool Manifest
Tool metadata is stored in tool-manifest.json and verified against src/server.js.
npm run verify:manifestSmoke Test
Smoke test runs without Loggly credentials by setting LOGGLY_SMOKE_TEST=1.
npm run smokeImplemented MCP Tools
Low-level Loggly API wrappers:
connection_testcreate_searchget_eventssearch_and_get_eventsiterate_events_pageiterate_events_nextcount_eventsvolume_metricsstats_querylist_fieldsfield_facetsraw_api_call
Aggregation-first traffic tools:
search_logstraffic_by_iptraffic_by_hosttraffic_by_pathgroup_by_ipgroup_by_pathgroup_by_user_agenttimelinesample_events
IP intelligence:
rdap_lookupip_reputationget_ip_context
Examples
Example tool argument payloads are in examples/.
Development
npm testnpm test runs manifest verification and the smoke test. CI runs the same checks in .github/workflows/ci.yml.
Versioning
VERSIONcontains the current release version.CHANGELOG.mdtracks changes by release.
Security Notes
.envfiles must never be committed.Tokens and API keys (
LOGGLY_TOKEN,LOGGLY_ACCOUNTS,GREYNOISE_API_KEY,ABUSEIPDB_API_KEY,MCP_BEARER_TOKEN) are treated as secrets.This server enforces read-only access to Loggly
/apiv2/*endpoints. IP-intel calls (RDAP/GreyNoise/AbuseIPDB) are read-only GET requests to those third-party services; no Loggly credentials are ever sent to them, and no IP-intel keys are sent to Loggly.
Available Tools
24 toolsconnection_testConnection TestB
Validates Loggly credentials by creating a small search and returning the RSID.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -15m | |
| size | No | ||
| query | No | * | |
| until | No | now | |
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses that the call internally creates a real search and returns an RSID, but omits whether that search persists, whether it consumes quota, and how auth failures surface.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the purpose front-loaded and no filler. It is efficient, though terse enough that the brevity edges into under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter tool with no annotations and no output schema, the description covers only the intent and the return handle (RSID). Parameter meaning, default behavior, and failure modes are all absent, leaving the agent under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Five parameters with 0% schema description coverage, and the description adds nothing about any of them. The phrase 'small search' only loosely gestures at query/size/from/until, leaving account and the defaults unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: validating Loggly credentials, with the mechanism (small search) and outcome (RSID) named. It is distinguishable from the search-oriented siblings, though it never explicitly contrasts itself with create_search or search_logs, which it superficially resembles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: an agent can infer this is a credential/connectivity check, not a data-retrieval call. There is no explicit when-to-use, when-not-to-use, or pointer to the sibling to use for actual searching.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
count_eventsCount EventsD
Calls /apiv2/events/count to return event count and optional volume.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| query | No | * | |
| until | No | now | |
| account | No | ||
| include_volume | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It discloses nothing about permissions, rate limits, return format, defaults, or what 'optional volume' means beyond what the schema field name already implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no waste, but it is under-specified rather than concise; the one sentence spent on the endpoint path could have been spent on meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
5 undocumented parameters, no annotations, no output schema, no usage guidance. Nothing an agent needs to call this correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description adds nothing about any of the 5 parameters (from, query, until, account, include_volume). No syntax, format, or meaning is explained anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('return event count') but the core of the description is the API endpoint path, which is implementation detail rather than purpose. It does not distinguish itself from siblings like get_events, volume_metrics, or stats_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus volume_metrics, get_events, or stats_query. An agent cannot infer routing from 'Calls /apiv2/events/count'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_searchCreate SearchC
Creates a Loggly search and returns its RSID metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| size | No | ||
| order | No | desc | |
| query | No | * | |
| until | No | now | |
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It implies a mutation (creating a search job) and hints at a returned RSID, but never states whether results are returned inline, whether the search must be polled, whether it expires, or what auth/limits apply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, which is structurally clean, but it is terse to the point of under-specification for a 6-parameter tool rather than genuinely economical.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 undocumented parameters, no annotations, and no output schema, one sentence is not enough. The description should at minimum explain the query/time-range semantics and the RSID lifecycle the caller must follow up on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters (query, from, until, size, order, account), and the description adds nothing about any of them — not even that 'query' accepts a Loggly search syntax string or that 'from'/'until' are time expressions. This is a clear gap the description fails to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Creates a Loggly search') and adds a return-value hint ('RSID metadata'). It does not, however, distinguish this from close siblings such as search_logs or search_and_get_events, so the agent must guess which search entry point to use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no indication that this is the first step of a two-phase create-then-iterate flow, and no mention of alternatives like search_and_get_events or iterate_events_page. The agent is left to infer the workflow entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
field_facetsField FacetsC
Calls /apiv2/fields// to return terms and counts for a specific field.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| query | No | ||
| until | No | now | |
| account | No | ||
| facet_size | No | ||
| field_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that the call returns terms and counts, but says nothing about read-only safety, rate limits, permissions, default time window, or whether the aggregation is scoped by query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though borderline too terse given the amount of undocumented behavior it is expected to cover.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no annotations, no output schema, and no parameter descriptions, the definition is substantially incomplete. An agent cannot determine the time-window defaults, the facet_size behavior, or how query filters the facet result from this text alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, so the description must compensate, yet it only clarifies that a field name goes into the URL path. The meaning and interaction of from/until defaults, query, account, and facet_size (1-300 cap) are left entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource ('return terms and counts for a specific field') rather than restating the name, so an agent can tell it is a faceting/aggregation call. However, it does not differentiate from the sibling list_fields, which an agent could easily confuse for the same territory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus list_fields, raw_api_call, or the group_by_* siblings. The only implicit signal is the endpoint path embedded in the text, which is not actionable routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_eventsGet EventsC
Retrieves event results for a previously-created RSID from /apiv2/events.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| rsid | Yes | ||
| format | No | ||
| account | No | ||
| columns | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It conveys that the operation is a read of event results and gives the endpoint, but omits relevant behavior such as authentication needs, pagination behavior, RSID lifetime, or output format expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence with no wasted words and puts the core purpose and resource up front. It is appropriately sized for a short definition, though its brevity contributes to gaps in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five parameters, no annotations, no output schema, and 0% schema description coverage, this description is too sparse. It states the basic retrieval purpose but omits enough parameter, pagination, and behavioral context that an agent cannot confidently invoke it in complex cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for all parameter meaning. It clarifies only the rsid parameter as 'previously-created' but says nothing about page, format, account, or columns, leaving four of five parameters semantically undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Retrieves') and resource ('event results'), and identifies the endpoint '/apiv2/events' and required input ('previously-created RSID'). It is clear what the tool does, but it does not distinguish itself from sibling tools like search_and_get_events or iterate_events_page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'previously-created RSID' implies a prerequisite, but the description gives no explicit when-to-use guidance, no when-not-to-use conditions, and does not name alternatives. An agent would have to infer that this is the RSID-based retrieval path versus other event-fetching siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_ip_contextGet IP ContextB
Combines RDAP, GreyNoise/AbuseIPDB reputation, and Loggly traffic (1h/24h/30d counts, first/last seen, hosts, top paths — checked across every configured Loggly account unless account is given) into one normalized profile for an IP. Flags cross_domain_correlation when the IP shows activity in more than one account, which the bot-traffic-triage playbook treats as the single strongest escalation signal.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | ||
| account | No | ||
| ip_field | No | ||
| host_field | No | ||
| path_field | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and discloses genuinely non-obvious behavior: it queries every configured Loggly account by default unless `account` is given, and it flags `cross_domain_correlation` when an IP appears in more than one account. It stops short of covering auth requirements, rate limits, or response structure, but the default-scope and flag semantics are valuable behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and the composite sources. The parenthetical detail on counts and fields is informative rather than redundant, and no sentence is wasted, though the second sentence is fairly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a composite lookup with no annotations and no output schema, the description adequately conveys what is returned and the key correlation flag, but leaves the field-override parameters and edge/error behavior unaddressed. It is minimum-viable rather than complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters. The description clarifies only `account` ('unless `account` is given'); the field-override parameters `ip_field`, `host_field`, and `path_field` are never mentioned and remain entirely undocumented in both schema and description. The description does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it combines three named sources (RDAP, GreyNoise/AbuseIPDB reputation, Loggly traffic) into a 'normalized profile for an IP'. This clearly identifies it as the composite/aggregation tool relative to narrower siblings like rdap_lookup, ip_reputation, and traffic_by_ip, though it never explicitly names those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the description ties the tool to the 'bot-traffic-triage playbook' and flags the strongest escalation signal, which gives a context of use. It does not state when to prefer this over the sibling lookups or any when-not condition, so guidance remains inferential.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
group_by_ipGroup By IPC
Facet counts by IP for a query/time range (thin wrapper over field_facets).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | * | |
| window | No | -1h | |
| account | No | ||
| ip_field | No | ||
| facet_size | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations and no output schema, so the description carries the full burden. It reveals that results are 'facet counts' and that it is a thin wrapper over field_facets, but says nothing about permissions, rate limits, default limits, or the shape/size of the returned facets.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the core purpose front-loaded and the implementation note trailing. No filler, though it is arguably too terse given the undocumented parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter aggregation tool with no annotations and no output schema, the description is inadequate: three parameters are wholly undocumented and there is no output or usage context to fill the gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters, so the description must compensate and largely doesn't. It only gestures at 'query/time range' (query, window), leaving account, ip_field, and facet_size completely undefined in both schema and prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: it produces facet counts keyed by IP for a query/time range. The parenthetical naming field_facets as the underlying implementation is useful, though it doesn't disambiguate from the nearby sibling traffic_by_ip or group_by_path, which sound like the same aggregation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no conditions, and no exclusions. The description never explains how this differs from traffic_by_ip, group_by_path, or group_by_user_agent, leaving the agent to guess which grouping tool to call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
group_by_pathGroup By PathC
Facet counts by path for a query/time range (thin wrapper over field_facets).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | * | |
| window | No | -1h | |
| account | No | ||
| facet_size | No | ||
| path_field | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses only that this is a thin wrapper over field_facets; it says nothing about return shape, default behavior (default query '*', default window '-1h'), result limits, or the facet_size cap of 300.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with the key noun front-loaded. It is structurally clean, though arguably too terse for a 5-parameter tool with no schema documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and 0% parameter coverage, the description should do heavy lifting but leaves most of the contract unspecified. An agent knows roughly what it returns grouped by, but not what it returns, how much, or what the parameters mean.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters, and the description only loosely gestures at 'query/time range' (query, window) and 'by path' (path_field). It adds no meaning for account, facet_size, path_field format, or the defaults that apply when nothing is passed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific output (facet counts) and a specific grouping dimension (path) scoped to a query/time range, which distinguishes it from siblings like group_by_ip and group_by_user_agent. It also names the underlying tool (field_facets), so the agent can place it in the family without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Calls itself a 'thin wrapper over field_facets', which weakly implies 'use field_facets if you need more than path grouping', but it never states when to choose this tool over field_facets, traffic_by_path, or group_by_ip. Usage is only inferable from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
group_by_user_agentGroup By User AgentB
Facet counts by User-Agent for a query/time range (thin wrapper over field_facets).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | * | |
| window | No | -1h | |
| account | No | ||
| facet_size | No | ||
| user_agent_field | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden, and it delivers almost none: no return shape, no pagination behavior, no statement of the facet_size cap (schema allows up to 300), and no note on defaults (query '*', window '-1h'). The 'thin wrapper' note usefully signals that behavior mirrors field_facets, but that is the only behavioral context offered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the operation, the dimension, the scope, and the underlying primitive with zero filler. Nothing could be removed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 undocumented parameters, no annotations, and no output schema, the description is far too thin to let an agent invoke this confidently. The unspecified user_agent_field parameter in particular leaves ambiguity about what is actually being grouped, and nothing explains the facet_size limit or defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters, so the description must compensate and largely does not. 'Query/time range' loosely maps to the query and window params, but account, facet_size, and especially user_agent_field (which presumably controls the field being faceted) are entirely unexplained anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific operation (facet counts), a specific dimension (User-Agent), and the scoping inputs (query/time range), which cleanly separates it from siblings like group_by_ip and group_by_path. It also names its underlying primitive, field_facets, so an agent knows exactly what it wraps. It stops short of a 5 only because it doesn't contrast itself against field_facets as an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical 'thin wrapper over field_facets' implies the agent should use field_facets directly for non-User-Agent facets, which is a usable routing hint. But there is no explicit when-to-use/when-not-to-use statement and no mention of prerequisites such as a valid account or time window. Usage is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ip_reputationIP ReputationA
Checks GreyNoise (internet-wide scanning noise) and AbuseIPDB (community abuse reports) for an IP. Requires GREYNOISE_API_KEY / ABUSEIPDB_API_KEY env vars — returns available:false for whichever isn't configured, rather than erroring.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it discloses two genuinely useful behavioral facts: the required GREYNOISE_API_KEY / ABUSEIPDB_API_KEY env vars and the graceful degradation to available:false instead of an error when a key is absent. It does not cover rate limits, caching, or response shape, so it is strong but not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with what is checked and followed immediately by the operational caveat. Every clause carries information and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter lookup with no annotations or output schema, the description covers the data sources, the auth requirement, and the partial-failure behavior, which is most of what an agent needs. It leaves IP format expectations and returned fields unaddressed, though the latter is largely excused by the absence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter, ip, at 0% schema description coverage, so the description must compensate and it does not — it says only 'for an IP' with no IPv4/IPv6 format guidance or handling of invalid input. The parameter name is self-explanatory but the description adds nothing beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (checks) and resource (IP reputation) and names the two upstream data sources — GreyNoise scanning noise and AbuseIPDB abuse reports — which implicitly separates it from rdap_lookup and traffic_by_ip. It stops short of explicitly naming or contrasting with those siblings, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies the context (reputation/abuse screening for an IP), but there is no explicit when-to-use or when-not-to-use guidance relative to neighbors such as get_ip_context or rdap_lookup. Usage must be inferred from the named sources.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iterate_events_nextIterate Events NextA
Fetches the next page from /apiv2/events/iterate using the exact next URL returned by the previous page.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | ||
| next_url | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully reveals that the URL must be the exact one returned previously (i.e. it is an opaque continuation token, not a constructible query), but discloses nothing about auth requirements, rate limits, or behavior at the end of pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the action and endpoint, with no filler. Every clause earns its place by implying both how pagination continues and why the URL must be reused verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple continuation tool with no output schema the description is roughly adequate, but the undocumented `account` parameter and the absence of any end-of-pagination or failure behavior leave gaps an agent would have to guess at.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description is the only source of meaning. It does add real semantics for `next_url` (must be the exact URL from the previous page), but the second parameter `account` is left entirely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (fetches the next page) and resource (events iterate endpoint), making the pagination-continuation role unambiguous. It does not explicitly name the sibling iterate_events_page, but the phrase 'the previous page' implicitly separates it from the first-page call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage condition: you call this only when you hold a `next` URL returned by a prior page. However, it never names iterate_events_page as the sibling that produces that URL, nor states what to do when no next URL is available, so the routing guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iterate_events_pageIterate Events PageC
Calls /apiv2/events/iterate with query parameters and returns the first page plus next URL.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| size | No | ||
| order | No | desc | |
| query | No | * | |
| until | No | now | |
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses only the return shape (first page + next URL); it says nothing about filtering semantics of the query parameters, authentication requirements, rate limits, or what happens on repeated iteration. This is a significant gap for a 6-parameter tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single, front-loaded sentence with no waste, but for a tool with six undocumented parameters the terseness is under-specification rather than effective conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no annotations and no output schema, the description omits parameter semantics, usage conditions, and alternative tools. The 'next URL' hint is the only substantive detail and is not enough to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for all six parameters, yet it only says 'with query parameters' without explaining from/until/size/order/query/account or their defaults and constraints. None of the parameters gain meaning from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the underlying endpoint and the resource (events page), and notes it returns the first page plus a `next` URL. However, it gives no sibling differentiation against get_events, search_and_get_events, or iterate_events_next, so the agent cannot confidently route between them from this text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives. The only clue is the implicit pagination framing in 'first page plus next URL', which leaves selection against sibling event tools to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_fieldsList FieldsC
Calls /apiv2/fields/ to return parsed field names in the selected time range.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| query | No | ||
| until | No | now | |
| account | No | ||
| facet_size | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read operation via 'return', but discloses nothing about auth needs, rate limits, result size, or pagination behavior. For a tool with zero annotation coverage this is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the endpoint and return type come first. It is tight, though its brevity is partly under-specification rather than disciplined concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 undocumented parameters, no annotations, and no output schema, the description should explain return shape and parameter behavior but does neither. An agent cannot reliably invoke this correctly on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for all 5 parameters. The description vaguely ties the call to a 'selected time range', which loosely maps to from/until, but leaves query, account, and especially facet_size (a bounded 1-500 integer) completely unexplained. It does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it returns parsed field names, scoped to a time range, and even names the endpoint. This clearly distinguishes it from event/search tools. However, it never differentiates itself from the sibling 'field_facets', which is a closely related field-oriented tool, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. With a closely related sibling like 'field_facets' in the set, the absence of routing guidance is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
raw_api_callRaw API CallC
Makes a GET request to a Loggly API path. Useful while discovering exact endpoint behavior.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | /apiv2/search | |
| account | No | ||
| paramsJson | No | {"q":"*","from":"-15m","until":"now","size":1} |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses only the HTTP method (GET), but omits authentication requirements, rate limits, error behavior, and whether calls hit a live production API. This is thin for a raw API tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and followed by the use case. There is no filler, though the tool's complexity means the brevity leaves important details to other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and 0% parameter description coverage, the description is far too incomplete for a flexible raw-call tool. It should explain authentication, path/account/paramsJson usage, and response behavior, but provides none of that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It loosely maps 'Loggly API path' to the path parameter and implies query parameters via GET, but it says nothing about the account parameter or the paramsJson format and default JSON, leaving most parameter semantics unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (GET) and resource (Loggly API path) and hints at a discovery use case. It does not explicitly differentiate this raw escape hatch from the many specialized sibling tools, but the purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states a use case ('useful while discovering exact endpoint behavior'), which implies when to use it, but there are no alternatives named and no when-not conditions. The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rdap_lookupRDAP LookupC
Looks up IP ownership/network registration data (RIR, netblock, org, country) via public RDAP (rdap.org) — no API key required.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that no API key is required and that it uses the public rdap.org service, but says nothing about rate limits, latency, error behavior for unroutable/private IPs, or the shape of the response for a read tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. Every phrase (service used, returned fields, no auth) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation, no-output-schema tool with an undocumented parameter, the description leaves out too much: input format, error/edge-case behavior, and how results differ from sibling IP tools. It is under-specified for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single 'ip' parameter has no description, so the description must compensate. It implies the input is an IP address via 'IP ownership' but adds no format guidance (IPv4 vs IPv6, public-only restriction, CIDR support).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (looks up) and a clearly defined resource (IP ownership/network registration data), listing the concrete fields returned (RIR, netblock, org, country). It is distinguishable from the unrelated logging/search siblings, though it doesn't explicitly contrast with the closest neighbor, ip_reputation/get_ip_context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no mention of alternatives such as ip_reputation or get_ip_context which appear to cover overlapping IP-context territory. Usage is only implied by the subject matter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sample_eventsSample EventsA
Returns a small number of representative events for a query — use this instead of pulling full result pages when you just need examples, not the complete set.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -1h | |
| limit | No | ||
| order | No | desc | |
| query | No | * | |
| until | No | now | |
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it does disclose the key trait that results are a small representative subset rather than an exhaustive set. However, it says nothing about how sampling is performed (random vs deterministic), permissions, rate limits, or pagination, leaving meaningful behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states what the tool returns and when to prefer it, with no wasted words. It reads well as an at-a-glance selection cue.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, and the description explains the sampling concept but not the six parameters or the shape of the returned sample. It is adequate for choosing the tool but incomplete for invoking it precisely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Six parameters (from, until, limit, order, query, account) have 0% schema description coverage and no annotations, so the description must compensate and largely does not. 'For a query' and 'small number' faintly gesture at the query and limit parameters but provide no syntax, format, or default semantics for any of them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource ('Returns a small number of representative events for a query') and characterizes its distinctive sampling role versus full-result retrieval. It does not name the specific sibling it replaces (e.g., get_events or search_and_get_events), so differentiation is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear when-to-use rule ('when you just need examples, not the complete set') and implicitly tells the agent to avoid it when the full set is required, which is genuine routing guidance. It stops short of naming the alternative tool explicitly, so it is not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_and_get_eventsSearch And Get EventsC
Creates a search then fetches one page from legacy /apiv2/events using the returned RSID.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -2h | |
| page | No | ||
| size | No | ||
| order | No | desc | |
| query | No | * | |
| until | No | now | |
| format | No | ||
| account | No | ||
| columns | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions the legacy endpoint and the RSID mechanism but omits critical traits: whether the RSID persists, whether pagination is supported here or via iterate_events_* siblings, authentication needs, rate limits, and error behavior. For a 9-parameter tool with zero annotation coverage, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single tight sentence with no wasted words, which is appropriate. However, the extreme brevity for a 9-parameter tool is under-specification rather than ideal conciseness, preventing a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters at 0% schema coverage, no annotations, and no output schema, the description is far from complete. It should explain parameter meanings, default behavior, paging strategy, and the relationship to sibling iteration tools, none of which are addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for nine undocumented parameters (from, page, size, order, query, until, format, account, columns). The description mentions none of them, leaving the agent with no semantic guidance on defaults like 'from: -2h' or the meaning of 'columns'. This is a severe deficiency.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific compound action ('creates a search then fetches one page') and names the underlying endpoint and mechanism (RSID). This distinguishes it from siblings like get_events (which presumably fetches directly) and create_search (which only creates). However it doesn't explicitly say what it returns or how it differs from get_events, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this combined create-and-fetch tool versus calling create_search and then get_events separately, or versus iterate_events_page/iterate_events_next for paging. The agent must infer usage from the description alone, which only explains mechanics, not selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsSearch Logs (Aggregated)A
Runs a query and returns an aggregated summary (total, top hosts/paths/status codes/user agents, a bucketed timeline, and a small representative sample) instead of raw events. Prefer this over get_events/iterate_events_* for exploratory analysis.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -1h | |
| query | No | * | |
| top_n | No | ||
| until | No | now | |
| account | No | ||
| host_field | No | ||
| path_field | No | ||
| sample_size | No | ||
| bucket_count | No | ||
| status_field | No | ||
| user_agent_field | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does disclose the key behavioral trait that output is aggregated rather than raw. However, it omits defaults, result-size limits (top_n max 100, sample_size max 50, bucket_count max 48), whether counts are exact or approximate, and any permission/rate-limit notes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, and the return-shape explanation is front-loaded ahead of the preference guidance. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter tool with no annotations and no output schema, the description covers the return content well but leaves the parameter surface largely unexplained. An agent could call the tool, but only with guesses about the field-override params and time syntax.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 11 parameters, so the schema contributes nothing and the description must compensate. It implicitly maps to several params by naming top hosts/paths/status codes/user agents, a bucketed timeline, and a representative sample, but it never explains from/until/query syntax, the *_field overrides, or account.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (runs a query) and the exact return shape (aggregated summary with total, top hosts/paths/status codes/user agents, bucketed timeline, and representative sample) rather than raw events. It explicitly distinguishes itself from get_events and iterate_events_*, so an agent can route correctly without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit alternative set (get_events/iterate_events_*) and the condition that selects this tool (exploratory analysis). It does not, however, address the many other aggregation-oriented siblings (count_events, group_by_*, timeline, field_facets, stats_query, traffic_by_*), which overlap with this tool's output and leave some routing ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stats_queryStats QueryC
Calls /apiv2/stats// for numeric field statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| field | Yes | ||
| query | No | * | |
| until | No | now | |
| account | No | ||
| stat_type | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It discloses only that the tool calls an API endpoint for numeric field statistics, but says nothing about read-only nature, required permissions, rate limits, response format, or what the various stat_type modes return.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repetition. It is concise, though its extreme brevity leaves important details unstated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a 6-parameter tool with an enum, defaults, no annotations, and no output schema, the description is severely incomplete. It does not explain parameter semantics, expected return values, or how to interpret the different stat_type modes, leaving an agent unable to invoke the tool correctly without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, so the description must compensate. It only mentions 'stat_type' and 'field' via the endpoint path, leaving 'from', 'until', 'query', and 'account' entirely unexplained, and it does not clarify the enum values or defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Calls) and resource (the /apiv2/stats/... endpoint) for 'numeric field statistics', which is clearer than a tautology. However, it does not differentiate this tool from siblings like field_facets or volume_metrics, and it leans on an internal endpoint path rather than a user-facing purpose statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as field_facets, volume_metrics, or count_events. The description simply states what the endpoint does, leaving the agent to infer appropriate usage contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
timelineTimelineC
Bucketed event counts over a time range for a query, computed client-side from /apiv2/events/count.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | -24h | |
| query | No | * | |
| until | No | now | |
| account | No | ||
| bucket_count | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It mentions client-side computation from /apiv2/events/count, hinting at a read-only operation and possible multiple API calls, but omits permissions, rate limits, and return format details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the core purpose and no wasted words. It is structurally efficient, though its brevity may be excessive for a five-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no annotations, no output schema, and 0% schema coverage, the description is far from complete. It omits parameter details, return value structure, and usage context, leaving the agent with insufficient information to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only vaguely references 'time range' and 'query', leaving bucket_count, account, and the expected formats for from/until (e.g., relative times) completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('bucketed event counts'), resource ('events'), and scope ('over a time range for a query'). It distinguishes itself from a simple count by emphasizing bucketing, but does not explicitly differentiate from siblings like volume_metrics or stats_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no alternatives named, and no prerequisites. The description only states what the tool does, leaving the agent to infer when it is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
traffic_by_hostTraffic By HostC
Aggregated traffic summary (see search_logs) scoped to a single hostname.
| Name | Required | Description | Default |
|---|---|---|---|
| top_n | No | ||
| window | No | -1h | |
| account | No | ||
| hostname | Yes | ||
| host_field | No | ||
| sample_size | No | ||
| bucket_count | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden, yet 'summary' only weakly implies a read-only aggregation. It discloses nothing about return shape, window semantics, sampling behavior, permissions, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the scoping constraint front-loaded and no filler. Conciseness is good, though the efficiency comes partly from simply saying too little.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool with 0% schema coverage, no annotations, and no output schema, the description is far too thin. It should at least define the time window, ranking (top_n), and bucketing behavior that the parameters imply.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and 7 parameters include top_n, window, account, host_field, sample_size, and bucket_count — none explained anywhere. The description only clarifies the required hostname scoping, leaving the semantics of the other six parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('aggregated traffic summary') and scope ('scoped to a single hostname'), which distinguishes it from siblings like traffic_by_ip and traffic_by_path by the grouping key. It doesn't explicitly name those siblings, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical '(see search_logs)' hints at a relationship but gives no explicit when-to-use or when-not-to-use guidance, and no condition distinguishing it from traffic_by_ip, group_by_ip, or timeline. An agent must infer the choice from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
traffic_by_ipTraffic By IPC
Aggregated traffic summary (see search_logs) scoped to a single IP address.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | ||
| top_n | No | ||
| window | No | -1h | |
| account | No | ||
| ip_field | No | ||
| sample_size | No | ||
| bucket_count | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, yet it discloses almost nothing: it doesn't say whether this is a read-only aggregation, what the default 1h window means, how top_n/sample_size/bucket_count shape the result, or any rate limits. 'Aggregated summary' is the only behavioral signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the key scoping fact front-loaded and no wasted words. It is arguably too terse for a 7-parameter tool, but the dimension rewards efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A tool with 7 parameters, no output schema, no annotations, and 0% schema coverage needs the description to explain the aggregation model (time bucketing, top-N truncation, sampling) and return shape. The description supplies none of that, leaving an agent unable to call it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 7 parameters, so the description must compensate and does not. Only the 'ip' scope is implied; top_n, window, account, ip_field, sample_size, and bucket_count are entirely unexplained in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific output ('aggregated traffic summary') and a specific scope ('a single IP address'), which an agent can distinguish from group_by_ip (multi-IP grouping) or traffic_by_host. It does not explicitly name or contrast those siblings, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only guidance is a parenthetical 'see search_logs', which points at a data source rather than explaining when to pick this over traffic_by_host, group_by_ip, or timeline. No when-not-to-use or prerequisite conditions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
traffic_by_pathTraffic By PathC
Aggregated traffic summary (see search_logs) scoped to a single request path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| top_n | No | ||
| window | No | -1h | |
| account | No | ||
| path_field | No | ||
| sample_size | No | ||
| bucket_count | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Aggregated traffic summary' implies a read-only aggregation, but nothing is said about return shape, pagination, cost, or the time window semantics implied by the parameters. For a 7-parameter analytics tool, this is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler and an efficient parenthetical cross-reference. It is well-structured, though its brevity here reflects under-specification rather than disciplined editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 undocumented parameters, no annotations, and no output schema, the description is far too sparse to let an agent call this correctly. The window, bucket_count, and top_n semantics are essential for a traffic aggregation and are entirely absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 7 parameters, and the description compensates only by naming 'path' implicitly via 'single request path'. Nothing explains top_n, window, bucket_count, sample_size, account, or path_field, so an agent must guess at their meaning and units.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific output (aggregated traffic summary) and scope (single request path), which distinguishes it from traffic_by_ip and traffic_by_host. However, it does not clarify how it differs from the sibling group_by_path, leaving one likely-overlapping alternative undifferentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only guidance is a parenthetical pointer to search_logs, which names a related tool but does not state when this tool should be chosen over traffic_by_ip, traffic_by_host, or group_by_path. No conditions, prerequisites, or exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_metricsVolume MetricsC
Calls /apiv2/volume-metrics to retrieve count/volume grouped or filtered by host/app/log type/tag.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| from | No | -1h | |
| host | No | ||
| until | No | now | |
| account | No | ||
| group_by | No | ||
| log_type | No | ||
| measurement_types | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden, yet it discloses almost nothing: no auth/permission requirements, no rate limits, no pagination or result-size behavior, no mention of the from=-1h / until=now defaults, and no indication of what the response contains. It only implies the operation is a read (retrieve/count).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single efficient sentence, but the leading clause 'Calls /apiv2/volume-metrics' is wasted tokens that convey an internal endpoint rather than capability, so it is sparse rather than truly well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter tool with no annotations, no output schema, and 0% schema description coverage, the one-line description is far too thin. An agent would need to guess at time-range semantics, account scoping, and result shape to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 parameters, so the description must compensate, and it only partially does: 'host/app/log type/tag' hints at the filter/group dimensions and 'count/volume' loosely maps to measurement_types. It says nothing about from, until, account, default values, accepted formats, or the group_by enum values, leaving half the parameters undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('retrieve count/volume') and names the dimensions it can group/filter by, which is more than a tautology. However, it spends half its length citing the raw endpoint '/apiv2/volume-metrics' (implementation detail) and never distinguishes itself from close siblings like count_events, stats_query, or traffic_by_host, so an agent cannot confidently choose it over them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all. With siblings such as count_events, stats_query, timeline, and traffic_by_host all plausibly overlapping in intent, the description gives no condition, exclusion, or alternative that would route the agent correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
24 tool updates
v0.1.0- First observed
connection_test - First observed
count_events - First observed
create_search - First observed
field_facets - First observed
get_events - First observed
get_ip_context - First observed
group_by_ip - First observed
group_by_path - First observed
group_by_user_agent - First observed
ip_reputation - First observed
iterate_events_next - First observed
iterate_events_page - First observed
list_fields - First observed
raw_api_call - First observed
rdap_lookup - First observed
sample_events - First observed
search_and_get_events - First observed
search_logs - First observed
stats_query - First observed
timeline - First observed
traffic_by_host - First observed
traffic_by_ip - First observed
traffic_by_path - First observed
volume_metrics
TDQS
Scored across 24 tools
There is real overlap: get_events, search_and_get_events, iterate_events_page/next, search_logs, and sample_events all retrieve event data, and the traffic_by_*/group_by_* families are near-identical variants differing only by dimension (some explicitly 'thin wrappers over field_facets'). The descriptions do provide guidance ('prefer this over...'), which prevents outright confusion, but an agent must read carefully to pick correctly.
All names use snake_case and are largely verb_noun or noun_verb forms (create_search, get_events, count_events, list_fields, sample_events, rdap_lookup). A few noun-first names (volume_metrics, field_facets, traffic_by_ip, timeline) deviate from the verb-first majority but remain readable and predictable.
24 tools is on the heavy end for a log-search server, and several families are redundant (traffic_by_ip/host/path, group_by_ip/path/user_agent) and could be collapsed into parameterized tools. It's justifiable but feels inflated by wrapper duplication.
The surface covers the core Loggly lifecycle well: credential check, search creation, event retrieval/iteration, counts, volume, stats, field listing/facets, plus aggregation helpers and external IP enrichment (RDAP, GreyNoise, AbuseIPDB, combined context). Minor gaps like saved-search management or write/delete operations exist but are outside the apparent read-only analytics scope.
Maintenance
Related MCP Connectors
Free MCP server of security & dev API tools -- supply-chain, CVE, DNS, WHOIS, OFAC, Cosmos SDK.
Model Context Protocol server for the Apideck Unified API. Connect any MCP-compatible agent framework to 100+ accounting systems, HRIS platforms, file storage providers, and more through one integration. More information https://www.apideck.com/mcp-server
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Syslog receiver and MCP server for homelab log intelligence.
Related MCP Servers
- AlicenseBqualityCmaintenanceA read-only MCP server for OpenObserve Community Edition that works over the REST API. Provides tools for searching logs, traces, stream schemas, and dashboards - no Enterprise license required.894 PyPI16GPL 3.0
- AlicenseNot gradedqualityFmaintenanceA read-only MCP server that exposes Quickwit log search and aggregations to LLM clients, enabling natural language log investigation.Apache 2.0
- AlicenseAqualityAmaintenanceMCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch/NetBox): full read surface plus opt-in, audited write tools.5192 PyPI3MIT
- FlicenseNot gradedqualityCmaintenanceRead-only MCP server for Elasticsearch log querying. Enables natural language search, filtering, context retrieval, and aggregation of logs.-