graylog-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_HOST | No | Host for streamable HTTP mode | |
| MCP_PORT | No | Port for streamable HTTP mode | |
| GRAYLOG_TOKEN | No | Access token for token authentication | |
| MCP_TRANSPORT | No | MCP transport mode: 'stdio' (default) or 'streamable-http' | |
| GRAYLOG_API_BASE | Yes | Base URL of the Graylog API (e.g., https://graylog.example.com/api) | |
| GRAYLOG_ENV_FILE | No | Path to .env file | |
| GRAYLOG_PASSWORD | No | Password for basic authentication | |
| GRAYLOG_USERNAME | No | Username for basic authentication | |
| GRAYLOG_AUTH_MODE | Yes | Authentication mode: 'session', 'token', or 'basic' | |
| GRAYLOG_SESSION_ID | No | Session ID for session authentication | |
| GRAYLOG_PROFILE_DIR | No | Directory containing business profiles (default: profiles) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| graylog_get_system_infoA | Verify Graylog connectivity and return cluster version/node metadata. |
| graylog_search_messagesC | Run a raw Graylog Lucene query over an absolute RFC3339 time range. |
| graylog_diagnose_code_logsA | Correlate code log literals and runtime identifiers, then expand discovered trace keys. Use this after reading relevant source and finding log statements. Pass stable literal text from those statements plus known values such as studentExamId, taskId, requestNo, or traceId. A business profile adds stage patterns and correlation keys without changing this tool. |
| graylog_list_profilesA | List available business diagnosis profiles and their trigger aliases. |
| graylog_get_profileA | Return one validated business diagnosis profile by name or alias. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| diagnose_code_runtime | Create a vendor-neutral code-to-Graylog runtime diagnosis workflow. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| profile_catalog | A compact catalog of available business diagnosis profiles. |
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: listing profiles, fetching a specific profile, checking system info, searching messages, and running log diagnosis. Even the two profile tools are differentiated by list vs. single get, matching standard patterns.
All tools follow the consistent verb_noun pattern with a common 'graylog_' prefix: list_profiles, get_profile, get_system_info, search_messages, diagnose_code_logs. The verbs are clear and uniform in style.
Five tools is well within the ideal range for a focused MCP server. Each tool is purposeful and contributes to the overall workflow of profile-based log diagnosis without redundancy.
The tool surface covers the core workflow: retrieving diagnosis profiles, searching raw messages, and running a specialized diagnosis. Minor gaps exist, such as no tool for creating/updating profiles or fetching a single message by ID, but these are not critical for the stated purpose.