vmware-aria-logs
Provides tools for querying and analyzing logs from VMware Aria Operations for Logs, including log search, incident detection, dashboard listing, and optional correlation with VMware Aria Operations resources and alerts.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@vmware-aria-logsShow me the latest error events from the past 2 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
VMware Aria Operations for Logs — MCP Server
MCP server for querying and analyzing logs from VMware Aria Operations for Logs (formerly vRealize Log Insight). Provides log search, mass incident detection, and optional VMware Aria Operations (vROps) correlation.
Built for use with Claude Code, Claude Desktop, LobeChat, and any MCP-compatible client.
Features
Log Search — Query events with time range, text filters, and field constraints via Log Insight API v2
Incident Detection — Signature-based clustering to identify mass log incidents (Stormbreaker engine)
API Surface Probe — Detect appliance version and available API endpoints
Dashboard Listing — Enumerate saved dashboards (legacy vRLIC API, deprecated on 8.18+)
vROps Correlation — Cross-reference log entities with Aria Operations resources and alerts
Related MCP server: Log Analyzer MCP Server
Quick Start
Install via uvx (recommended)
uvx vmware-aria-logsInstall via pip
pip install vmware-aria-logsRun with environment variables
export LI_BASE_URL=https://loginsight.example.com
export LI_USERNAME=admin
export LI_PASSWORD=your-password
export LI_PROVIDER=Local
vmware-aria-logsMCP Tools
Tool | Description |
| Search log events with time range, text filter, field constraints |
| Get appliance version and probe API surface |
| List saved dashboards (legacy vRLIC API, deprecated on 8.18+) |
| Mass incident detection via signature clustering |
| Find entities in Aria Operations by name |
| Get alerts for specific vROps resources |
Configuration
Required Environment Variables
Variable | Description | Default |
| Log Insight appliance URL | — |
| API username |
|
| API password | — |
| Auth provider (Local, ActiveDirectory) |
|
| Verify TLS certificates |
|
| HTTP request timeout (seconds) |
|
Optional (vROps Correlation)
Variable | Description | Default |
| Aria Operations URL | — |
| vROps username |
|
| vROps password | — |
| Auth source |
|
| Verify TLS certificates |
|
| HTTP request timeout (seconds) |
|
Claude Code / MCP Client Configuration
{
"mcpServers": {
"aria-logs": {
"command": "uvx",
"args": ["vmware-aria-logs"],
"env": {
"LI_BASE_URL": "https://loginsight.example.com",
"LI_USERNAME": "admin",
"LI_PASSWORD": "your-password"
}
}
}
}Why This Server?
VMware Aria Operations for Logs (Log Insight) is widely deployed in enterprise VMware environments, but lacks modern AI-assisted log analysis tooling. This MCP server bridges that gap:
Zero dependencies beyond the MCP SDK — uses Python stdlib
urllibfor HTTPStormbreaker engine — unique signature-based clustering that finds mass incidents humans miss
vROps correlation — cross-reference log events with infrastructure health in a single conversation
Works on v8.x+ — tested on Aria Operations for Logs 8.18.3, gracefully degrades deprecated APIs
Also Available On
License
MIT
Available Tools
6 toolsdetect_incidentsA
Detect mass log incidents using signature clustering (Stormbreaker engine).
Queries events, groups them by normalized signature pattern, and returns clusters that exceed the mass threshold — ranked by event count.
Args: lookback_minutes: How far back to search (default 60 minutes). search_term: Free-text search term (optional, empty = all events). event_limit: Max events to fetch for analysis (default 5000). mass_threshold: Min events per signature to qualify as incident (default 5). max_incidents: Max incidents to return (default 20).
Returns: JSON with ranked incidents including signature, event count, blast radius (affected sources), and sample text.
| Name | Required | Description | Default |
|---|---|---|---|
| lookback_minutes | No | ||
| search_term | No | ||
| event_limit | No | ||
| mass_threshold | No | ||
| max_incidents | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It transparently describes that the tool queries events, groups by signature, and returns clusters above a threshold. It does not mention any side effects or mutability, but the verb 'detect' implies a read-only operation. However, it lacks explicit non-destructive declaration.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a one-line purpose, a process overview, a parameter list with explanations, and a return value summary. Every sentence is informative and efficiently written without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no annotations, and an output schema exists, the description covers purpose, process, parameter semantics, and return format adequately. It provides sufficient context for an AI agent to understand and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description compensates fully with clear explanations for all five parameters: lookback_minutes, search_term, event_limit, mass_threshold, max_incidents. Each has a concise purpose and default value stated, adding significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool detects mass log incidents using signature clustering with the Stormbreaker engine, distinguishing it from siblings like query_events (raw events) and list_dashboards (dashboards). It specifies the verb 'detect' and the resource 'incidents' with a clear methodology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for detecting mass incidents via parameters like lookback_minutes, search_term, and mass_threshold. It does not explicitly state when to avoid using it or mention alternatives among siblings, but the specialized intent is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_vrops_resourcesA
Find resources in VMware Aria Operations (vROps) by name.
Useful for correlating Log Insight events with vROps monitored entities. Requires VROPS_BASE_URL to be configured.
Args: name: Resource name to search for (VM name, host name, etc.).
Returns: JSON array of matching vROps resources with IDs, names, and types.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description carries burden. Discloses return format (JSON array with IDs, names, types) and prerequisite. Could mention case sensitivity or partial match behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise with 5 sentences including Args and Returns. Well-structured and free of fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with one parameter and output schema, description covers purpose, prerequisite, parameter, and return. Complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description adds meaning: 'Resource name to search for (VM name, host name, etc.)'. Compensates effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'find' and resource 'resources in VMware Aria Operations by name.' Distinguishes from siblings like get_vrops_alerts and query_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a specific use case (correlating Log Insight events) and a prerequisite (VROPS_BASE_URL). Does not explicitly mention when to avoid use or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_versionA
Get VMware Aria Operations for Logs appliance version and API surface.
Returns version info and probes key API endpoints to determine which features are available on this deployment.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full burden. It mentions probing key API endpoints but does not detail which endpoints or specify side effects (e.g., read-only). The description is adequate but lacks some behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. The description is front-loaded with the main purpose and efficiently adds detail about probing endpoints.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with no parameters, and an output schema exists. The description covers the key aspects (version and feature probing), so it is complete for this context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so schema coverage is 100% by default. The description adds value by explaining that the tool returns version info and probes endpoints for feature detection, beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'VMware Aria Operations for Logs appliance version and API surface'. It distinguishes from sibling tools like detect_incidents or query_events, which focus on different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (to obtain version and feature availability). No explicit exclusions or alternatives are stated, but with no similar sibling tools, the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_vrops_alertsB
Get alerts from VMware Aria Operations for specific resources.
Args: resource_ids: Comma-separated vROps resource IDs.
Returns: JSON array of alerts with severity, status, and descriptions.
| Name | Required | Description | Default |
|---|---|---|---|
| resource_ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must disclose behavior. It mentions return format but fails to state that the operation is read-only, nor does it discuss authentication, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct and structured with Args and Returns sections, making it easy to scan. However, it could be more front-loaded with the key purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple retrieval tool with an output schema, but it lacks usage context, behavioral details, and differentiation from siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant value by specifying that resource_ids are comma-separated vROps resource IDs, which is not in the schema. This compensates for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets alerts for specific resources using resource IDs. While it differentiates from siblings by focusing on alerts, it does not explicitly contrast with detect_incidents or query_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No prerequisites, conditions, or exclusions are mentioned, leaving the agent without context for proper selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dashboardsA
List saved dashboards from Aria Operations for Logs.
Uses the legacy vRLIC API (/vrlic/api/v1/content/dashboards).
This endpoint was deprecated in Aria Operations for Logs 8.18+
and will return an empty result on newer appliances.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool uses a deprecated legacy API and will return empty results on newer systems, which is important behavioral context for the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no fluff. The first sentence states the purpose, and the subsequent sentences provide critical caveats. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and an output schema, the description is fairly complete. It identifies the tool's purpose and its limitation (empty on new appliances). Could mention the return type, but output schema covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and schema coverage is 100%. The description adds no parameter information, which is acceptable because none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List saved dashboards from Aria Operations for Logs', specifying the verb and resource. It does not explicitly differentiate from sibling tools, but the action is distinct from detect_incidents, query_events, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the legacy API and deprecation, warning that it returns empty on newer appliances. This provides some usage context but lacks explicit alternatives or when-not-to-use guidance compared to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_eventsA
Search log events in VMware Aria Operations for Logs.
Args: lookback_minutes: How far back to search (default 60 minutes). search_term: Free-text search term (optional). limit: Maximum number of events to return (default 100, max 10000). field_name: Optional field constraint name (e.g. 'hostname', 'appname'). field_operator: Constraint operator (CONTAINS, NOT_CONTAINS, HAS, etc.). field_value: Constraint value.
Returns: JSON array of log events with text, source, timestamp, and fields.
| Name | Required | Description | Default |
|---|---|---|---|
| lookback_minutes | No | ||
| search_term | No | ||
| limit | No | ||
| field_name | No | ||
| field_operator | No | CONTAINS | |
| field_value | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It mentions the return format and default values but does not explicitly state that this is a read-only, non-destructive operation. The agent must infer that from the verb 'search' and the return of log events.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with a clear title, an Args block with parameter descriptions, and a Returns section. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no annotations, but with an output schema), the description covers the main aspects: input parameters with defaults and return format. It could mention that search_term is optional and the relationship between field_name, field_operator, and field_value, but it's largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema by explaining each parameter's purpose and constraints (e.g., 'limit: default 100, max 10000'). However, it does not list the accepted values for field_operator (e.g., CONTAINS, NOT_CONTAINS), which would enhance clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Search' and resource 'log events' with a specific scope 'in VMware Aria Operations for Logs'. This distinguishes it from sibling tools like detect_incidents or get_vrops_alerts, which deal with different resource types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description does not mention when not to use it or provide any context about preferred usage scenarios relative to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.1.0- First observed
detect_incidents - First observed
find_vrops_resources - First observed
get_version - First observed
get_vrops_alerts - First observed
list_dashboards - First observed
query_events
TDQS
Each tool has a clearly distinct purpose: incident detection, resource lookup, version info, alerts, dashboards, and log queries. No overlapping functionality.
All tool names follow a consistent verb_noun pattern in snake_case, e.g., detect_incidents, find_vrops_resources, query_events.
6 tools is well-scoped for a log management server, covering core log analysis and cross-product integration without being too sparse or bloated.
Essential log query and incident detection are present, but missing CRUD for dashboards and incident management, leaving notable gaps in the tool surface.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
- AgentCatOAuthcom.agentcat
Analytics and debugging for your MCP server — explore usage and sessions, then root-cause errors.
- mttrlyOAuthcom.mttrly
AI-powered incident management and server monitoring via MCP.
Syslog receiver and MCP server for homelab log intelligence.
Related MCP Servers
- AlicenseBqualityFmaintenanceAn MCP server for searching and visualizing SolarWinds Observability logs, allowing users to query log data with filtering options and generate visual representations of log events over time.21,4226MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server for intelligent log analysis providing semantic search, error pattern clustering, and smart error detection. It enables users to process, vectorize, and query local logs to efficiently identify issues and generate AI-powered summaries.MIT
- FlicenseBqualityBmaintenanceMCP server that integrates with Sumo Logic's API to perform log searches, data discovery, metrics queries, and monitoring.156-
- FlicenseNot gradedqualityDmaintenanceA server that bridges MCP-compatible clients to VMware Log Insight, enabling natural-language log querying and analysis.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/apollion69/vmware-aria-logs'
If you have feedback or need assistance with the MCP directory API, please join our Discord server