Skip to main content
Glama
abuzo

victorialogs-mcp

by abuzo

victoria-logs-mcp

Read-only VictoriaLogs MCP server for AI log investigation over stdio. Built with TypeScript, the official MCP SDK, Zod and undici.

Requires Node.js >=22.12 and a reachable VictoriaLogs query endpoint. Package: @alexbuzo/victoria-logs-mcp. Executable: victorialogs-mcp.

Run from source

git clone https://github.com/abuzo/victoria-logs-mcp.git
cd victoria-logs-mcp
npm ci
npm test
node dist/cli.js --victorialogs-url http://localhost:9428

The process waits for MCP JSON-RPC on stdin. To see options, use --help. Configuration can come from CLI flags, environment variables or a local .env (see .env.example). CLI flags override environment settings.

VICTORIALOGS_URL=https://logs.example.com \
VICTORIALOGS_TOKEN=your-bearer-token \
node dist/cli.js

For Basic auth, use VICTORIALOGS_USERNAME and VICTORIALOGS_PASSWORD instead of the token. Anonymous access is supported. Authentication normally belongs to your vmauth/reverse proxy configuration. AccountID/ProjectID are VictoriaLogs storage tenants; the normalized tenant_id log field is unrelated.

Related MCP server: Elastic MCP Server

Connect an MCP client

After the first npm release, use this configuration for Cursor or other clients accepting mcpServers JSON:

{
  "mcpServers": {
    "victorialogs": {
      "command": "npx",
      "args": ["-y", "@alexbuzo/victoria-logs-mcp@0.1.0"],
      "env": {
        "VICTORIALOGS_URL": "https://logs.example.com",
        "VICTORIALOGS_TOKEN": "YOUR_BEARER_TOKEN",
        "VICTORIALOGS_ACCOUNT_ID": "0",
        "VICTORIALOGS_PROJECT_ID": "0"
      }
    }
  }
}

Replace the example connection values. For a local build before publishing, use "command": "node" and "args": ["/absolute/path/to/victoria-logs-mcp/dist/cli.js"]. For Basic auth, replace VICTORIALOGS_TOKEN with VICTORIALOGS_USERNAME and VICTORIALOGS_PASSWORD. Omit all three for anonymous access.

To install a local package without publishing:

npm pack
npm install -g ./alexbuzo-victoria-logs-mcp-0.1.0.tgz
victorialogs-mcp --url http://localhost:9428

Configuration

CLI

Environment variable

Default

--victorialogs-url / --url

VICTORIALOGS_URL

required

--token

VICTORIALOGS_TOKEN

none (Bearer auth)

--username

VICTORIALOGS_USERNAME

none (Basic auth)

--password

VICTORIALOGS_PASSWORD

none (Basic auth)

--account-id

VICTORIALOGS_ACCOUNT_ID

0

--project-id

VICTORIALOGS_PROJECT_ID

0

--ssl-verify

VICTORIALOGS_SSL_VERIFY

true

--timeout-ms

VICTORIALOGS_TIMEOUT_MS

30000

--max-response-bytes

VICTORIALOGS_MAX_RESPONSE_BYTES

8388608 (8 MiB)

--debug

VICTORIALOGS_DEBUG

false

Boolean env settings accept true or false. Basic auth requires both username and password and cannot be combined with a token. Tenant IDs are uint32 values. Use the single-node root URL or a vlselect/proxy base URL whose query routes are under /select/logsql/. Proxy prefixes such as https://host/logs are preserved. URL credentials, query strings and fragments are rejected.

TLS verification is enabled. For a private CA, use NODE_EXTRA_CA_CERTS. --ssl-verify=false applies only to this server's HTTP client. Request failures do not echo upstream response bodies or secrets. Stdout contains only MCP traffic; startup diagnostics use stderr. Requests are not retried or redirected.

Tools

All names begin with victorialogs. and use LogsQL, not Graylog Lucene or Loki LogQL. Tools are read-only; there are no ingestion, deletion or admin tools.

Common inputs:

  • rangeSec: trailing seconds, default 3600; search_uuid defaults to 86400.

  • start and end: optional paired ISO-8601 timestamps with timezone. They override rangeSec; end is exclusive. Input precision is at most milliseconds; finer fractions are rejected explicitly. Returned timestamps are UTC. Use these fixed bounds for pagination. Maximum relative window: 365 days.

  • filter: optional additional LogsQL filter, sent as extra_filters separately from the main query, so query pipelines stay intact.

Tool

Inputs in addition to time/filter

Result

search_logs

required query, limit=150 (max 500), offset=0 (max 100000)

Normalized messages, original fields, returned count

search_uuid

required uuid, limit=150

Exact ID field matches plus phrase search in _msg

search_stream

required streamId (48 hex chars), limit=150

Logs from _stream_id

list_streams

query="*", limit=100 (max 500)

data.values with stream IDs and hit counts

field_names

query="*", limit=100 (max 500)

data.values with field names/hits

field_values

required field, query="*", limit=100 (max 500)

data.values with field values/hits

hits

query="*", stepSec=60, fields=[] (up to 10), groupsLimit=20 (max 100)

data.hits with timestamps, values and totals

query_stats

required query, limit=150 (max 500), offset=0

Raw aggregation/query rows with returned count

All results include query_used, start and end. count is the number of returned rows, not a count of every matching log in storage. Discovery uses a bounded subset; stream hit counts can be zeroed by the backend when its limit is reached. Hits allows up to 10000 aligned time buckets; groupsLimit returns top groups plus an overflow group with fields: {}. Grouped series and all other responses are additionally constrained by the byte limit and request deadline. query_stats uses the JSON Lines query API, preserving arbitrary aggregation columns. It does not expose the Prometheus-compatible stats endpoints.

Examples of MCP arguments:

{"query":"level:=error AND app:=api","rangeSec":3600,"limit":100}
{"uuid":"550e8400-e29b-41d4-a716-446655440000","rangeSec":86400}
{"query":"level:=error | stats by (app) count() as errors","rangeSec":3600}
{"query":"app:=api","stepSec":60,"fields":["level"],"rangeSec":3600}

Search result example:

{
  "count": 1,
  "query_used": "level:=error",
  "start": "2026-10-19T09:00:00.000Z",
  "end": "2026-10-19T10:00:00.000Z",
  "messages": [{
    "ts": "2026-10-19T09:30:00Z",
    "message": "connection failed",
    "level": "error",
    "trace_id": "abc",
    "fields": {"_time":"2026-10-19T09:30:00Z","_msg":"connection failed","level":"error","traceId":"abc"}
  }]
}

Aliases normalize common service/container, request/trace/span, HTTP and source fields. Original fields are retained so Kubernetes/OTel or custom data is available. Tool failures return isError: true. Narrow the query or lower limit if the response exceeds the byte cap. Logs are untrusted data and can contain text resembling instructions.

Development and verification

npm ci
npm run dev -- --url http://localhost:9428
npm test
npm pack --dry-run

Tests cover HTTP encoding, tenant/auth, NDJSON, bounds, cancellation, errors, MCP discovery/calls and real subprocess stdio. A separate smoke script inserts synthetic logs, so only run it against a disposable test instance:

docker run -d --rm --name victorialogs-mcp-test \
  -p 127.0.0.1:19428:9428 victoriametrics/victoria-logs:v1.53.0
npm run build
VICTORIALOGS_SMOKE_URL=http://127.0.0.1:19428 node scripts/smoke.mjs
docker stop victorialogs-mcp-test

The smoke test checks all eight tools through stdio against real VictoriaLogs, including literal ID escaping, stream discovery, aggregation and query errors.

Design and references

The official implementation informed the API selection; no source code was copied or vendored. This project is an independent TypeScript implementation.

Publish to npm

The first release must be published by an npm account with permission to publish under the @alexbuzo scope:

npm login
npm ci
npm test
npm publish --dry-run
npm publish --access public

prepublishOnly runs the tests and prepack builds the package. The package allowlist includes compiled runtime files, TypeScript declarations, README and MIT license; tests, environment files and local configuration are excluded. Use npm's interactive authentication/OTP prompts as required by your account.

MIT © Aliaksei Buzo.

Available Tools

8 tools
victorialogs.field_namesB
Read-onlyIdempotent

Discover available log field names and hit counts. Results are bounded; use query/filter to narrow scope.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
limitNo
queryNo*
startNo
filterNo
rangeSecNo

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so safety is covered. The description adds one useful behavioral fact ('Results are bounded'), but omits the actual limits (limit default 100/max 500, rangeSec default) that matter for a discovery call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, both front-loaded and free of filler. The scope-narrowing hint is placed after the core purpose, which is appropriate ordering.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, zero-coverage tool with no output schema, the description is too thin. It never explains time-range defaults, the limit cap, or what the returned hit counts represent, leaving the agent to guess at invocation semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, so the description carries the full burden, yet it only names query/filter and alludes to bounded results. start, end, limit, and rangeSec are left completely unexplained by both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Discover available log field names and hit counts'), which clearly differs from siblings like field_values (which returns values). It stops short of naming the sibling it is not, so an agent must infer the boundary from names alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'use query/filter to narrow scope' gives a concrete narrowing hint, but there is no explicit when-to-use versus alternatives such as field_values or hits, and no exclusions. Usage is implied rather than guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.field_valuesC
Read-onlyIdempotent

Discover values and hit counts for a required field in a bounded time window.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
fieldYes
limitNo
queryNo*
startNo
filterNo
rangeSecNo

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations supply the safety profile (readOnly, idempotent, non-destructive, openWorld), so the description need not restate it. It adds the useful constraint that the field is required and the window must be bounded, but says nothing about the limit cap, default range behavior, or result ordering/pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. It is efficient, though its brevity borders on under-specification for a seven-parameter tool rather than true economy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with 0% schema description coverage, no output schema, and no help text on query/filter semantics or defaults, one sentence is not enough. An agent knows what the tool returns but not how to shape the request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 7 parameters, so the description must compensate — yet it only alludes to 'field' and the time window. The query/filter pair, the '*' default, and the 100/500 limit bounds are documented nowhere, leaving most parameters unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Discover') and resource ('values and hit counts for a required field'), which cleanly separates it from the sibling field_names tool that only lists names. It is clear what the tool returns, though it never explicitly names the alternative tools it competes with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance. 'Bounded time window' hints that a time constraint is mandatory, but the description never says when to pick field_values over search_logs, hits, or query_stats, despite seven sibling tools that overlap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.hitsB
Read-onlyIdempotent

Count logs over time with stepSec buckets (default 60s), optionally grouped by fields. groupsLimit (default 20, max 100) returns top groups plus an overflow group. Maximum 10000 time buckets; default window last hour.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
queryNo*
startNo
fieldsNo
filterNo
stepSecNo
rangeSecNo
groupsLimitNo

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent/safe, and the description adds real behavioral context: the default 60s step, the max 10000 bucket cap, the default one-hour window, groupsLimit default 20 with max 100, and the overflow-group behavior. It stops short of describing auth needs or the exact response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the core purpose and limits, with no filler. It is information-packed but readable; a slight risk of overload from stacking bucket limits and group limits in one sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description partially compensates by explaining bucket counts, top groups, and the overflow group. Still, for an 8-parameter aggregation tool with 0% schema coverage and no output schema, the query/filter syntax and time-range parameters are meaningfully under-explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description must carry the load. It explains stepSec, groupsLimit, fields-based grouping, and the default window, but start, end, query, and filter (the actual log-selection inputs) are undocumented in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Count logs over time') plus the bucketing mechanism, which is clearly distinct from raw-log search. However, it never names or contrasts with siblings like search_logs or query_stats, so an agent must infer the distinction from the aggregation semantics alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description describes what the tool produces but gives no explicit when-to-use guidance, no conditions under which to prefer this over search_logs or query_stats, and no note about prerequisites. Usage is only inferable from 'count ... over time'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.list_streamsA
Read-onlyIdempotent

Discover stream IDs and hits. Values are _stream_id strings usable by search_stream. A limited subset can have zeroed hit counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
limitNo
queryNo*
startNo
filterNo
rangeSecNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already disclose read-only, idempotent, open-world, and non-destructive behavior. The description adds useful behavioral context beyond annotations: the output values are stream IDs consumed by search_stream, and a limited subset may have zeroed hit counts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, moving from purpose to output/usage to caveat. Every sentence adds relevant information without repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, output identity, and a hit-count caveat, and annotations cover the safety profile. However, with no output schema and 0% parameter description coverage, it omits any explanation of the six input parameters, leaving a clear completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description says nothing about the six input parameters (limit, query, start, end, rangeSec, filter). With low coverage, the description needed to compensate but does not, leaving parameter meaning entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Discover') and resource ('stream IDs and hits') and clarifies the returned values are _stream_id strings usable by search_stream. This distinguishes it from the sibling search_stream tool without requiring the agent to open either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly implies the discovery-then-search workflow by saying the values are usable by search_stream. There is no explicit when-not guidance or mention of other alternatives such as field_names or search_logs, but the context is clear enough for an agent to route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.query_statsA
Read-onlyIdempotent

Execute a LogsQL aggregation pipeline, e.g. * | stats by (service) count() as errors. Returns original JSON rows without log normalization. Uses /select/logsql/query, not the Prometheus stats API. Default last hour, max 500 rows.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
limitNo
queryYes
startNo
filterNo
offsetNo
rangeSecNo

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/idempotent/non-destructive, so the description adds real behavioral value beyond them: it returns 'original JSON rows without log normalization', names the backing endpoint, and discloses the default window (last hour) and row cap (max 500). It doesn't cover pagination interaction with offset or truncation signaling, which would push this higher.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the core purpose and an inline example. Each sentence carries distinct information (purpose, return shape, endpoint, defaults), though the endpoint/API clarification is the least essential for invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must carry return-value context, and it does so briefly ('original JSON rows without log normalization'). Combined with the stated defaults and row cap it is reasonably complete, but the seven undocumented parameters and the missing behavior for offset-based pagination leave meaningful gaps for an aggregation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 7 parameters, so the description must compensate, and it only partially does: it confirms the 500-row limit and the one-hour default, matching the schema's limit and rangeSec defaults. It says nothing about start/end formats, offset semantics, or the relationship between the query and filter properties, leaving most parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Execute a LogsQL aggregation pipeline' with a concrete example ('* | stats by (service) count() as errors'). It also clarifies the execution path ('/select/logsql/query, not the Prometheus stats API'), which separates it from an adjacent-but-different API, though it does not name a sibling tool like search_logs or hits directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The aggregation framing implies this is for stats/summary queries rather than raw log retrieval, and the Prometheus-API note clarifies a boundary. However, it never states when to prefer this over search_logs, search_stream, or hits, nor any prerequisites for the LogsQL pipeline. Usage is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.search_logsA
Read-onlyIdempotent

Search VictoriaLogs with LogsQL. Default: last hour, 150 latest rows; max 500. Use rangeSec or paired ISO start/end (end exclusive). filter is a separate LogsQL extra_filters constraint. offset paginates the selected window; keep start/end fixed across pages.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
limitNo
queryYes
startNo
filterNo
offsetNo
rangeSecNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/openWorld, so the safety profile is covered. The description adds real behavioral context beyond that: default window of last hour, 150 rows with a 500 cap, end-exclusive time bounds, and the stability requirement for paging. It stops short of describing result shape or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense and front-loaded: query language first, then defaults, then time-window options, then filtering and pagination. Every clause carries information, though the middle-clause run-on is slightly compressed for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should sketch what search results look like (row/log shape, ordering), but it never does. Parameter and pagination behavior are well covered, so the definition is adequate but leaves the return contract implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden and largely does: it explains rangeSec vs paired ISO start/end (end exclusive), that filter is a separate LogsQL extra_filters constraint distinct from query, and how limit/offset behave. Only minor gaps remain (e.g., no explicit statement of units beyond default values).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Search') and resource ('VictoriaLogs') plus the query language ('LogsQL'), so the operation is unambiguous. It does not, however, differentiate itself from close siblings such as search_stream or search_uuid.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives practical operating guidance for pagination ('offset paginates the selected window; keep start/end fixed across pages'), which implies the intended usage pattern. It never states when to prefer this tool over siblings like search_stream, hits, or query_stats, so alternative selection is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.search_streamA
Read-onlyIdempotent

Search a VictoriaLogs stream by its 48-character hex _stream_id. Discover IDs via list_streams. Default window: last hour.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
limitNo
startNo
filterNo
rangeSecNo
streamIdYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint, so the safety profile is covered. The description adds the default time window, but that value is already the rangeSec schema default (3600), and it says nothing about pagination or the 500 limit cap. Adds marginal context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the core operation and followed by the discovery hint and default window. No filler; every sentence carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, no-output-schema tool this is thin: four of six parameters are unexplained and there is no note on what a result contains or how limit interacts with the time window. The required parameter and its discovery path are covered, which keeps it at minimum-viable rather than inadequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, so the description carries the full burden and largely fails. It restates the streamId pattern (already encoded in the schema) but never explains filter syntax, limit behavior, or the start/end vs rangeSec relationship.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search a VictoriaLogs stream') plus the key identifying field (48-character hex _stream_id), which is enough to separate it from the other search siblings. It stops short of explicitly contrasting with search_logs/search_uuid, so an agent still has to infer which search family applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real routing guidance: it names list_streams as the way to discover IDs and states the default time window. It lacks an explicit 'when not to use' (e.g. use search_logs when you don't have a stream ID), but the discovery pointer handles the main selection decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

victorialogs.search_uuidB
Read-onlyIdempotent

Find a UUID, trace, request or correlation ID across common exact-value fields plus a phrase in _msg. Default window: last day.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
uuidYes
limitNo
startNo
filterNo
rangeSecNo

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, non-destructive, so the safety profile is covered. The description adds genuinely useful behavior: the default time window (last day) and the search scope (exact-value fields + _msg phrase). It says nothing about result volume, the limit parameter, or pagination, so it stays at a moderate 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler; the search target is front-loaded ahead of the window detail. Efficient, though for a 6-parameter tool the extreme brevity borders on under-specification rather than pure conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter search tool with no output schema and 0% schema description coverage, the description is too thin: filtering, limits, and time-range parameters are undocumented and nothing is said about what a hit looks like. It does not carry the full burden left by the structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, so the description must compensate and largely does not. It hints at the uuid input and the rangeSec default ("last day") but leaves limit, filter, start, and end entirely unexplained in both schema and text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb ("Find") and a concrete resource set (UUID, trace, request, correlation ID) and explains the search surface: exact-value fields plus a phrase in _msg. An agent can tell it apart from generic siblings like search_logs, though the description never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource type (searching for an identifier) and the default window is stated, but there is no explicit when-to-use/when-not guidance and no routing to alternatives such as search_logs or search_stream. The agent must infer that this tool is for identifier lookups vs. free-text queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0
    • First observedvictorialogs.field_names
    • First observedvictorialogs.field_values
    • First observedvictorialogs.hits
    • First observedvictorialogs.list_streams
    • First observedvictorialogs.query_stats
    • First observedvictorialogs.search_logs
    • First observedvictorialogs.search_stream
    • First observedvictorialogs.search_uuid

TDQS

B3.4/5.0

Scored across 8 tools

Disambiguation4/5

The eight tools mostly target distinct outputs: raw log retrieval (search_logs), stream discovery, field discovery, value discovery, time-bucketed counts (hits), aggregation pipelines (query_stats), and a UUID lookup convenience wrapper. However, search_logs, query_stats, hits, and search_uuid all run LogsQL-style queries over logs with overlapping capability, and only the detailed descriptions keep them apart.

Naming Consistency3/5

All names share the victorialogs. prefix and snake_case, which aids readability. But the internal pattern is mixed: search_stream/search_logs/search_uuid are verb_noun, list_streams is verb_noun, field_names/field_values are noun phrases, and hits/query_stats are bare noun/verb forms, so there is no single predictable convention.

Tool Count5/5

Eight tools is well-scoped for a log-search backend, with each tool covering a distinct capability (search, discovery, aggregation, counting, ID lookup) rather than redundant variants. Nothing feels padded or missing.

Completeness4/5

The surface covers stream discovery, field/value discovery, raw search, UUID lookup, time-bucketed counting, and aggregation, which is broad lifecycle coverage for querying logs. Minor gaps exist (no explicit schema/field-type or export/tail tool), but agents can work around them via LogsQL.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    A read-only MCP server that exposes Quickwit log search and aggregations to LLM clients, enabling natural language log investigation.
    Apache 2.0
  • A
    license
    Not graded
    quality
    F
    maintenance
    A read-only MCP server for the Auralogs logging platform, enabling AI agents to query production logs, search errors, and retrieve AI analyses without write access. It allows you to ask your coding assistant 'what's broken in production right now?' by connecting to your logs via a simple bearer auth key.
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    A read-only MCP server for querying Sumo Logic logs, enabling AI assistants to search and investigate application logs with opinionated tools and secure credential handling.
    5
    11 npm
    1
    MIT