How do I use log-analyzer-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@log-analyzer-mcp Search for ERROR in /var/log/app.log" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

log-analyzer-mcp

by yufeizhou666

Overview Schema Related Servers Score Discussions

TypeScript

Local

log-analyzer-mcp

An MCP (Model Context Protocol) server that provides log analysis and system metrics tools. Connects to Claude Code via stdio transport and exposes 5 tools for searching, counting, and analyzing local log files.

Features

Tool	Description
`search_logs`	Search log files by keywords or regex patterns
`count_by_level`	Count log entries by severity level (ERROR/WARN/INFO/DEBUG)
`query_by_timerange`	Filter logs within a specific time range
`get_system_metrics`	Get CPU, memory, and disk usage metrics
`explain_error`	Format error content for AI-assisted analysis

Related MCP server: ai-ssh-mcp

Quick Start

# Install dependencies
npm install

# Build TypeScript
npm run build

# Run the server
npm start

Development

# Run with hot reload
npm run dev

Integration with Claude Code

Add the server to Claude Code:

# Project-level (only available in this directory)
claude mcp add log-analyzer -- node /path/to/log-analyzer-mcp/dist/index.js

# User-level (available globally)
claude mcp add log-analyzer --scope user -- node /path/to/log-analyzer-mcp/dist/index.js

Verify the connection:

claude mcp list

Tool Details

search_logs

Search log files by keywords or regex. Supports searching a single .log file or an entire directory.

{
  "keywords": ["ERROR", "timeout"],
  "regex": "connection.*failed",
  "logPath": "/var/log",
  "limit": 100
}

count_by_level

Count log entries by severity level, optionally filtered by time range.

{
  "logPath": "/var/log",
  "startTime": "2026-04-29T00:00:00Z",
  "endTime": "2026-04-30T00:00:00Z"
}

query_by_timerange

Filter logs within a specific time range, with optional level filter.

{
  "startTime": "2026-04-29T00:00:00Z",
  "endTime": "2026-04-30T00:00:00Z",
  "logPath": "/var/log",
  "level": "ERROR",
  "limit": 100
}

get_system_metrics

Get CPU, memory, and disk metrics. Supports Windows and Linux.

{
  "metrics": ["cpu", "memory", "disk"]
}

explain_error

Format error content for AI-assisted root cause analysis.

{
  "errorContent": "java.lang.NullPointerException\n  at com.example.Service.process(Service.java:42)",
  "contextLines": 10
}

Architecture

src/
├── index.ts           # MCP Server entry point
├── tools/             # Individual MCP tool implementations
├── utils/
│   ├── log_parser.ts  # Timestamp/level parsing, keyword/regex matching
│   └── metrics.ts     # Cross-platform CPU/memory/disk metrics
└── types/             # TypeScript type definitions

The server uses @modelcontextprotocol/sdk with StdioServerTransport. Tools are registered via CallToolRequestSchema handler.

Key Design Decisions

Stream processing: Uses readline + createReadStream to handle large log files without loading them entirely into memory
Cross-platform: Windows (WMIC) and Linux (top/free/df) dual-path implementation with runtime platform detection
Tolerant parsing: Non-standard log formats are preserved rather than dropped (missing levels default to INFO, missing timestamps default to current time)

License

MIT

Available Tools

5 tools

count_by_levelB

Count log entries by severity level (ERROR, WARN, INFO, DEBUG)

ParametersJSON Schema

Name	Required	Description	Default
`logPath`	No	Path to log file or directory	/var/log
`startTime`	No	Start time in ISO8601 format
`endTime`	No	End time in ISO8601 format

TDQS

B3.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully disclose behavior. It only states the counting operation but omits details such as read-only nature, error handling for missing paths, or output format. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with action and levels. No wasted words. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has 3 parameters, no output schema, and no annotations. Description is too brief; does not explain output format, behavior with directories vs files, or case sensitivity of levels. Incomplete for a tool aggregating log data by severity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no extra meaning beyond the schema; it does not explain how parameters like startTime/endTime relate to the counting logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'Count', the resource 'log entries', and the grouping 'by severity level' with explicit levels. It distinguishes from siblings like search_logs and query_by_timerange which do different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for counting log entries by level but does not explicitly state when to use this over alternatives like search_logs or query_by_timerange. No prerequisites or exclusions provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_errorC

AI-assisted error analysis. Formats error content for AI analysis.

ParametersJSON Schema

Name	Required	Description	Default
`errorContent`	Yes	The error log or stack trace to analyze
`contextLines`	No	Number of context lines around the error

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It implies a read-only analysis but does not explicitly state whether the tool modifies data, requires authentication, or has rate limits. The phrase 'formats error content' suggests it is non-destructive, but this is not confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, efficient for a simple tool. However, the second sentence ('Formats error content for AI analysis') is somewhat redundant with the first, and the title is null so the description stands alone.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 params and no output schema, the description is adequate but does not describe the output format. Given sibling tools (search_logs, count_by_level), it fits well but could mention that the result is formatted text for consumption by an AI.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with both parameters documented. The description adds no new meaning beyond what the schema provides; it merely repeats 'error log or stack trace' and 'number of context lines'. Baseline 3 applies due to high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it does AI-assisted error analysis and formats error content for AI analysis. It specifies the verb 'analyze' and resource 'error content'. However, it does not explicitly differentiate from siblings like search_logs which might also process errors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like search_logs or get_system_metrics. It lacks prerequisites, when-not-to-use scenarios, or context for invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_system_metricsB

Get CPU, memory, and disk metrics from the system

ParametersJSON Schema

Name	Required	Description	Default
`metrics`	No	Which metrics to retrieve: cpu, memory, disk

TDQS

B3.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It only states the action without disclosing side effects, permissions, or potential limitations (e.g., read-only, resource cost).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that conveys the tool's purpose efficiently with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description fails to explain return format, data granularity, or operational context (e.g., whether metrics are real-time or cached). It leaves significant gaps for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single parameter 'metrics', which already defines its meaning. The tool description adds no extra semantic value beyond identifying the metrics types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'CPU, memory, and disk metrics from the system'. It directly distinguishes from sibling tools like 'search_logs' or 'count_by_level', which handle different data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving system metrics, but no explicit guidance on when to use it versus alternatives or exclusions. Siblings are distinct, so the context is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_by_timerangeC

Query logs within a specific time range

ParametersJSON Schema

Name	Required	Description	Default
`startTime`	Yes	Start time in ISO8601 format
`endTime`	Yes	End time in ISO8601 format
`logPath`	No	Path to log file or directory	/var/log
`level`	No	Filter by log level
`limit`	No	Maximum number of results

TDQS

C2.8/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It only states the basic operation without revealing any behavioral traits (e.g., read-only, performance, pagination, or effects). This is insufficient for an agent to understand the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short (6 words), which is concise but at the expense of completeness. It leaves out essential information for an agent to use it effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, so the description should explain return values, but it does not. The tool has 5 parameters and no annotations, yet the description covers only the basic purpose, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The tool description adds minimal meaning beyond the schema (only reiterating the time range). It does not compensate for any missing parameter context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Query', resource 'logs', and constraint 'within a specific time range'. It provides a specific purpose but does not distinguish from sibling tool 'search_logs' which may have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'search_logs' or 'count_by_level'. The description lacks context for appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_logsA

Search log files by keywords or regex patterns. Returns matching log entries with timestamps.

ParametersJSON Schema

Name	Required	Description	Default
`keywords`	No	Keywords to search for in log files
`regex`	No	Regular expression pattern to match
`logPath`	No	Path to log file or directory	/var/log
`limit`	No	Maximum number of results

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It states the tool returns matching log entries with timestamps, which is helpful, but omits details like case sensitivity, regex+keyword interaction, and pagination. Basic coverage but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. First sentence states action and method, second states output. Front-loaded, every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters and no output schema, the description covers core functionality but lacks details on parameter interplay (e.g., can keywords and regex be used together?) and default behavior of logPath and limit. Adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 4 parameters. The tool description adds minimal extra meaning beyond restating search mechanisms and output; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches log files using keywords or regex patterns, and returns matching entries with timestamps. This verb+resource specificity distinguishes it from siblings like count_by_level and explain_error.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description does not mention when to prefer search_logs over count_by_level, explain_error, or query_by_timerange, leaving the agent without comparative context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.4/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: counting by level, error explanation, system metrics, time-range queries, and keyword search. No overlap in functionality.

Naming Consistency4/5

Names follow a verb-oriented pattern (count, explain, get, query, search) but mix styles: some use 'by_' (count_by_level, query_by_timerange) while others are plain verb_noun (explain_error, get_system_metrics, search_logs). Mostly consistent but with minor deviations.

Tool Count5/5

5 tools is well-scoped for a log analysis server, covering essential operations without being too few or excessive.

Completeness4/5

Core log analysis tasks are covered: search, count by level, time-range queries, error explanation, and system metrics. Minor gaps exist, such as lacking a tool to list log sources or aggregate statistics beyond level counting.

Maintenance

ActivityInactive

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Foam Observability
io.github.foam-ai
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Observability Monitoring Developer Tools
2
Superlog
sh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Monitoring Observability
21,039
mcp A
com.googleapis.compute
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
Cloud Platforms Networking & Infrastructure OS Automation
292
AgentSEO B
dev.agentseo.www
Live SEO workflow tools for Claude Code, Codex, and AI agents.
Marketing Browser Automation
454

Related MCP Servers

Aliyun MCP Server
Cloud Platforms Search RAG Systems
nailuoGG
F
license
B
quality
C
maintenance
A Claude integration tool that enables users to query and analyze Aliyun (Alibaba Cloud) Simple Log Service logs through natural language commands.
Updated a year ago (2025-03-26 06:13 UTC)
1
26
2
ai-ssh-mcp
Shell Access Command Line
guozhiwei01
A
license
A
quality
D
maintenance
Enables natural language SSH server management via Claude Code, allowing users to read logs, check services, run commands, and transfer files across multiple servers.
Updated 5 months ago (2026-03-27 06:37 UTC)
6
MIT
mcp-system-monitor
Monitoring Observability
VZilvinskus
F
license
A
quality
D
maintenance
Enables Claude to monitor CPU, memory, disk, processes, network connections, Docker containers, and system logs for system diagnostics and troubleshooting.
Updated 5 months ago (2026-04-03 20:14 UTC)
5
mcp-it-ops
Monitoring Observability
bastiaan365
F
license
A
quality
D
maintenance
Exposes homelab and IT-ops tools to Claude, including system health monitoring, Grafana alert states, Docker container status, Loki logs, SMART disk health, and more.
Updated 4 months ago (2026-04-19 15:04 UTC)
8
1

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/yufeizhou666/my_mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server