A
licenseA
qualityD
maintenanceEnables searching and analyzing AWS CloudWatch logs with support for configurable log groups, time-based searches, and service-specific log stream filtering.
5
MIT
mcp-syslog
by crunchtools
This server exposes six MCP tools for querying a fleet-wide syslog collection, letting an agent inspect logs, correlate events, and triage incidents without reading raw files.
syslog_sources_tool – List available log sources (optionally filtered by substring), including size and last-write time; can include the collector's internal stats.
syslog_search_tool – Search logs by source, time window, severity, program, and regex pattern; supports relative or ISO timestamps and caps results.
syslog_grep_tool – Regex search across the whole fleet or one source, with optional severity filter and time window.
syslog_tail_tool – Get the most recent entries for a specific source, optionally filtered by severity.
syslog_context_tool – Show log entries surrounding a specific moment (before/after seconds), optionally across all sources to correlate failures with other events.
syslog_stats_tool – Summarize log volume and error rate per source, ranked by volume, optionally restricted to one source or a time window.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-syslogsearch the api service for errors in the last 15 minutes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-syslog-crunchtools
MCP server for the logs collected by crunchtools/syslog.
Built for RT #1460, to close a specific gap: Hermes gets paged by Nagios and can restart a service, but it cannot read the service's logs — so every remediation is a blind restart. This turns that into an informed one.
Capabilities
Tool | What it answers |
| What can I query? |
| Show me ERRs from this service in the last 15 minutes |
| Where does this string appear across the whole fleet? |
| What are this service's most recent lines? |
| What was everything saying around 03:14? |
| Which service is loudest, and which is actually unhealthy? |
Related MCP server: Log Analyzer MCP Server
The triage loop
nagios_current_problems_tool → what is broken
syslog_search_tool(source=…, → why it broke
severity="ERR",
since="15m")
syslog_context_tool(timestamp=…) → what else was happening at that moment
nagios_schedule_check_tool → confirm the fixsyslog_context_tool without a source is the one that earns its keep. It spans
every source at once, which is how "the app died" gets connected to "the database
container OOMed four seconds earlier".
Design notes
Every result is bounded, and says when it is. Logs are unbounded and this output lands in a model's context window. Each tool caps its results, caps how many lines it will scan, and annotates the answer when either limit is hit:
[!] Stopped after the 2,000,000-line scan limit, so this result is INCOMPLETE
and an empty or short result does not mean nothing happened.That annotation is load-bearing. A caller that cannot distinguish "no errors occurred" from "I stopped looking" will draw the wrong conclusion from an empty result — and this server exists to inform remediation decisions.
Time filtering is cheap. The collector puts the date in the filename, so a ten-minute query opens one file rather than reading ninety days of history.
Source names are untrusted. They come from a model and are used to build a
filesystem path. Each is resolved and then confirmed to still be inside the log
root, which catches traversal, absolute paths, and symlinks pointing out of the
tree — see tests/test_security.py.
Severity is "at least this severe". severity="ERR" returns ERR, CRIT, ALERT
and EMERG. An unrecognised severity is kept rather than dropped, on the grounds
that hiding a line you do not understand is worse than showing it — but it is
not counted as an error in syslog_stats_tool, or a healthy service would
report a 57% error rate.
Severity is not badness. Podman records anything a container writes to stderr
at priority err, and plenty of services log routine INFO there. One chatty
httpx-based service in this fleet sits around 65% "ERR" while being entirely
healthy:
PRIORITY=3 | 2026-08-23 15:55:24 INFO httpx: HTTP Request: GET https://... "200 OK"The collector is reporting the journal faithfully; the journal is reporting the file descriptor. Read the message, and prefer a change in error rate to its absolute value. This caveat is in the server's MCP instructions too, so an agent querying it is told the same thing.
Two line formats are parsed. The collector emitted five fields before 2026-08-23 and six after, and the old lines stay in retention for 90 days. Which layout a line uses is decided by where a real severity sits, not by counting fields.
Log format
The collector writes six space-delimited fields:
2026-08-23T15:41:52+00:00 crunchtools.com crunchtools.com httpd ERR AH00169: caught SIGTERM
└─ timestamp ───────────┘ └─ host ──────┘ └─ source ────┘ └prog┘ └sev┘ └─ message ────────┘source is the log stream — normally a container name. program is the process
inside it, which matters for systemd containers where httpd, php-fpm and
mariadb all file under one service name.
Configuration
Variable | Default | Purpose |
|
| Collector log root, mounted read-only |
|
| Cap on entries returned per call |
|
| Cap on lines examined per call |
No credentials — the server reads files off a read-only bind mount.
Running
podman run -d --name mcp-syslog \
--network crunchtools \
-p 127.0.0.1:8027:8027 \
-v /path/to/syslog/data/logs:/logs:ro \
quay.io/crunchtools/mcp-syslog:latest \
--transport streamable-http --host 0.0.0.0 --port 8027Mount :ro. This server never needs to write, and a read-only mount means a bug
here cannot destroy the forensic record it exists to protect.
Development
uv sync
uv run ruff check src tests
uv run mypy src
uv run pytest -vAvailable Tools
6 toolssyslog_context_toolSyslog Context ToolARead-only
Return log entries surrounding a specific moment.
Use this after an alert names a time. Omitting source spans the whole fleet, which is how a failure gets correlated with whatever else was happening.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum entries to return. | |
| source | No | Restrict to one source. Omit to span all sources. | |
| severity | No | Optional minimum severity. | |
| timestamp | Yes | The moment of interest — ISO-8601, or relative like '30m' ago. | |
| after_seconds | No | How far forward from the timestamp to include. | |
| before_seconds | No | How far back from the timestamp to include. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint already covers the safety profile, so the description is credited for the extra context it adds: that omitting source spans the whole fleet and that this is the correlation mechanism for failures. It does not mention result volume, ordering, or limits of the fleet-wide scan, so it is not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler; the core action comes first and the usage cue follows immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full parameter documentation, the description only needs the invocation context it provides. The remaining gap is what a fleet-wide query returns in practice (volume, ordering), which matters given the default window behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter including the before/after window is already documented. The description only reinforces the source-omission behavior rather than adding new syntax or format guidance, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with scope: 'Return log entries surrounding a specific moment.' It is distinguishable from search/grep/tail siblings by the 'surrounding' framing, though it never names those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this after an alert names a time' gives a clear triggering condition, and the note on omitting source clarifies a common usage decision. No explicit when-not or sibling routing, so it stops short of 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syslog_grep_toolSyslog Grep ToolARead-only
Regex search across all sources, or within one named source.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum entries to return. | |
| since | No | How far back to search — relative ('15m', '2h', '3d') or ISO-8601. | 24h |
| source | No | Restrict to one source. Omit to search the whole fleet. | |
| pattern | Yes | Case-insensitive regular expression matched against the message. | |
| severity | No | Optional minimum severity. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A3.5/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read operation, and the description adds that searches default to all sources unless one source is named. It still omits useful behavioral context such as the default 24h window and the effect of limit/severity filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is as concise as possible while still naming the core operation and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The rich schema and output schema make invocation details available, and readOnlyHint covers safety. Completeness is only adequate because the description does not clarify the tool's niche against closely related siblings like syslog_search_tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters and defaults are already documented in the schema. The description only reinforces the pattern/source semantics and adds no syntax, formatting, or edge-case detail beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (regex search) and its scope (all sources or one named source), so the operation is understandable. However, it does not distinguish this tool from the sibling syslog_search_tool, leaving an obvious overlap unresolved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The source-scope phrasing implies this is for fleet-wide or single-source regex lookup, but there is no explicit guidance on when to prefer it over syslog_search_tool, syslog_tail_tool, or syslog_context_tool. No exclusions or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syslog_search_toolSyslog Search ToolCRead-only
Search collected logs by source, time window, severity and pattern.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum entries to return. | |
| since | No | Start of the window — relative ('15m', '2h', '3d') or ISO-8601. | 1h |
| until | No | End of the window. Omit for "up to now". | |
| source | No | Container or service name. Omit to search every source. | |
| pattern | No | Optional case-insensitive regular expression matched against the message. | |
| program | No | Restrict to one program within the source (e.g. 'httpd' inside a web container). | |
| severity | No | Minimum severity: EMERG, ALERT, CRIT, ERR, WARNING, NOTICE, INFO, DEBUG. 'ERR' returns ERR and anything more severe. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
C2.9/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already tells the agent this is a safe read, so the description's bar is lower, but it adds essentially no behavioral context beyond the title. It says nothing about result ordering, pagination/limit behavior, truncation, or what happens when no logs match.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the filtering dimensions come first. It is efficient but so terse that it leaves no room for the routing guidance a multi-sibling tool needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and all 7 parameters are fully documented in the schema. What is missing is the practical context an agent needs: which sibling to use, whether results are sorted, and whether the limit has a default cap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so defaults, relative time syntax, severity ordering, and regex semantics are all already documented in the schema. The description only lists which dimensions exist, adding nothing beyond the schema fields; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Search') and resource ('collected logs') and enumerates the four primary narrowing dimensions. It does not differentiate from the closely related siblings syslog_grep_tool or syslog_context_tool, which an agent would need in order to choose correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to prefer this over syslog_grep_tool, syslog_tail_tool, or syslog_context_tool, even though grep clearly overlaps with the pattern parameter. Usage is only inferred from the tool name and the word 'search'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syslog_sources_toolSyslog Sources ToolARead-only
List log sources available to query, with size and last-write time.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Optional case-insensitive substring to filter source names. | |
| include_internal | No | Include the collector's own '_collector' statistics. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A3.5/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already declares this is a safe read, so the bar is lower. The description adds no behavior beyond annotations and the output schema — no ordering of results, no note on what 'size' or 'last-write' represent, no mention of whether internal sources are excluded by default.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Appropriately sized, though it is terse enough that useful structure (usage context, sibling contrast) is absent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and parameters are fully documented in the schema. For a simple read-only listing tool the description is adequate, with only sibling routing left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both 'pattern' and 'include_internal' fully documented in the schema, so baseline is 3. The description adds nothing about filtering or the internal-source toggle beyond what the schema already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List log sources available to query') plus the returned attributes (size, last-write time). It never names or contrasts with siblings like syslog_search_tool or syslog_stats_tool, so differentiation relies on the agent inferring it from names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Available to query' hints that this is a discovery step before searching, but there is no explicit when-to-use, when-not-to-use, or pointer to alternatives such as syslog_stats_tool. Guidance is implied only.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syslog_stats_toolSyslog Stats ToolBRead-only
Summarise log volume and error rate per source.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | How many sources to list, ranked by volume. | |
| since | No | Window to summarise — relative ('1h', '24h') or ISO-8601. | 1h |
| source | No | Restrict to one source. Omit to cover every source. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
B3.3/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered by structured data. The description adds that results are broken down per source with an error rate, but says nothing about cost, limits, or how 'error rate' is computed — acceptable but thin given the annotations do most of the work.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. Nothing in it fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema and full parameter documentation exist, so return values and inputs are covered elsewhere. What the description omits is the routing information an agent needs to choose this aggregation tool over its five siblings — the only substantive gap for a zero-required-parameter read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter (top, since, source) is documented with defaults and formats, so the description need not repeat them. It adds no meaning beyond the schema, which is exactly the baseline case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Summarise') and a specific resource ('log volume and error rate per source'), so the agent knows it produces an aggregate statistical view rather than raw entries. It does not, however, contrast itself with siblings such as syslog_sources_tool, which also deals with sources and could be mistaken for this aggregation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to reach for this tool versus syslog_search_tool, syslog_grep_tool or syslog_sources_tool, and no mention of preconditions or typical follow-up. Usage is only inferable from the word 'Summarise'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syslog_tail_toolSyslog Tail ToolBRead-only
Return the most recent entries for one source.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Number of entries to return. | |
| source | Yes | Container or service name. | |
| severity | No | Optional minimum severity. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
B3.2/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the description's main added value is the behavioral frame 'most recent entries' and the single-source scoping. It says nothing about ordering, whether severity filtering affects recency selection, or truncation behavior, but with annotations plus an output schema the bar is lower.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, exactly the right shape for a simple read tool. It is arguably undersized for the routing decision, but the sentence itself earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema coverage, annotations, and an output schema, the description needn't explain parameters or return shape. However, for a tool sitting among five syslog siblings, the absence of any routing guidance leaves a real gap an agent must close by guessing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so limit, source, and severity are already documented in the schema, which sets the baseline at 3. The description only echoes two of them ('most recent' implies limit, 'one source' restates source) without adding format or interaction semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return the most recent entries') scoped to 'one source', which distinguishes it implicitly from query-based siblings like syslog_search_tool and syslog_grep_tool. It never names those siblings, so the differentiation is left to inference rather than made explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use or when-not-to-use guidance and names none of the five sibling tools (search, grep, context, stats, sources). An agent must guess that 'tail' means 'show latest logs for a known source' versus searching across sources.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
syslog_context_tool - First observed
syslog_grep_tool - First observed
syslog_search_tool - First observed
syslog_sources_tool - First observed
syslog_stats_tool - First observed
syslog_tail_tool
TDQS
A3.5/5.0
Scored across 6 tools
Disambiguation4/5
Each tool targets a distinct query mode: listing sources, filtered search, regex grep, tailing, contextual windows, and stats. The main overlap is between syslog_search_tool (severity/pattern) and syslog_grep_tool (regex), which an agent could confuse, but the descriptions draw a reasonable line between structured filtering and regex matching.
Naming Consistency4/5
All tools follow a clear syslog_<action>_tool pattern, which is highly predictable. The action terms mix nouns (sources, stats) and verbs (search, grep, tail), a minor inconsistency within an otherwise uniform convention.
Tool Count5/5
Six tools is well-scoped for a log query server, with each tool covering a genuinely distinct access pattern (discovery, search, grep, tail, context, stats). No tool feels redundant or vestigial.
Completeness4/5
The read-only query lifecycle is well covered: discovery, filtering, regex, recency, surrounding context, and aggregate stats. Minor gaps exist around schema/field discovery or export, but core investigative workflows are fully supported without dead ends.
Maintenance
ActivityActive
ResponsivenessUnresponsive
Related MCP Connectors
Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
Search log events, investigate anomalies, and manage cases in your Knowledge Grid tenant.
- SuperlogOAuthsh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables querying and analyzing logs from multiple remote Unix hosts via the Log Collector API, with tools for search, error detection, and summary generation.-
- FlicenseNot gradedqualityBmaintenanceProvides telemetry tools for retrieving recent logs and system metrics to support root-cause analysis of infrastructure incidents. Enables autonomous incident triage with grounded verification and human-in-the-loop remediation.1-
- AlicenseAqualityCmaintenanceEnables debugging of distributed transactions by continuously ingesting Docker container logs, indexing them by trace/request ID, and exposing MCP tools to search, tail, and correlate logs across services.7ISC