Yokozuna MCP gives coding agents programmatic access to Sumo Logic logs for searching, triaging, monitoring, and schema analysis — without leaving the editor.

Core Search

• Run searches (sumo_run_search): Execute Sumo Logic queries in one call with support for relative or absolute time ranges, output verbosity levels (summary, compact, full, raw), field projection, deduplication, and JSON extraction.

• Bulk export (sumo_export_results): Stream up to 100,000 results to an NDJSON file on disk.

• Low-level search job primitives: Manually create, poll status, page messages/records, and delete search jobs for fine-grained control.

Triage & Diagnostics

• Error digest (sumo_error_digest): Auto-detects severity signals, deduplicates errors by normalized signature, and returns top problems with counts, timestamps, and sample request IDs.

• Trend analysis (sumo_trend): Bucket logs over time with timeslice sparklines, split by auto-detected severity or a custom dimension.

• Poll for new logs (sumo_new_since): Stateless cursor-based polling for logs arriving by receipt time, ideal for continuous monitoring loops.

Schema & Discovery

• Facet exploration (sumo_facets): See log data distribution via ranked top-N counts across multiple dimensions (native Sumo fields or JSON paths).

• Deep schema learning (sumo_describe_schema): Stratified-samples a scope to enumerate JSON keys with fill percentages and inferred types, and proposes paste-ready severity filter fragments.

Alerting & Monitoring

• List monitors (sumo_list_monitors): Discover Sumo Logic Monitors with name, folder, type, enabled status, current state, and notification destinations.

• List fired alerts (sumo_list_alerts): Query fired-alert history from the System Event Index, correlating fire and resolve events with monitor join keys.

Configuration: Credentials and deployment region are set via environment variables (SUMO_ACCESS_ID, SUMO_ACCESS_KEY, SUMO_DEPLOYMENT).

Provides tools for searching, querying, and managing Sumo Logic logs via the Search Job API, enabling incident triage and log analysis directly from the editor.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@yokozuna-mcp search for errors in production logs from the last hour"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.