Skip to main content
Glama
fedora-copr

Log Detective MCP

Official
by fedora-copr
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Log Detective MCP

MCP server implementing core log analysis tools of Log Detective for use by other agents.

The server uses the Drain3 algorithm to cluster log messages into templates and extract a representative subset of snippets, reducing large logs to a manageable size for downstream analysis.

Installation

Requires Python 3.11+.

pip install .

Or with uv:

uv pip install .

Related MCP server: log-essence

Usage

Running the server

logdetective-mcp

Or directly:

python -m logdetective_mcp.main

MCP client configuration

Claude Code

claude mcp add logdetective -- logdetective-mcp

Claude Desktop

Add to your Claude Desktop configuration file:

{
  "mcpServers": {
    "logdetective": {
      "command": "logdetective-mcp"
    }
  }
}

Tools

extract_log_snippets

Extracts representative log snippets using Drain3 clustering. The tool chunks the log into logical messages, clusters similar messages, and returns one representative snippet per cluster.

Log content can be provided in three ways (exactly one must be used):

Parameter

Type

Description

log_text

str

Raw log text passed directly.

log_path

str

Path to a log file on the server's filesystem.

log_url

str

HTTP(S) URL to fetch log content from.

Optional parameters:

Parameter

Type

Default

Description

max_clusters

int

8

Maximum number of snippets to extract.

max_snippet_len

int

2000

Maximum character length per snippet.

skip_patterns

list[str]

null

List of regex patterns. Chunks matching any pattern are excluded before clustering.

Returns a list of Snippet objects, each with line_number (position in the original log) and text (the extracted snippet content).

Size limits

All downloaded inputs (via log_url) are limited to 100 MB regardless of format. Downloads are streamed in chunks and aborted as soon as the limit is exceeded.

Archives read via log_path are also checked against the 100 MB limit during decompression.

Compressed file support

Both tools transparently decompress archived log files. Supported formats:

  • Single-file compression: .gz, .bz2, .xz, .lzma

  • Archives: .zip, .tar, .tar.gz, .tar.bz2, .tar.xz

Format is detected from the file extension (or URL path). Archives must contain exactly one file.

Zip bomb protection is enforced via:

  • Maximum decompressed size of 100 MB

  • Maximum compression ratio of 100:1

  • Pre-check of declared sizes in zip/tar headers

  • No recursive decompression (nested archives are not unpacked)

Contributing

All changes to this repository must pass pre-commit checks and tests.

uv run pytest tests/

Available Tools

2 tools
extract_log_snippetsA

Extract representative log snippets using Drain3 clustering.

Analyzes log text by chunking it into logical messages, clustering
similar messages using the Drain algorithm, and returning one
representative snippet per cluster.

Exactly one of log_text, log_path, or log_url must be provided.

Downloaded inputs are limited to 100 MB.
Compressed files (.gz, .bz2, .xz, .zip, .tar, .tar.gz, .tar.bz2,
.tar.xz) are decompressed transparently. Archives must contain
exactly one file. Compression ratios above 100:1 are rejected.

Args:
    log_text: Raw log text to analyze.
    log_path: Path to a log file on disk.
    log_url: HTTP(S) URL to fetch log content from.
    max_clusters: Maximum number of clusters/snippets to extract.
    max_snippet_len: Maximum character length per snippet chunk.
    skip_patterns: Optional list of regex patterns.
        Chunks matching any pattern are excluded before clustering.
ParametersJSON Schema
NameRequiredDescriptionDefault
log_urlNo
log_pathNo
log_textNo
max_clustersNo
skip_patternsNo
max_snippet_lenNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does well: it discloses the 100 MB download limit, transparent decompression of named formats, the single-file archive constraint, and rejection of >100:1 compression ratios. It does not mention authentication, rate limits, or failure/timeout behavior when fetching log_url, leaving a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose and output behavior, followed by input constraints then the Args list. Every sentence earns its place given the 0% schema coverage, and there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and no annotations exist to offload the behavioral burden. The description covers inputs, input-selection rules, and resource limits adequately for a six-param tool; only edge-case behavior of the URL fetch path is unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (only titles and defaults exist), so the description must compensate, and its Args block documents all six parameters with meaning — including the exclusive-or input constraint and what max_clusters, max_snippet_len, and skip_patterns control. The parameter notes are terse, so meaning is added but not exhaustively.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Extract representative log snippets') and even names the algorithm and the process (chunk, cluster with Drain, return one snippet per cluster). The resource is distinct from the sibling extract_python_tracebacks, but the sibling is never referenced, so distinction is inferential rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an important usage constraint ('Exactly one of log_text, log_path, or log_url must be provided'), which tells the agent how to invoke it. However, it offers no guidance on when to choose this tool over extract_python_tracebacks or when this tool is inappropriate; usage context is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_python_tracebacksA

Extract Python tracebacks using specialized heuristic.

Analyzes log text and extracts unbroken Python tracebacks.
Traces are truncated to `max_traceback_len` characters.

Exactly one of log_text, log_path, or log_url must be provided.

Downloaded inputs are limited to 100 MB.
Compressed files (.gz, .bz2, .xz, .zip, .tar, .tar.gz, .tar.bz2,
.tar.xz) are decompressed transparently. Archives must contain
exactly one file. Compression ratios above 100:1 are rejected.

Args:
    log_text: Raw log text to analyze.
    log_path: Path to a log file on disk.
    log_url: HTTP(S) URL to fetch log content from.
    max_traceback_len: Maximum character length per extracted traceback.
    skip_patterns: Optional list of regex patterns.
        Chunks matching any pattern are excluded.
ParametersJSON Schema
NameRequiredDescriptionDefault
log_urlNo
log_pathNo
log_textNo
skip_patternsNo
max_traceback_lenNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well: truncation to max_traceback_len, a 100 MB download cap, transparent decompression for a named list of formats, a single-file archive constraint, and rejection of >100:1 compression ratios. These are exactly the non-obvious operational traits an agent cannot infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-line purpose, then constraints, then Args; nothing is padded or redundant prose. The Args block is somewhat long, but since the schema provides no parameter descriptions it earns its place rather than duplicating structured data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers everything else an agent needs: input selection, size/compression limits, truncation behavior, and filtering. Nothing material for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it documents all five parameters in the Args block. Non-obvious semantics are added beyond the schema: skip_patterns is described as regex patterns that exclude matching chunks, and max_traceback_len as a per-traceback character cap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Extract Python tracebacks') plus the method ('specialized heuristic') and the input domain ('Analyzes log text'). The scope (unbroken Python tracebacks) is narrow enough that an agent can distinguish it from the sibling extract_log_snippets even without an explicit cross-reference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit input-selection rule: 'Exactly one of log_text, log_path, or log_url must be provided,' which is real usage guidance an agent needs before calling. It does not, however, state when to prefer this tool over the sibling extract_log_snippets or note any exclusions beyond the input constraint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.5.2
    • First observedextract_log_snippets
    • First observedextract_python_tracebacks
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.1/5.0

Scored across 2 tools

Disambiguation5/5

The two tools have clearly distinct purposes: one extracts representative log snippets via clustering, while the other extracts Python tracebacks. Shared input parameters do not create ambiguity because their outputs and targeting heuristics are different.

Naming Consistency5/5

Both tools follow the same predictable verb_noun snake_case pattern: extract_log_snippets and extract_python_tracebacks. There is no mixing of conventions or vague verbs.

Tool Count3/5

Two tools is on the thin side for a server called Log Detective MCP, even though each tool is focused. It is borderline rather than clearly well-scoped for broader log analysis.

Completeness3/5

The surface covers two specific extraction modes but lacks general log search, filtering, aggregation, or traceback support for other languages. These are notable gaps for a log-detection toolset, though the provided tools can handle some initial investigation.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • log-essence

    Apsion
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables LLMs to analyze logs by extracting patterns, redacting secrets, and providing token-efficient summaries from files, Docker containers, or journald.
    5
    MIT

  • log-ai-optimizer

    JustinHabashi
    F
    license
    Not graded
    quality
    D
    maintenance
    Compresses log files into templates and statistics using Drain3, and exposes them to AI assistants via an MCP server for efficient log monitoring and anomaly detection.
    -

  • Drain3 MCP Server

    xinqihuang
    A
    license
    A
    quality
    C
    maintenance
    MCP server that wraps Drain3 for streaming log template mining, read-only matching, parameter extraction, and model persistence, exposing tools and resources to train on logs and query learned templates.
    8
    MIT