Skip to main content
Glama
Sign In
Log Detective MCP

Log Detective MCP

Official
by fedora-copr
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

extract_log_snippets

Extract representative log snippets by clustering similar messages with Drain3 to analyze large logs from raw text, files, URLs, or compressed archives.

Instructions

Extract representative log snippets using Drain3 clustering.

Analyzes log text by chunking it into logical messages, clustering
similar messages using the Drain algorithm, and returning one
representative snippet per cluster.

Exactly one of log_text, log_path, or log_url must be provided.

Downloaded inputs are limited to 100 MB.
Compressed files (.gz, .bz2, .xz, .zip, .tar, .tar.gz, .tar.bz2,
.tar.xz) are decompressed transparently. Archives must contain
exactly one file. Compression ratios above 100:1 are rejected.

Args:
    log_text: Raw log text to analyze.
    log_path: Path to a log file on disk.
    log_url: HTTP(S) URL to fetch log content from.
    max_clusters: Maximum number of clusters/snippets to extract.
    max_snippet_len: Maximum character length per snippet chunk.
    skip_patterns: Optional list of regex patterns.
        Chunks matching any pattern are excluded before clustering.
    context: Number of lines to include before and after each snippet (0-50).
        These lines are additional to max_snippet_len. Split chunks retain
        their extracted text instead of expanding to the whole source line.

Input Schema

NameRequiredDescriptionDefault
contextNoNumber of surrounding lines to include.
log_urlNo
log_pathNo
log_textNo
max_clustersNo
skip_patternsNo
max_snippet_lenNo

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed5 schema fields changedv0.7.0
    • addedInput schema / oneOf
      Added value: +[
+  {
+    "properties": {
+      "log_text": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_text"
+    ]
+  },
+  {
+    "properties": {
+      "log_path": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_path"
+    ]
+  },
+  {
+    "properties": {
+      "log_url": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_url"
+    ]
+  }
+]
    • addedInput schema / properties / skip_patterns / anyOf
      Added value: +[
+  {
+    "items": {
+      "type": "string"
+    },
+    "type": "array"
+  },
+  {
+    "type": "null"
+  }
+]
    • changedInput schema / properties / skip_patterns / default
      Previous value: -[]New value: +null
    • removedInput schema / properties / skip_patterns / items
      Removed value: -{
-  "type": "string"
-}
    • removedInput schema / properties / skip_patterns / type
      Removed value: -"array"
  2. Changed1 schema field changedv0.6.1
    • addedInput schema / properties / context
      Added value: +{
+  "default": 0,
+  "description": "Number of surrounding lines to include.",
+  "maximum": 50,
+  "minimum": 0,
+  "title": "Context",
+  "type": "integer"
+}
  3. First observedv0.5.2

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the 100 MB download cap, transparent decompression of listed formats, the single-file archive rule, and rejection of compression ratios above 100:1. It omits any explicit statement that this is a read-only/network-fetching operation and says nothing about cost or latency of clustering large inputs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then the input rule, then constraints, then per-argument notes. The Args block is docstring-style but each entry adds information rather than restating the schema verbatim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a seven-parameter tool with no annotations, the description covers the algorithm, the input-selection invariant, size and archive limits, and the filtering/context semantics. An output schema exists, so return-value explanation is correctly omitted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 14%, so the description must compensate, and it largely does: all seven parameters are explained, with real added meaning for skip_patterns (regex exclusion before clustering) and context (0-50, additive to max_snippet_len, split-chunk behavior). max_snippet_len and max_clusters are only lightly characterized beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Extract representative log snippets') plus the mechanism (Drain3 clustering), and the body clarifies the chunk-cluster-pick-one workflow. It does not explicitly distinguish itself from the sibling extract_python_tracebacks, though the resource difference is inferable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'exactly one of log_text, log_path, or log_url' constraint is a strong input rule, but there is no guidance on when to choose this tool over extract_python_tracebacks or when snippet extraction is the wrong approach. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools