What can you do with this server?

Analyze logs via two MCP tools: extract representative clustered log snippets and extract Python tracebacks, with filtering, context, compression support, and size limits. * Extract one representative snippet per Drain3 cluster from a log, returning line_number and text. * Provide log content exactly one way: raw log_text, server-side log_path, or HTTP(S) log_url. * Tune snippet extraction with max_clusters, max_snippet_len, skip_patterns, and context (0–50 surrounding lines). * Extract Python tracebacks, including chained exceptions, with optional truncation, skip_patterns, and context. * Transparently decompress .gz, .bz2, .xz, .lzma, .zip, .tar, .tar.gz, .tar.bz2, and .tar.xz inputs; archives must contain exactly one file. * Enforce 100 MB limits on downloads and decompressed archives, with zip-bomb protections and no recursive decompression.

How do I use Log Detective MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Log Detective MCP extract representative snippets from /var/log/app.log" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Log Detective MCP

Official

by fedora-copr

Overview Schema Source Related Servers Discussions Admin

Python

Hybrid

Log Detective MCP

MCP server implementing core log analysis tools of Log Detective for use by other agents.

The server uses the Drain3 algorithm to cluster log messages into templates and extract a representative subset of snippets, reducing large logs to a manageable size for downstream analysis.

Installation

Requires Python 3.11+.

pip install .

Or with uv:

uv pip install .

Related MCP server: log-essence

Usage

Running the server

logdetective-mcp

Or directly:

python -m logdetective_mcp.main

MCP client configuration

Claude Code

claude mcp add logdetective -- logdetective-mcp

Claude Desktop

Add to your Claude Desktop configuration file:

{
  "mcpServers": {
    "logdetective": {
      "command": "logdetective-mcp"
    }
  }
}

Tools

`extract_log_snippets`

Extracts representative log snippets using Drain3 clustering. The tool chunks the log into logical messages, clusters similar messages, and returns one representative snippet per cluster.

Log content can be provided in three ways (exactly one must be used):

Parameter	Type	Description
`log_text`	`str`	Raw log text passed directly.
`log_path`	`str`	Path to a log file on the server's filesystem.
`log_url`	`str`	HTTP(S) URL to fetch log content from.

The input schema for both tools uses oneOf to require exactly one nonempty source field. Omitted source fields and fields set to "" do not count as a source. This matches the rule checked when a tool runs. The advertised tool definitions conform to the MCP 2025-11-25 Tool schema.

Optional parameters:

Parameter	Type	Default	Description
`max_clusters`	`int`	8	Maximum number of snippets to extract.
`max_snippet_len`	`int`	2000	Maximum character length per snippet.
`skip_patterns`	`list[str] \| null`	`null`	List of regex patterns. Chunks matching any pattern are excluded before clustering.
`context`	`int`	0	Number of lines to include before and after each snippet (0-50).

Returns a list of Snippet objects, each with line_number (position in the original log) and text (the extracted snippet content). MCP structured output wraps this list as {"result": [...]}; the advertised output schema describes that object.

`extract_python_tracebacks`

Extracts Python tracebacks from the log, including chained exceptions.

Parameter	Type	Default	Description
`max_traceback_len`	`int`	2000	Maximum character length per extracted traceback.
`skip_patterns`	`list[str] \| null`	`null`	List of regex patterns. Tracebacks matching any pattern are excluded.
`context`	`int`	0	Number of lines to include before and after each traceback (0-50).

For both extractor tools, context follows grep's -C behavior: the requested number of surrounding log lines is included on each side when available. The length limit applies to the extracted snippet or traceback; context lines are additional, so the returned text can be longer than the limit. With context enabled, line_number points to the first returned line. Values outside 0-50 are rejected.

If a traceback is truncated, the extractor keeps its beginning and end with a marker when max_traceback_len permits; smaller limits keep only a prefix. Following context starts after the original traceback, without restoring its omitted middle. If a log line is split into chunks by max_snippet_len, each selected chunk keeps its own text when context is added. Neighboring lines do not replace it with the complete long line. Context boundaries follow the chunk's original source lines, including blank lines omitted from the rendered chunk.

Size limits

All downloaded inputs (via log_url) are limited to 100 MB regardless of format. Downloads are streamed in chunks and aborted as soon as the limit is exceeded.

Archives read via log_path are also checked against the 100 MB limit during decompression.

Compressed file support

Both tools transparently decompress archived log files. Supported formats:

Single-file compression: .gz, .bz2, .xz, .lzma
Archives: .zip, .tar, .tar.gz, .tar.bz2, .tar.xz

Format is detected from the file extension (or URL path). Archives must contain exactly one file.

Zip bomb protection is enforced via:

Maximum decompressed size of 100 MB
Maximum compression ratio of 100:1
Pre-check of declared sizes in zip/tar headers
No recursive decompression (nested archives are not unpacked)

Contributing

All changes to this repository must pass pre-commit checks and tests.

uv run pytest tests/

To inspect the JSON schemas returned by the installed server, run the check script with the project's virtual environment. It starts the server over MCP stdio, validates both tool schemas and structured results, and compares the returned tool definitions with the files in schemas/:

.venv/bin/python scripts/check_mcp_schemas.py

After an intentional schema change, regenerate those files with:

.venv/bin/python scripts/check_mcp_schemas.py --write

Available Tools

2 tools

extract_log_snippetsA

Extract representative log snippets using Drain3 clustering.

Analyzes log text by chunking it into logical messages, clustering
similar messages using the Drain algorithm, and returning one
representative snippet per cluster.

Exactly one of log_text, log_path, or log_url must be provided.

Downloaded inputs are limited to 100 MB.
Compressed files (.gz, .bz2, .xz, .zip, .tar, .tar.gz, .tar.bz2,
.tar.xz) are decompressed transparently. Archives must contain
exactly one file. Compression ratios above 100:1 are rejected.

Args:
    log_text: Raw log text to analyze.
    log_path: Path to a log file on disk.
    log_url: HTTP(S) URL to fetch log content from.
    max_clusters: Maximum number of clusters/snippets to extract.
    max_snippet_len: Maximum character length per snippet chunk.
    skip_patterns: Optional list of regex patterns.
        Chunks matching any pattern are excluded before clustering.
    context: Number of lines to include before and after each snippet (0-50).
        These lines are additional to max_snippet_len. Split chunks retain
        their extracted text instead of expanding to the whole source line.

Name	Required	Description
`context`	No	Number of surrounding lines to include.
`log_url`	No
`log_path`	No
`log_text`	No
`max_clusters`	No
`skip_patterns`	No
`max_snippet_len`	No

Output Schema

Name	Required	Description
`result`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the 100 MB download cap, transparent decompression of listed formats, the single-file archive rule, and rejection of compression ratios above 100:1. It omits any explicit statement that this is a read-only/network-fetching operation and says nothing about cost or latency of clustering large inputs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then the input rule, then constraints, then per-argument notes. The Args block is docstring-style but each entry adds information rather than restating the schema verbatim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a seven-parameter tool with no annotations, the description covers the algorithm, the input-selection invariant, size and archive limits, and the filtering/context semantics. An output schema exists, so return-value explanation is correctly omitted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 14%, so the description must compensate, and it largely does: all seven parameters are explained, with real added meaning for skip_patterns (regex exclusion before clustering) and context (0-50, additive to max_snippet_len, split-chunk behavior). max_snippet_len and max_clusters are only lightly characterized beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Extract representative log snippets') plus the mechanism (Drain3 clustering), and the body clarifies the chunk-cluster-pick-one workflow. It does not explicitly distinguish itself from the sibling extract_python_tracebacks, though the resource difference is inferable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'exactly one of log_text, log_path, or log_url' constraint is a strong input rule, but there is no guidance on when to choose this tool over extract_python_tracebacks or when snippet extraction is the wrong approach. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_python_tracebacksA

Extract Python tracebacks using specialized heuristic.

Analyzes log text and extracts unbroken Python tracebacks.
Traces are truncated to `max_traceback_len` characters.

Exactly one of log_text, log_path, or log_url must be provided.

Downloaded inputs are limited to 100 MB.
Compressed files (.gz, .bz2, .xz, .zip, .tar, .tar.gz, .tar.bz2,
.tar.xz) are decompressed transparently. Archives must contain
exactly one file. Compression ratios above 100:1 are rejected.

Args:
    log_text: Raw log text to analyze.
    log_path: Path to a log file on disk.
    log_url: HTTP(S) URL to fetch log content from.
    max_traceback_len: Maximum character length per extracted traceback.
    skip_patterns: Optional list of regex patterns.
        Chunks matching any pattern are excluded.
    context: Number of lines to include before and after each traceback (0-50).
        These lines are additional to max_traceback_len. A truncated
        traceback keeps its shortened text; following context begins after
        the original traceback ends.

Name	Required	Description
`context`	No	Number of surrounding lines to include.
`log_url`	No
`log_path`	No
`log_text`	No
`skip_patterns`	No
`max_traceback_len`	No

Output Schema

Name	Required	Description
`result`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses truncation to max_traceback_len, a 100 MB download cap, transparent decompression of listed formats, and a 100:1 compression-ratio rejection rule. It does not state failure behavior (invalid regex, missing file, malformed archive), which is the main remaining gap for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then constraints, then an Args block — every sentence carries information an agent would otherwise have to guess. The compression paragraph is long but each clause is a distinct, enforceable rule rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the description instead covers input acquisition, decompression, truncation, and context semantics. The one genuine omission is sibling differentiation against extract_log_snippets, which matters for a tool with a similar name and adjacent purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 17%, so the Args block is doing real work: it defines log_text/log_path/log_url, skip_patterns regex exclusion semantics, and the 0-50 context range. The context note that surrounding lines are additional to max_traceback_len and that truncated tracebacks resume context after the original end adds genuine meaning unavailable in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Extract Python tracebacks') and restates it in more operational terms ('Analyzes log text and extracts unbroken Python tracebacks'), so an agent immediately knows what comes back. It never names or distinguishes itself from the sibling extract_log_snippets, leaving the boundary between traceback extraction and snippet extraction implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the constraint 'Exactly one of log_text, log_path, or log_url must be provided' and through the skip_patterns/context definitions, which suggest filtering and context-expansion use cases. However, there is no explicit when-to-use statement and no mention of when to prefer the sibling extract_log_snippets over this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

2 tool updatesv0.7.0Nov 2, 2026

Changedextract_log_snippets5 fields changed

addedInput schema / oneOf

Added value: +[
+  {
+    "properties": {
+      "log_text": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_text"
+    ]
+  },
+  {
+    "properties": {
+      "log_path": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_path"
+    ]
+  },
+  {
+    "properties": {
+      "log_url": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_url"
+    ]
+  }
+]

addedInput schema / properties / skip_patterns / anyOf

Added value: +[
+  {
+    "items": {
+      "type": "string"
+    },
+    "type": "array"
+  },
+  {
+    "type": "null"
+  }
+]

changedInput schema / properties / skip_patterns / default
```
Previous value: -[]New value: +null
```
removedInput schema / properties / skip_patterns / items
```
Removed value: -{
-  "type": "string"
-}
```
removedInput schema / properties / skip_patterns / type
```
Removed value: -"array"
```

Changedextract_python_tracebacks5 fields changed

addedInput schema / oneOf

Added value: +[
+  {
+    "properties": {
+      "log_text": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_text"
+    ]
+  },
+  {
+    "properties": {
+      "log_path": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_path"
+    ]
+  },
+  {
+    "properties": {
+      "log_url": {
+        "minLength": 1
+      }
+    },
+    "required": [
+      "log_url"
+    ]
+  }
+]

addedInput schema / properties / skip_patterns / anyOf

Added value: +[
+  {
+    "items": {
+      "type": "string"
+    },
+    "type": "array"
+  },
+  {
+    "type": "null"
+  }
+]

changedInput schema / properties / skip_patterns / default
```
Previous value: -[]New value: +null
```
removedInput schema / properties / skip_patterns / items
```
Removed value: -{
-  "type": "string"
-}
```
removedInput schema / properties / skip_patterns / type
```
Removed value: -"array"
```

2 tool updatesv0.6.1Oct 23, 2026

Changedextract_log_snippets1 field changed

addedInput schema / properties / context

Added value: +{
+  "default": 0,
+  "description": "Number of surrounding lines to include.",
+  "maximum": 50,
+  "minimum": 0,
+  "title": "Context",
+  "type": "integer"
+}

Changedextract_python_tracebacks1 field changed

addedInput schema / properties / context

Added value: +{
+  "default": 0,
+  "description": "Number of surrounding lines to include.",
+  "maximum": 50,
+  "minimum": 0,
+  "title": "Context",
+  "type": "integer"
+}

2 tool updatesv0.5.2Oct 20, 2026
- First observedextract_log_snippets
- First observedextract_python_tracebacks

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored 2026-11-02 18:45 across 2 tools

Disambiguation4/5

The two tools target different extraction strategies (Drain3 clustering vs Python traceback heuristics), so their core purposes are clearly distinct. However, they share identical input modes (log_text/log_path/log_url, skip_patterns, context), and a log containing tracebacks could plausibly be fed to either, leaving a small boundary ambiguity an agent must reason about.

Naming Consistency5/5

Both names follow the same `extract_<thing>` snake_case convention with the same verb prefix and noun-phrase object. Parameter naming is also mirrored across the two tools (max_*_len, skip_patterns, context), reinforcing predictability.

Tool Count3/5

Two tools is thin for a server branded as 'Log Detective' — the surface is essentially one extraction family with two strategies. It is not incoherent, but there is little room for an agent to do anything beyond pulling snippets or tracebacks.

Completeness3/5

Input handling is thorough (text/path/URL, transparent decompression, safety limits) and both tools mirror it consistently. But the lifecycle stops at extraction: there is no summarization, severity/error-level grouping, keyword or pattern-include extraction, or structured output option, which leaves gaps for a diagnostic-oriented server.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Related MCP Connectors

LogsLoom A
io.github.efim23
Ingest and search LogsLoom logs from coding agents.
Observability Monitoring Developer Tools
41
https://mcp.logsloom.com/mcp
HumanMirror Oracle A
fr.humanmirror
Structured analysis API and remote MCP tool for text, JSON records and numeric series.
Research & Data Data Platforms
11
https://humanmirror.fr/api/oracle/mcp/
AgentRead A
dev.workers.toolschemaforge.agent-read
Turn URLs, PDFs and DOCX into clean Markdown for agents, plus prompt-injection scanning
Web Scraping RAG Systems Security
21
https://agent-read.toolschemaforge.workers.dev/mcp
Superlog
sh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Monitoring Observability
21,039
https://api.superlog.sh/mcp

Related MCP Servers

MCP Test Failure Analysis
Testing & QA Tools Developer Tools
rudrathkr
F
license
B
quality
D
maintenance
Provides tools to analyze test failures, cluster similar failures, and detect flaky tests from input or log files, helping QA teams debug and triage issues.
Updated 6 months ago (2026-04-26 12:59 UTC)
3
-
log-essence
Monitoring Observability
Apsion
A
license
Not graded
quality
F
maintenance
Enables LLMs to analyze logs by extracting patterns, redacting secrets, and providing token-efficient summaries from files, Docker containers, or journald.
Updated 6 days ago (2026-10-28 15:20 UTC)
21 PyPI
5
MIT
log-ai-optimizer
Monitoring Observability
JustinHabashi
F
license
Not graded
quality
D
maintenance
Compresses log files into templates and statistics using Drain3, and exposes them to AI assistants via an MCP server for efficient log monitoring and anomaly detection.
Updated 4 months ago (2026-07-05 18:33 UTC)
-
Drain3 MCP Server
Observability Monitoring
xinqihuang
A
license
A
quality
C
maintenance
MCP server that wraps Drain3 for streaming log template mining, read-only matching, parameter extraction, and model persistence, exposing tools and resources to train on logs and query learned templates.
Updated 3 months ago (2026-08-14 11:42 UTC)
8
MIT

Log Detective MCP

Installation

Usage

Running the server

MCP client configuration

Claude Code

Claude Desktop

Tools

extract_log_snippets

extract_python_tracebacks

Size limits

Compressed file support

Contributing

Available Tools

Output Schema

TDQS

Output Schema

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

MCP Test Failure Analysis

log-essence

log-ai-optimizer

Drain3 MCP Server

`extract_log_snippets`

`extract_python_tracebacks`