Loki MCP Server
The Loki MCP Server enables AI agents to query and analyze Grafana Loki logs through the Model Context Protocol (MCP) using LogQL.
query_range— Execute LogQL range queries to fetch logs over a time window, with configurable start/end times, result limit (up to 5000), and sort direction (forward/backward)query— Execute LogQL instant queries for point-in-time log evaluation, with configurable timestamp, result limit, and directionlabels— List all available label names in Loki within a given time range, useful for discovering what labels exist before building querieslabel_values— Retrieve all unique values for a specific label name within a time range, enabling dynamic query constructionseries— Find active log stream series matching a stream selector (e.g.{app="nginx"}), helping identify which log streams are currently active
Additional capabilities include support for basic auth, bearer tokens, and multi-tenant deployments; strict input validation (limit caps, direction checks, label format); and seamless integration with Claude Desktop, Claude Code, AI agent frameworks, and DevOps workflows. A local Docker Compose stack with Loki, Grafana, Promtail, and a log generator is included for development and testing.
Enables querying Grafana Loki logs using LogQL, allowing for the discovery of labels, label values, and active series, and the execution of range and instant queries for log retrieval.
Loki MCP Server
Query Grafana Loki logs directly from AI agents using the Model Context Protocol (MCP).
Built in Go. Enables AI-powered log analysis using LogQL.
Supports integration with:
Claude Desktop
AI agent frameworks
automation tools
DevOps workflows
Motivation
The official grafana/loki-mcp exposes a single loki_query tool, which means the LLM must already know valid label names and values before it can build a query. This project takes a different approach by providing 5 granular tools — labels, label_values, and series let the LLM discover what's available in Loki first, then construct precise query_range or query calls. The result is more accurate log retrieval with fewer wasted round-trips.
Additionally, this server enforces strict input validation (limit caps, direction validation, label name format checks, mutually exclusive auth) to surface errors early instead of forwarding bad requests to Loki.
Related MCP server: Overwatch MCP
Features
query_range — Execute LogQL range queries to fetch logs over a time window
query — Execute LogQL instant queries for point-in-time evaluation
labels — List all available label names
label_values — List values for a specific label
series — Find active log stream series matching a selector
Installation
Homebrew
brew install incu6us/tap/loki-mcp-serverGo install
go install github.com/incu6us/loki-mcp-server/cmd/loki-mcp-server@latestOr build from source:
git clone https://github.com/incu6us/loki-mcp-server.git
cd loki-mcp
go build -o loki-mcp-server ./cmd/loki-mcp-serverConfiguration
The server is configured entirely via environment variables, injected by the MCP client.
Variable | Required | Default | Description |
| yes | — | Base URL of the Loki instance |
| no | — | Basic auth username |
| no | — | Basic auth password |
| no | — | Bearer token authentication |
| no |
| Skip TLS certificate verification |
| no | — |
|
| no |
| HTTP request timeout (Go duration, e.g. |
| no | — | Listen address for the streamable HTTP transport, e.g. |
Note: Basic auth (
LOKI_USERNAME/LOKI_PASSWORD) and bearer token (LOKI_BEARER_TOKEN) are mutually exclusive.
Transports
By default the server speaks MCP over stdio, which is what Claude Code, Claude Desktop and most local clients expect.
Set MCP_HTTP_ADDR to serve the streamable HTTP transport instead, for running the
server as a remote endpoint behind a proxy or gateway:
LOKI_URL=http://loki:3100 MCP_HTTP_ADDR=:8080 loki-mcp-server
# MCP endpoint: http://localhost:8080/mcpThe HTTP mode is stateless, so it can run behind a load balancer with several replicas.
It carries no authentication of its own — put it behind TLS and an authenticating proxy
before exposing it, and remember that whoever reaches the endpoint can read every log
line the configured LOKI_URL credentials can see.
Usage with Claude Code
Add to your Claude Code MCP configuration (~/.claude.json):
{
"mcpServers": {
"loki-mcp-server": {
"type": "stdio",
"command": "/path/to/loki-mcp-server",
"args": [],
"env": {
"LOKI_URL": "http://loki:3100",
"LOKI_USERNAME": "admin",
"LOKI_PASSWORD": "secret"
}
}
}
}Usage with Claude Desktop
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"loki-mcp-server": {
"type": "stdio",
"command": "/path/to/loki-mcp-server",
"args": [],
"env": {
"LOKI_URL": "http://loki:3100",
"LOKI_USERNAME": "admin",
"LOKI_PASSWORD": "secret"
}
}
}
}Tools
query_range
Execute a LogQL range query against Loki to fetch logs over a time window.
Parameter | Type | Required | Default | Description |
| string | yes | — | LogQL query expression |
| string | no | 1 hour ago | Start of time range (RFC3339 or Unix nano) |
| string | no | now | End of time range |
| number | no | 100 | Max entries (max 5000) |
| string | no | backward |
|
query
Execute a LogQL instant query for point-in-time evaluation.
Parameter | Type | Required | Default | Description |
| string | yes | — | LogQL query expression |
| number | no | 100 | Max entries (max 5000) |
| string | no | now | Evaluation timestamp |
| string | no | backward |
|
labels
List all available label names in Loki.
Parameter | Type | Required | Default | Description |
| string | no | 6 hours ago | Start of time range |
| string | no | now | End of time range |
label_values
List values for a specific label.
Parameter | Type | Required | Default | Description |
| string | yes | — | Label name |
| string | no | 6 hours ago | Start of time range |
| string | no | now | End of time range |
series
Find active log stream series matching a selector.
Parameter | Type | Required | Default | Description |
| string | yes | — | Stream selector (e.g. |
| string | no | 6 hours ago | Start of time range |
| string | no | now | End of time range |
Local Development Stack
A Docker Compose setup is included under deploy/ to spin up a full Loki environment for testing:
Loki — log storage at
http://localhost:3100Grafana — UI at
http://localhost:3000(anonymous admin, Loki pre-configured as datasource)Promtail — collects container logs and ships them to Loki
Log generator — emits structured JSON logs with randomized apps (
nginx,api,gateway,auth,payments), levels, and messages
# Start the stack
docker compose -f deploy/docker-compose.yml up -d
# Use loki-mcp-server against local Loki
LOKI_URL=http://localhost:3100 loki-mcp-server
# Stop the stack
docker compose -f deploy/docker-compose.yml downDevelopment
# Run tests
go test ./...
# Build
go build -o loki-mcp-server ./cmd/loki-mcp-server
# Vet
go vet ./...⭐ If this project is useful for you, please star the repository.
Available Tools
5 toolslabelsARead-onlyIdempotent
List the label names Loki knows about in a time window.
Start here when the log schema is unknown: labels gives the names (app, namespace, level), then label_values gives the values for one of them, and together they let you write a valid selector for query_range. Only labels present on streams that received data inside the window are returned, so widening start/end surfaces more.
Returns the raw Loki JSON response: {"status","data":["label","names"]}. Read-only: it never writes to or mutates Loki.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the time range, RFC3339 or Unix nanoseconds. Defaults to now. | |
| start | No | Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description reinforces with 'Read-only: it never writes to or mutates Loki' and adds the raw return format ('{"status","data":["label","names"]}') plus the behavior about only labels present on streams with data in the window. This goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences front-load the purpose, then explain the workflow and return format. Every sentence earns its place, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with two optional parameters and no output schema, the description fully explains purpose, usage context, return format, and operational behavior. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (start and end documented with types, defaults, and format). The description adds the insight that widening start/end surfaces more labels, which is extra semantic value beyond the schema, but the core semantics are already covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' the resource 'label names' within 'Loki' and a time window. It differentiates itself from siblings by explicitly contrasting with label_values and query_range, and positioning itself as the starting point for schema discovery.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly directs the agent: 'Start here when the log schema is unknown' and describes the sequence labels → label_values → query_range. It also gives a practical tip about widening start/end to surface more labels, making the intended use unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
label_valuesARead-onlyIdempotent
List the values a single label takes in Loki over a time window.
Use it after labels to fill in a selector: labels says "app" exists, label_values with label="app" says which apps are actually logging, and one of those goes into {app="..."} for query_range. Only values seen inside the window are returned, so widening start/end surfaces more.
Returns the raw Loki JSON response: {"status","data":["value","list"]}. An unknown label name is not an error; it comes back as an empty list. Read-only: it never writes to or mutates Loki.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the time range, RFC3339 or Unix nanoseconds. Defaults to now. | |
| label | Yes | Label name to look up, as returned by the labels tool (e.g. app, namespace, level). Must match ^[a-zA-Z_][a-zA-Z0-9_]*$. | |
| start | No | Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the raw JSON response format, the empty-list behavior for unknown labels, and explicitly states 'Read-only: it never writes to or mutates Loki.' This adds behavioral context beyond the annotations (readOnlyHint, destructiveHint, idempotentHint) by clarifying exact response shape and error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is about 70 words, front-loaded with the core action, then logically flows into usage, behavior, and return format. Every sentence carries useful information, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
It covers purpose, usage pattern, response format, edge cases (unknown label), read-only guarantee, and parameter interpretation. The presence of annotations and sibling context fills remaining gaps, making this fully self-sufficient for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema covers 100% of parameters, the description adds significant meaning: it ties start/end to the time-window semantics, gives an example ('app') for the label pattern, and explains the default values. This elevates the parameters from syntax to usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a clear, specific verb and resource ('List the values a single label takes in Loki over a time window') and immediately distinguishes it from siblings by explaining when to use it (after labels, before query_range). It names the exact context and how it fits the workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool: 'Use it after labels to fill in a selector' and walks through a concrete example (labels says 'app' exists, label_values gives actual values, one goes into query_range). It also notes the effect of widening start/end, giving clear guidance on parameter usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryARead-onlyIdempotent
Run a LogQL instant query against Loki, evaluating the expression at a single point in time.
Use this for metric expressions (rate, count_over_time, sum by) when one value per series is enough, or for a quick "what is happening right now" check. To read log lines across a time window, use query_range instead. To discover which labels exist before writing a selector, use labels and label_values.
Returns the raw Loki JSON response: {"status","data":{"resultType","result"}}, where resultType is "vector" for metric expressions and "streams" for log selectors. Read-only: it never writes to or mutates Loki.
| Name | Required | Description | Default |
|---|---|---|---|
| time | No | Evaluation timestamp, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to now. | |
| limit | No | Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000. | |
| query | Yes | LogQL expression. Metric example: sum(rate({app="nginx"} |= "error" [5m])). Log example: {app="nginx"} |= "error". | |
| direction | No | Order of returned log entries: backward (newest first, the default) or forward (oldest first). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only and idempotent, but the description adds the exact return format (raw Loki JSON with resultType 'vector' or 'streams') and explicitly states 'never writes to or mutates Loki'. This goes beyond annotations by specifying output structure and result semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Compact and well-structured: core action first, then usage guidance, then return format, and finally safety. No filler; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description fully explains the return JSON and resultType. It also covers usage context, parameter guidance, and safety. For a read-only query tool, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, meeting the baseline, but the description adds value by explaining how the query parameter should be shaped (metric examples like rate, count_over_time) and clarifying that limit applies only to log selectors (though this is also in schema). The description reinforces parameter behavior without redundancy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool runs a LogQL instant query against Loki, evaluates at a single point in time, and differentiates from query_range (time window) and labels/label_values (label discovery). The verb 'run' and resource 'Loki' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (metric expressions needing one value per series, quick 'what is happening right now' checks) and when not (query_range for time ranges, labels/label_values for label discovery). Names alternatives and conditions clearly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_rangeARead-onlyIdempotent
Run a LogQL range query against Loki, returning results across a time window.
This is the tool to reach for when reading logs: searching for errors, tailing a service over the last hour, or graphing a metric expression over time. Use query instead when a single point-in-time value is enough. If the selector is unknown, call labels and label_values first.
Returns the raw Loki JSON response: {"status","data":{"resultType","result"}}, where resultType is "streams" for log selectors and "matrix" for metric expressions. Loki truncates at limit entries, so a full result set may mean logs were cut off; narrow start/end or tighten the selector rather than raising limit. Read-only: it never writes to or mutates Loki.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the time range, RFC3339 or Unix nanoseconds. Defaults to now. | |
| limit | No | Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000. | |
| query | Yes | LogQL expression. Log example: {app="nginx"} |= "error" | json. Metric example: sum by (app) (rate({app="nginx"}[5m])). | |
| start | No | Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 1 hour ago. | |
| direction | No | Order of returned log entries: backward (newest first, the default) or forward (oldest first). With backward and a hit limit, you keep the newest entries. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint, destructiveHint, idempotentHint. Description adds valuable behavior beyond those: truncation at limit with advice to narrow range, direction effect ('With backward and a hit limit, you keep the newest entries'), and explicit read-only statement. No contradiction; it enriches transparency with operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: purpose first, then usage guidance, then output format, then truncation caveat, then read-only note. Every sentence delivers distinct value—no filler. Front-loaded with the most important usage context. Appropriate length for a complex tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and complex behavior, the description explains the raw JSON response format, resultType meanings, truncation behavior, and parameter interactions. It also covers edge cases (metric expressions ignore limit, direction defaults). All necessary information for correct invocation is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. Description adds nuance: clarifies that limit applies only to log selectors (not metric expressions), explains direction's effect on truncation, and advises narrowing start/end rather than raising limit. This goes beyond schema's per-parameter descriptions, adding operational semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Run a LogQL range query'), resource ('Loki'), and scope ('across a time window'). It explicitly distinguishes from sibling 'query' (point-in-time) and mentions 'labels' and 'label_values' as alternate tools. An agent can immediately understand what this tool does and how it differs from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: 'This is the tool to reach for when reading logs' and gives concrete scenarios (searching errors, tailing over an hour, graphing metrics). It specifies when to use 'query' instead and instructs to call 'labels' and 'label_values' first if selector unknown. Clear when/when-not with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
seriesARead-onlyIdempotent
List the log streams matching a selector, as complete label sets.
Use it to see which concrete streams a selector actually covers and what other labels they carry: {app="nginx"} may expand to one series per pod, region or level. That answers "does this selector match anything" and "how many streams am I about to read" without fetching log lines. For the lines themselves, use query_range; for label names and values in isolation, use labels and label_values.
Returns the raw Loki JSON response: {"status","data":[{"label":"value"}]}, one object per stream. A selector matching nothing comes back as an empty list. Read-only: it never writes to or mutates Loki.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the time range, RFC3339 or Unix nanoseconds. Defaults to now. | |
| match | Yes | Stream selector in LogQL brace syntax, e.g. {app="nginx"} or {namespace="prod",level=~"error|warn"}. Line filters (|=) are not accepted here. | |
| start | No | Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the read-only safety is covered. The description adds valuable context beyond annotations: the exact return shape (raw Loki JSON with status/data), the empty-list behavior for no matches, and a concrete example of selector expansion. It also repeats the read-only guarantee, reinforcing but not contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact yet thorough, leading with the core action, then purpose, usage guidance, return format, and safety note. Every sentence adds new information—no redundant fluff. The alternative-tool routing is front-loaded and the response format is clearly specified up front, making it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters and no output schema, the description is exceptionally complete. It covers the raw JSON structure, empty-list case, read-only nature, selector expansion, and explicitly routes to sibling tools. Time range defaults are in the schema, and the description complements rather than duplicates, leaving nothing essential missing for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all three parameters at 100% with clear descriptions, including the match selector syntax and time range defaults. The description adds significant extra semantic value by explaining the expansion behavior ('{app="nginx"} may expand to one series per pod, region or level'), which directly illuminates how the match parameter behaves in practice, beyond a simple field description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('List the log streams matching a selector') and immediately clarifies it returns complete label sets. It explicitly differentiates from siblings by naming query_range, labels, and label_values as alternatives for different purposes, making the tool's unique role unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states exactly when to use this tool ('to see which concrete streams a selector actually covers', 'does this selector match anything', 'how many streams am I about to read') and gives explicit exclusions: 'For the lines themselves, use query_range; for label names and values in isolation, use labels and label_values.' This leaves no ambiguity about when to choose this tool over siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.0.3- Changed
label_values4 fields changed- changed
Input schema / properties / end / descriptionPrevious value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now." - changed
Input schema / properties / label / descriptionPrevious value: -"Label name to retrieve values for"New value: +"Label name to look up, as returned by the labels tool (e.g. app, namespace, level). Must match ^[a-zA-Z_][a-zA-Z0-9_]*$." - added
Input schema / properties / label / patternAdded value: +"^[a-zA-Z_][a-zA-Z0-9_]*$" - changed
Input schema / properties / start / descriptionPrevious value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
- Changed
labels2 fields changed- changed
Input schema / properties / end / descriptionPrevious value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now." - changed
Input schema / properties / start / descriptionPrevious value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
- Changed
query5 fields changed- changed
Input schema / properties / direction / descriptionPrevious value: -"Sort order: forward or backward. Defaults to backward"New value: +"Order of returned log entries: backward (newest first, the default) or forward (oldest first)." - added
Input schema / properties / direction / enumAdded value: +[ + "forward", + "backward" +] - changed
Input schema / properties / limit / descriptionPrevious value: -"Maximum number of entries to return. Defaults to 100, max 5000"New value: +"Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000." - changed
Input schema / properties / query / descriptionPrevious value: -"LogQL query expression"New value: +"LogQL expression. Metric example: sum(rate({app=\"nginx\"} |= \"error\" [5m])). Log example: {app=\"nginx\"} |= \"error\"." - changed
Input schema / properties / time / descriptionPrevious value: -"Evaluation timestamp (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"Evaluation timestamp, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to now."
- Changed
query_range6 fields changed- changed
Input schema / properties / direction / descriptionPrevious value: -"Sort order: forward or backward. Defaults to backward"New value: +"Order of returned log entries: backward (newest first, the default) or forward (oldest first). With backward and a hit limit, you keep the newest entries." - added
Input schema / properties / direction / enumAdded value: +[ + "forward", + "backward" +] - changed
Input schema / properties / end / descriptionPrevious value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now." - changed
Input schema / properties / limit / descriptionPrevious value: -"Maximum number of entries to return. Defaults to 100, max 5000"New value: +"Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000." - changed
Input schema / properties / query / descriptionPrevious value: -"LogQL query expression"New value: +"LogQL expression. Log example: {app=\"nginx\"} |= \"error\" | json. Metric example: sum by (app) (rate({app=\"nginx\"}[5m]))." - changed
Input schema / properties / start / descriptionPrevious value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 1 hour ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 1 hour ago."
- Changed
series3 fields changed- changed
Input schema / properties / end / descriptionPrevious value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now." - changed
Input schema / properties / match / descriptionPrevious value: -"Stream selector (e.g. {app=\"nginx\"})"New value: +"Stream selector in LogQL brace syntax, e.g. {app=\"nginx\"} or {namespace=\"prod\",level=~\"error|warn\"}. Line filters (|=) are not accepted here." - changed
Input schema / properties / start / descriptionPrevious value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
5 tool updates
v0.1.0- First observed
label_values - First observed
labels - First observed
query - First observed
query_range - First observed
series
TDQS
Scored across 5 tools
Each tool serves a distinct purpose: labels lists names, label_values lists values for a given label, query runs instant queries, query_range runs range queries, and series lists matching streams. No overlap or ambiguity between them.
All tool names are in snake_case and follow a clear pattern: label_values, labels, query, query_range, series. They are consistent in style and predictable, with multi-word names clearly separated by underscores.
With 5 tools, the server is well-scoped for a log querying service. Each tool is essential and there are no redundant or excessive entries.
The tool surface covers the full read-only workflow for Loki: discovering labels, discovering label values, running instant queries, running range queries, and checking stream coverage. No obvious gaps for typical use cases.
Maintenance
Related MCP Connectors
An MCP server giving access to Grafana dashboards, data and more.
Syslog receiver and MCP server for homelab log intelligence.
Syslog receiver and MCP server for homelab log intelligence.
An MCP server that let you interact with Cycloid.io Internal Development Portal and Platform
Related MCP Servers
- AlicenseDqualityFmaintenanceAn MCP interface that allows AI assistants to query and analyze Grafana Loki logs using LogQL, with support for authentication and various output formats.3108 npm6MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that enables querying logs and metrics from Graylog, Prometheus, and InfluxDB 2.x. It provides tools for executing Lucene log searches, PromQL queries, and Flux queries directly within MCP-compatible clients.MIT
- AlicenseNot gradedqualityDmaintenanceThis MCP server enables natural-language querying of Grafana logs by automatically detecting log sources and service labels. It provides read-only access to log data with intelligent caching for efficient repeat queries.38 npmMIT
- FlicenseNot gradedqualityFmaintenanceAn MCP server that enables AI assistants to query and analyze logs from Grafana Loki using LogQL, supporting label discovery and keyword search.4-