Skip to main content
Glama

Loki MCP Server

CI Release codecov Go Report Card License: MIT Stars MCP

loki-mcp-server MCP server

Query Grafana Loki logs directly from AI agents using the Model Context Protocol (MCP).

Built in Go. Enables AI-powered log analysis using LogQL.

Supports integration with:

  • Claude Desktop

  • AI agent frameworks

  • automation tools

  • DevOps workflows

Motivation

The official grafana/loki-mcp exposes a single loki_query tool, which means the LLM must already know valid label names and values before it can build a query. This project takes a different approach by providing 5 granular toolslabels, label_values, and series let the LLM discover what's available in Loki first, then construct precise query_range or query calls. The result is more accurate log retrieval with fewer wasted round-trips.

Additionally, this server enforces strict input validation (limit caps, direction validation, label name format checks, mutually exclusive auth) to surface errors early instead of forwarding bad requests to Loki.

Related MCP server: Overwatch MCP

Features

  • query_range — Execute LogQL range queries to fetch logs over a time window

  • query — Execute LogQL instant queries for point-in-time evaluation

  • labels — List all available label names

  • label_values — List values for a specific label

  • series — Find active log stream series matching a selector

Installation

Homebrew

brew install incu6us/tap/loki-mcp-server

Go install

go install github.com/incu6us/loki-mcp-server/cmd/loki-mcp-server@latest

Or build from source:

git clone https://github.com/incu6us/loki-mcp-server.git
cd loki-mcp
go build -o loki-mcp-server ./cmd/loki-mcp-server

Configuration

The server is configured entirely via environment variables, injected by the MCP client.

Variable

Required

Default

Description

LOKI_URL

yes

Base URL of the Loki instance

LOKI_USERNAME

no

Basic auth username

LOKI_PASSWORD

no

Basic auth password

LOKI_BEARER_TOKEN

no

Bearer token authentication

LOKI_TLS_SKIP_VERIFY

no

false

Skip TLS certificate verification

LOKI_TENANT_ID

no

X-Scope-OrgID header for multi-tenant deployments

LOKI_HTTP_TIMEOUT

no

30s

HTTP request timeout (Go duration, e.g. 10s, 1m)

MCP_HTTP_ADDR

no

Listen address for the streamable HTTP transport, e.g. :8080. Unset means stdio

Note: Basic auth (LOKI_USERNAME/LOKI_PASSWORD) and bearer token (LOKI_BEARER_TOKEN) are mutually exclusive.

Transports

By default the server speaks MCP over stdio, which is what Claude Code, Claude Desktop and most local clients expect.

Set MCP_HTTP_ADDR to serve the streamable HTTP transport instead, for running the server as a remote endpoint behind a proxy or gateway:

LOKI_URL=http://loki:3100 MCP_HTTP_ADDR=:8080 loki-mcp-server
# MCP endpoint: http://localhost:8080/mcp

The HTTP mode is stateless, so it can run behind a load balancer with several replicas. It carries no authentication of its own — put it behind TLS and an authenticating proxy before exposing it, and remember that whoever reaches the endpoint can read every log line the configured LOKI_URL credentials can see.

Usage with Claude Code

Add to your Claude Code MCP configuration (~/.claude.json):

{
  "mcpServers": {
    "loki-mcp-server": {
      "type": "stdio",
      "command": "/path/to/loki-mcp-server",
      "args": [],
      "env": {
        "LOKI_URL": "http://loki:3100",
        "LOKI_USERNAME": "admin",
        "LOKI_PASSWORD": "secret"
      }
    }
  }
}

Usage with Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "loki-mcp-server": {
      "type": "stdio",
      "command": "/path/to/loki-mcp-server",
      "args": [],
      "env": {
        "LOKI_URL": "http://loki:3100",
        "LOKI_USERNAME": "admin",
        "LOKI_PASSWORD": "secret"
      }
    }
  }
}

Tools

query_range

Execute a LogQL range query against Loki to fetch logs over a time window.

Parameter

Type

Required

Default

Description

query

string

yes

LogQL query expression

start

string

no

1 hour ago

Start of time range (RFC3339 or Unix nano)

end

string

no

now

End of time range

limit

number

no

100

Max entries (max 5000)

direction

string

no

backward

forward or backward

query

Execute a LogQL instant query for point-in-time evaluation.

Parameter

Type

Required

Default

Description

query

string

yes

LogQL query expression

limit

number

no

100

Max entries (max 5000)

time

string

no

now

Evaluation timestamp

direction

string

no

backward

forward or backward

labels

List all available label names in Loki.

Parameter

Type

Required

Default

Description

start

string

no

6 hours ago

Start of time range

end

string

no

now

End of time range

label_values

List values for a specific label.

Parameter

Type

Required

Default

Description

label

string

yes

Label name

start

string

no

6 hours ago

Start of time range

end

string

no

now

End of time range

series

Find active log stream series matching a selector.

Parameter

Type

Required

Default

Description

match

string

yes

Stream selector (e.g. {app="nginx"})

start

string

no

6 hours ago

Start of time range

end

string

no

now

End of time range

Local Development Stack

A Docker Compose setup is included under deploy/ to spin up a full Loki environment for testing:

  • Loki — log storage at http://localhost:3100

  • Grafana — UI at http://localhost:3000 (anonymous admin, Loki pre-configured as datasource)

  • Promtail — collects container logs and ships them to Loki

  • Log generator — emits structured JSON logs with randomized apps (nginx, api, gateway, auth, payments), levels, and messages

# Start the stack
docker compose -f deploy/docker-compose.yml up -d

# Use loki-mcp-server against local Loki
LOKI_URL=http://localhost:3100 loki-mcp-server

# Stop the stack
docker compose -f deploy/docker-compose.yml down

Development

# Run tests
go test ./...

# Build
go build -o loki-mcp-server ./cmd/loki-mcp-server

# Vet
go vet ./...

⭐ If this project is useful for you, please star the repository.

Available Tools

5 tools
labelsA
Read-onlyIdempotent

List the label names Loki knows about in a time window.

Start here when the log schema is unknown: labels gives the names (app, namespace, level), then label_values gives the values for one of them, and together they let you write a valid selector for query_range. Only labels present on streams that received data inside the window are returned, so widening start/end surfaces more.

Returns the raw Loki JSON response: {"status","data":["label","names"]}. Read-only: it never writes to or mutates Loki.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoEnd of the time range, RFC3339 or Unix nanoseconds. Defaults to now.
startNoStart of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true. The description reinforces with 'Read-only: it never writes to or mutates Loki' and adds the raw return format ('{"status","data":["label","names"]}') plus the behavior about only labels present on streams with data in the window. This goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the purpose, then explain the workflow and return format. Every sentence earns its place, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with two optional parameters and no output schema, the description fully explains purpose, usage context, return format, and operational behavior. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (start and end documented with types, defaults, and format). The description adds the insight that widening start/end surfaces more labels, which is extra semantic value beyond the schema, but the core semantics are already covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' the resource 'label names' within 'Loki' and a time window. It differentiates itself from siblings by explicitly contrasting with label_values and query_range, and positioning itself as the starting point for schema discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly directs the agent: 'Start here when the log schema is unknown' and describes the sequence labels → label_values → query_range. It also gives a practical tip about widening start/end to surface more labels, making the intended use unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

label_valuesA
Read-onlyIdempotent

List the values a single label takes in Loki over a time window.

Use it after labels to fill in a selector: labels says "app" exists, label_values with label="app" says which apps are actually logging, and one of those goes into {app="..."} for query_range. Only values seen inside the window are returned, so widening start/end surfaces more.

Returns the raw Loki JSON response: {"status","data":["value","list"]}. An unknown label name is not an error; it comes back as an empty list. Read-only: it never writes to or mutates Loki.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoEnd of the time range, RFC3339 or Unix nanoseconds. Defaults to now.
labelYesLabel name to look up, as returned by the labels tool (e.g. app, namespace, level). Must match ^[a-zA-Z_][a-zA-Z0-9_]*$.
startNoStart of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the raw JSON response format, the empty-list behavior for unknown labels, and explicitly states 'Read-only: it never writes to or mutates Loki.' This adds behavioral context beyond the annotations (readOnlyHint, destructiveHint, idempotentHint) by clarifying exact response shape and error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is about 70 words, front-loaded with the core action, then logically flows into usage, behavior, and return format. Every sentence carries useful information, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers purpose, usage pattern, response format, edge cases (unknown label), read-only guarantee, and parameter interpretation. The presence of annotations and sibling context fills remaining gaps, making this fully self-sufficient for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema covers 100% of parameters, the description adds significant meaning: it ties start/end to the time-window semantics, gives an example ('app') for the label pattern, and explains the default values. This elevates the parameters from syntax to usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear, specific verb and resource ('List the values a single label takes in Loki over a time window') and immediately distinguishes it from siblings by explaining when to use it (after labels, before query_range). It names the exact context and how it fits the workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool: 'Use it after labels to fill in a selector' and walks through a concrete example (labels says 'app' exists, label_values gives actual values, one goes into query_range). It also notes the effect of widening start/end, giving clear guidance on parameter usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryA
Read-onlyIdempotent

Run a LogQL instant query against Loki, evaluating the expression at a single point in time.

Use this for metric expressions (rate, count_over_time, sum by) when one value per series is enough, or for a quick "what is happening right now" check. To read log lines across a time window, use query_range instead. To discover which labels exist before writing a selector, use labels and label_values.

Returns the raw Loki JSON response: {"status","data":{"resultType","result"}}, where resultType is "vector" for metric expressions and "streams" for log selectors. Read-only: it never writes to or mutates Loki.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeNoEvaluation timestamp, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to now.
limitNoMaximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000.
queryYesLogQL expression. Metric example: sum(rate({app="nginx"} |= "error" [5m])). Log example: {app="nginx"} |= "error".
directionNoOrder of returned log entries: backward (newest first, the default) or forward (oldest first).

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only and idempotent, but the description adds the exact return format (raw Loki JSON with resultType 'vector' or 'streams') and explicitly states 'never writes to or mutates Loki'. This goes beyond annotations by specifying output structure and result semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Compact and well-structured: core action first, then usage guidance, then return format, and finally safety. No filler; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description fully explains the return JSON and resultType. It also covers usage context, parameter guidance, and safety. For a read-only query tool, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, meeting the baseline, but the description adds value by explaining how the query parameter should be shaped (metric examples like rate, count_over_time) and clarifying that limit applies only to log selectors (though this is also in schema). The description reinforces parameter behavior without redundancy.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool runs a LogQL instant query against Loki, evaluates at a single point in time, and differentiates from query_range (time window) and labels/label_values (label discovery). The verb 'run' and resource 'Loki' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (metric expressions needing one value per series, quick 'what is happening right now' checks) and when not (query_range for time ranges, labels/label_values for label discovery). Names alternatives and conditions clearly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_rangeA
Read-onlyIdempotent

Run a LogQL range query against Loki, returning results across a time window.

This is the tool to reach for when reading logs: searching for errors, tailing a service over the last hour, or graphing a metric expression over time. Use query instead when a single point-in-time value is enough. If the selector is unknown, call labels and label_values first.

Returns the raw Loki JSON response: {"status","data":{"resultType","result"}}, where resultType is "streams" for log selectors and "matrix" for metric expressions. Loki truncates at limit entries, so a full result set may mean logs were cut off; narrow start/end or tighten the selector rather than raising limit. Read-only: it never writes to or mutates Loki.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoEnd of the time range, RFC3339 or Unix nanoseconds. Defaults to now.
limitNoMaximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000.
queryYesLogQL expression. Log example: {app="nginx"} |= "error" | json. Metric example: sum by (app) (rate({app="nginx"}[5m])).
startNoStart of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 1 hour ago.
directionNoOrder of returned log entries: backward (newest first, the default) or forward (oldest first). With backward and a hit limit, you keep the newest entries.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnlyHint, destructiveHint, idempotentHint. Description adds valuable behavior beyond those: truncation at limit with advice to narrow range, direction effect ('With backward and a hit limit, you keep the newest entries'), and explicit read-only statement. No contradiction; it enriches transparency with operational details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: purpose first, then usage guidance, then output format, then truncation caveat, then read-only note. Every sentence delivers distinct value—no filler. Front-loaded with the most important usage context. Appropriate length for a complex tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and complex behavior, the description explains the raw JSON response format, resultType meanings, truncation behavior, and parameter interactions. It also covers edge cases (metric expressions ignore limit, direction defaults). All necessary information for correct invocation is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. Description adds nuance: clarifies that limit applies only to log selectors (not metric expressions), explains direction's effect on truncation, and advises narrowing start/end rather than raising limit. This goes beyond schema's per-parameter descriptions, adding operational semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb ('Run a LogQL range query'), resource ('Loki'), and scope ('across a time window'). It explicitly distinguishes from sibling 'query' (point-in-time) and mentions 'labels' and 'label_values' as alternate tools. An agent can immediately understand what this tool does and how it differs from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: 'This is the tool to reach for when reading logs' and gives concrete scenarios (searching errors, tailing over an hour, graphing metrics). It specifies when to use 'query' instead and instructs to call 'labels' and 'label_values' first if selector unknown. Clear when/when-not with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

seriesA
Read-onlyIdempotent

List the log streams matching a selector, as complete label sets.

Use it to see which concrete streams a selector actually covers and what other labels they carry: {app="nginx"} may expand to one series per pod, region or level. That answers "does this selector match anything" and "how many streams am I about to read" without fetching log lines. For the lines themselves, use query_range; for label names and values in isolation, use labels and label_values.

Returns the raw Loki JSON response: {"status","data":[{"label":"value"}]}, one object per stream. A selector matching nothing comes back as an empty list. Read-only: it never writes to or mutates Loki.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoEnd of the time range, RFC3339 or Unix nanoseconds. Defaults to now.
matchYesStream selector in LogQL brace syntax, e.g. {app="nginx"} or {namespace="prod",level=~"error|warn"}. Line filters (|=) are not accepted here.
startNoStart of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the read-only safety is covered. The description adds valuable context beyond annotations: the exact return shape (raw Loki JSON with status/data), the empty-list behavior for no matches, and a concrete example of selector expansion. It also repeats the read-only guarantee, reinforcing but not contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet thorough, leading with the core action, then purpose, usage guidance, return format, and safety note. Every sentence adds new information—no redundant fluff. The alternative-tool routing is front-loaded and the response format is clearly specified up front, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with three parameters and no output schema, the description is exceptionally complete. It covers the raw JSON structure, empty-list case, read-only nature, selector expansion, and explicitly routes to sibling tools. Time range defaults are in the schema, and the description complements rather than duplicates, leaving nothing essential missing for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all three parameters at 100% with clear descriptions, including the match selector syntax and time range defaults. The description adds significant extra semantic value by explaining the expansion behavior ('{app="nginx"} may expand to one series per pod, region or level'), which directly illuminates how the match parameter behaves in practice, beyond a simple field description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('List the log streams matching a selector') and immediately clarifies it returns complete label sets. It explicitly differentiates from siblings by naming query_range, labels, and label_values as alternatives for different purposes, making the tool's unique role unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states exactly when to use this tool ('to see which concrete streams a selector actually covers', 'does this selector match anything', 'how many streams am I about to read') and gives explicit exclusions: 'For the lines themselves, use query_range; for label names and values in isolation, use labels and label_values.' This leaves no ambiguity about when to choose this tool over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.0.3
    • Changedlabel_values4 fields changed
      • changedInput schema / properties / end / description
        Previous value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now."
      • changedInput schema / properties / label / description
        Previous value: -"Label name to retrieve values for"New value: +"Label name to look up, as returned by the labels tool (e.g. app, namespace, level). Must match ^[a-zA-Z_][a-zA-Z0-9_]*$."
      • addedInput schema / properties / label / pattern
        Added value: +"^[a-zA-Z_][a-zA-Z0-9_]*$"
      • changedInput schema / properties / start / description
        Previous value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
    • Changedlabels2 fields changed
      • changedInput schema / properties / end / description
        Previous value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now."
      • changedInput schema / properties / start / description
        Previous value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
    • Changedquery5 fields changed
      • changedInput schema / properties / direction / description
        Previous value: -"Sort order: forward or backward. Defaults to backward"New value: +"Order of returned log entries: backward (newest first, the default) or forward (oldest first)."
      • addedInput schema / properties / direction / enum
        Added value: +[
        +  "forward",
        +  "backward"
        +]
      • changedInput schema / properties / limit / description
        Previous value: -"Maximum number of entries to return. Defaults to 100, max 5000"New value: +"Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000."
      • changedInput schema / properties / query / description
        Previous value: -"LogQL query expression"New value: +"LogQL expression. Metric example: sum(rate({app=\"nginx\"} |= \"error\" [5m])). Log example: {app=\"nginx\"} |= \"error\"."
      • changedInput schema / properties / time / description
        Previous value: -"Evaluation timestamp (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"Evaluation timestamp, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to now."
    • Changedquery_range6 fields changed
      • changedInput schema / properties / direction / description
        Previous value: -"Sort order: forward or backward. Defaults to backward"New value: +"Order of returned log entries: backward (newest first, the default) or forward (oldest first). With backward and a hit limit, you keep the newest entries."
      • addedInput schema / properties / direction / enum
        Added value: +[
        +  "forward",
        +  "backward"
        +]
      • changedInput schema / properties / end / description
        Previous value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now."
      • changedInput schema / properties / limit / description
        Previous value: -"Maximum number of entries to return. Defaults to 100, max 5000"New value: +"Maximum log entries to return. Applies to log selectors only; metric expressions ignore it. Defaults to 100, must not exceed 5000."
      • changedInput schema / properties / query / description
        Previous value: -"LogQL query expression"New value: +"LogQL expression. Log example: {app=\"nginx\"} |= \"error\" | json. Metric example: sum by (app) (rate({app=\"nginx\"}[5m]))."
      • changedInput schema / properties / start / description
        Previous value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 1 hour ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 1 hour ago."
    • Changedseries3 fields changed
      • changedInput schema / properties / end / description
        Previous value: -"End of time range (RFC3339 or Unix nanoseconds). Defaults to now"New value: +"End of the time range, RFC3339 or Unix nanoseconds. Defaults to now."
      • changedInput schema / properties / match / description
        Previous value: -"Stream selector (e.g. {app=\"nginx\"})"New value: +"Stream selector in LogQL brace syntax, e.g. {app=\"nginx\"} or {namespace=\"prod\",level=~\"error|warn\"}. Line filters (|=) are not accepted here."
      • changedInput schema / properties / start / description
        Previous value: -"Start of time range (RFC3339 or Unix nanoseconds). Defaults to 6 hours ago"New value: +"Start of the time range, RFC3339 (2026-03-25T10:00:00Z) or Unix nanoseconds. Defaults to 6 hours ago."
  2. 5 tool updatesv0.1.0
    • First observedlabel_values
    • First observedlabels
    • First observedquery
    • First observedquery_range
    • First observedseries

TDQS

A4.9/5.0

Scored across 5 tools

Disambiguation5/5

Each tool serves a distinct purpose: labels lists names, label_values lists values for a given label, query runs instant queries, query_range runs range queries, and series lists matching streams. No overlap or ambiguity between them.

Naming Consistency5/5

All tool names are in snake_case and follow a clear pattern: label_values, labels, query, query_range, series. They are consistent in style and predictable, with multi-word names clearly separated by underscores.

Tool Count5/5

With 5 tools, the server is well-scoped for a log querying service. Each tool is essential and there are no redundant or excessive entries.

Completeness5/5

The tool surface covers the full read-only workflow for Loki: discovering labels, discovering label values, running instant queries, running range queries, and checking stream coverage. No obvious gaps for typical use cases.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    D
    quality
    F
    maintenance
    An MCP interface that allows AI assistants to query and analyze Grafana Loki logs using LogQL, with support for authentication and various output formats.
    3
    108 npm
    6
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that enables querying logs and metrics from Graylog, Prometheus, and InfluxDB 2.x. It provides tools for executing Lucene log searches, PromQL queries, and Flux queries directly within MCP-compatible clients.
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    This MCP server enables natural-language querying of Grafana logs by automatically detecting log sources and service labels. It provides read-only access to log data with intelligent caching for efficient repeat queries.
    38 npm
    MIT
  • F
    license
    Not graded
    quality
    F
    maintenance
    An MCP server that enables AI assistants to query and analyze logs from Grafana Loki using LogQL, supporting label discovery and keyword search.
    4
    -