Graylog MCP Server

list_streams

List readable Graylog streams with id, title, and default-stream exclusion status. Use titleContains to find a specific stream, as results are capped at limit.

Instructions

List the Graylog streams the API token can read (id + title, and whether each removes its matches from the Default Stream). To search everything, pass streams:"*" to search/analyze rather than listing streams here. A cluster can hold thousands of streams, so results are capped — use titleContains to find one specific named stream (e.g. a service whose logs are absent from the Default Stream).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "list_streams"
  }
}

Input Schema

Name	Required	Description
`limit`	No	Max streams to return. Default: 50.
`instance`	No	Graylog instance to query. Active: "instance_1". Default: "instance_1".
`titleContains`	No	Case-insensitive substring filter on the stream title.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.3.0Aug 7, 2026

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full weight. It discloses that results are capped ('results are capped'), that the API token limits readability, and what the listing includes. It doesn't mention pagination or rate limits, but the key behavioral trait (cap) is present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences. The first states purpose, the second gives an alternative, the third explains the cap and how to handle it. No wasted words, front-loaded, every sentence contributes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with no output schema, the description sufficiently explains return content, the cap, the filtering option, and the relationship to search/analyze. It covers all essential context an agent needs to decide and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context beyond schema: explains why limit exists (thousands of streams), why titleContains is useful (capped results), and gives an example. This elevates it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('List the Graylog streams...') with the resource (Graylog streams) and the returned fields (id + title, and whether it removes matches from the Default Stream). It clearly distinguishes from siblings by steering users to search/analyze for searching everything.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use an alternative: 'To search everything, pass streams:"*" to search/analyze rather than listing streams here.' Also instructs to use titleContains for finding a specific named stream, with a concrete use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server