OpenSearch Logs MCP Server
Provides tools for querying OpenTelemetry logs stored in OpenSearch, supporting search by Lucene syntax, trace ID, service name, error levels, field values, and index mapping across development and production environments.
Enables querying and analysis of OpenTelemetry log data, including structured logs with attributes, resource information, and trace-based correlation for distributed tracing workflows.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@OpenSearch Logs MCP Serversearch errors in prod from the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
OpenSearch Logs MCP Server
MCP (Model Context Protocol) server for querying OpenTelemetry logs in OpenSearch. Supports development (dev) and production (prod) environments.
Architecture
The server follows SOLID principles and Clean Architecture:
src/
├── index.ts # Entry point
├── server.ts # MCP Server setup
├── config/
│ └── environments.ts # Environment configuration
├── types/
│ └── index.ts # Type definitions
├── services/
│ ├── opensearch-client.ts # HTTP client for OpenSearch
│ └── log-search.service.ts # Business logic
├── tools/
│ ├── tool-definitions.ts # Tool schemas
│ └── tool-handlers.ts # Tool execution
└── utils/
├── query-builder.ts # Query construction (Builder pattern)
└── time-range.ts # Time utilitiesApplied Principles
Single Responsibility (SRP): Each module has a single responsibility
Open/Closed (OCP): Easy to add new tools without modifying existing code
Dependency Inversion (DIP): Services depend on abstractions (interfaces)
Builder Pattern:
QueryBuilderfor fluent query construction
Related MCP server: otel-mcp-server
Installation
cd Tools/mcp-opensearch-logs
npm install
npm run buildConfiguration in Cursor
Add this to your Cursor configuration (~/.cursor/mcp.json):
{
"mcpServers": {
"opensearch-logs": {
"command": "node",
"args": ["/ruta/al/proyecto/Tools/mcp-opensearch-logs/dist/index.js"],
"env": {
"OPENSEARCH_DEV_USERNAME": "tu-usuario-dev",
"OPENSEARCH_DEV_PASSWORD": "tu-password-dev",
"OPENSEARCH_PROD_USERNAME": "tu-usuario-prod",
"OPENSEARCH_PROD_PASSWORD": "tu-password-prod"
}
}
}
}Available Tools
search_logs
Free-text search with Lucene syntax.
Parameter | Type | Required | Description | ||||
environment |
|
| ✅ | Environment to query | |||
query | string | ✅ | Query in Lucene syntax | ||||
timeRange |
|
|
|
|
| ❌ | Time range (default: 1h) |
size | number | ❌ | Maximum results (default: 50, max: 200) |
Examples:
"Search for logs containing 'error' in dev from the last hour"
"Search for logs with status 500 in prod from the last 6 hours"
search_by_trace
Search all logs for an OpenTelemetry trace.
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
traceId | string | ✅ | Trace ID | |
size | number | ❌ | Maximum results (default: 100) |
Example:
"Give me all logs for trace abc123 in dev"
search_by_service
Filter logs by service name.
Parameter | Type | Required | Description | ||||
environment |
|
| ✅ | Environment to query | |||
serviceName | string | ✅ | Service name | ||||
level |
|
|
|
|
| ❌ | Log level |
query | string | ❌ | Additional query | ||||
timeRange | string | ❌ | Time range | ||||
size | number | ❌ | Maximum results |
Examples:
"Search for logs from the stori-ios service in prod"
"Give me errors from the stori-ios service in dev"
search_errors
Search for logs with level ERROR or higher (severityNumber >= 17).
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
serviceName | string | ❌ | Filter by service | |
query | string | ❌ | Additional query | |
timeRange | string | ❌ | Time range | |
size | number | ❌ | Maximum results |
Examples:
"Give me errors from the last hour in prod"
"Search for errors related to KYC in dev"
get_field_values
Get the most common values for a field (aggregation).
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
field | string | ✅ | Field to aggregate | |
size | number | ❌ | Maximum unique values (default: 20) |
Examples:
"What values does the 'event' field have in prod?"
"Give me the most common error types in dev"
search_by_field
Search by a specific field and value.
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
field | string | ✅ | Field name | |
value | string | ✅ | Value to search | |
timeRange | string | ❌ | Time range | |
size | number | ❌ | Maximum results |
Example:
"Search for logs with transactionId=abc123 in prod"
get_mapping
Get the index field mapping.
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
Example:
"What fields are available in the prod logs?"
get_sample_log
Get a sample log to see the structure.
Parameter | Type | Required | Description | |
environment |
|
| ✅ | Environment to query |
Example:
"Give me a sample log from prod to see the structure"
Lucene Search Syntax
The query field supports full Lucene syntax:
Syntax | Description | Example |
| Search in any field |
|
| Search in specific field |
|
| Wildcard |
|
| Both terms |
|
| Either term |
|
| Exclude term |
|
| Range |
|
| Exact match |
|
Time Ranges
Value | Description |
| Last 15 minutes |
| Last hour (default) |
| Last 6 hours |
| Last 24 hours |
| Last 7 days |
Development
# Desarrollo con watch mode
npm run dev
# Build
npm run build
# Lint
npm run lintOpenTelemetry Log Structure
Logs follow the OpenTelemetry schema:
{
"time": "2024-01-15T10:30:00.000Z",
"severityText": "ERROR",
"severityNumber": 17,
"body": "Error message",
"attributes": {
"event": "kyc_error",
"kycFlow": "creditL1",
"transactionId": "abc123"
},
"resource": {
"service.name": "stori-ios",
"service.version": "1.0.0"
}
}Available Tools
8 toolsget_field_valuesB
Get the most common values for a specific field. Useful for discovering available services, log levels, or other field values.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| field | Yes | The field to get values for. Examples: 'service.name', 'level', 'host.name' | |
| size | No | Maximum number of unique values to return (default: 20) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the tool retrieves 'most common values,' which implies a statistical or aggregated operation, but doesn't detail aspects like rate limits, authentication needs, error handling, or what 'most common' entails (e.g., based on frequency, time range). For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and followed by a concise usage hint. Every sentence earns its place by adding value: the first defines the action, and the second provides practical context. There is no redundancy or wasted words, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no annotations, no output schema, and moderate complexity (3 parameters with 2 required), the description is partially complete. It covers the purpose and hints at usage but lacks details on behavior, return values, or error cases. For a discovery tool with full schema coverage, it's adequate but has clear gaps in transparency and output expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema by implying the tool is for 'discovering' values, which contextualizes the 'field' parameter. However, it doesn't provide additional semantics, examples, or constraints not covered in the schema descriptions. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get the most common values for a specific field.' It specifies the verb ('Get') and resource ('most common values for a specific field'), and provides concrete examples ('services, log levels, or other field values') that help distinguish it from siblings like 'search_logs' or 'get_sample_log'. However, it doesn't explicitly differentiate from all siblings (e.g., 'get_mapping' might also retrieve field-related data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context with 'Useful for discovering available services, log levels, or other field values,' suggesting it's for exploration or discovery rather than searching or filtering. However, it doesn't explicitly state when to use this tool versus alternatives like 'search_by_field' or 'get_sample_log', nor does it provide exclusions or prerequisites. The guidance is helpful but not comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mappingA
Get the field mapping for the index. Useful for discovering available fields and their types.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It describes the tool's behavior as retrieving field mappings for discovery purposes, which implies a read-only, non-destructive operation. However, it doesn't disclose details like response format, potential errors, rate limits, or authentication needs. The description adds some context but lacks comprehensive behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured: two sentences that directly state the purpose and usage without any fluff. Every word earns its place, and it's front-loaded with the core functionality. This is an excellent example of efficient communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter, no output schema, no annotations), the description is somewhat complete but could be improved. It explains the tool's purpose and high-level use case but doesn't cover what the output looks like (e.g., structure of field mappings) or potential limitations. For a discovery tool, more details on the return format would enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with the 'environment' parameter fully documented including enum values and descriptions. The description doesn't add any parameter-specific information beyond what the schema provides, such as clarifying the 'index' context or field mapping details. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get the field mapping for the index' specifies both the action (get) and resource (field mapping). It distinguishes this from siblings like 'get_field_values' or 'search_by_field' by focusing on metadata discovery rather than data retrieval. However, it doesn't explicitly contrast with all siblings, keeping it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implied usage guidance: 'Useful for discovering available fields and their types' suggests this tool should be used for schema exploration. However, it doesn't explicitly state when to use this versus alternatives like 'get_field_values' (which might retrieve actual values) or when not to use it, nor does it mention prerequisites. This is adequate but lacks explicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_sample_logB
Get a single sample log entry to see the structure and available fields.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions retrieving a 'single sample log entry,' which implies a read-only operation, but doesn't specify if it's safe, if it requires authentication, rate limits, or what the return format looks like. For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior and constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently conveys the tool's purpose and intent without any wasted words. It's front-loaded with the main action ('Get a single sample log entry') and clearly states the goal ('to see the structure and available fields'), making it easy to parse and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, no output schema, no annotations), the description is adequate but not fully complete. It explains the purpose but lacks details on behavioral aspects like safety, return format, or how it differs from sibling tools. Without annotations or an output schema, the description should do more to cover these gaps, but it meets a minimum viable level for a basic read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't add any parameter-specific information beyond what's in the input schema, which has 100% coverage and fully documents the 'environment' parameter with its enum values and description. Since schema coverage is high, the baseline score is 3, as the schema handles the parameter semantics adequately without needing extra details from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get a single sample log entry to see the structure and available fields.' It specifies the verb ('Get'), resource ('sample log entry'), and intent ('to see the structure and available fields'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'search_logs' or 'search_by_field', which might also retrieve log data, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating the tool is for seeing 'structure and available fields,' suggesting it's used for exploration or understanding log formats. However, it doesn't provide explicit guidance on when to use this tool versus alternatives like 'search_logs' or other search tools, nor does it mention any exclusions or prerequisites. The usage is clear in context but lacks detailed comparative advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_fieldC
Search logs by a specific field and value.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| field | Yes | The field name to search. Examples: 'user_id', 'request_id', 'endpoint' | |
| value | Yes | The value to search for | |
| timeRange | No | Time range to search within | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions searching logs but doesn't describe what type of logs, the data source, authentication requirements, rate limits, error handling, or what the output looks like. For a search tool with 5 parameters and no annotations, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It's appropriately sized for the tool's complexity and front-loads the core functionality without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no annotations, no output schema, and multiple sibling tools, the description is incomplete. It doesn't explain the search scope, result format, or how it differs from other search tools. For a search operation in a log system with complex parameters, more context is needed to guide effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal semantic context beyond the input schema, which has 100% coverage with detailed descriptions for all parameters. It mentions 'specific field and value,' which aligns with the 'field' and 'value' parameters but doesn't provide additional insights like field examples beyond those in the schema or how the search is performed. With high schema coverage, the baseline is 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Search logs by a specific field and value,' which is a specific verb+resource combination. However, it doesn't distinguish this tool from sibling tools like 'search_by_service,' 'search_by_trace,' or 'search_logs,' which all appear to search logs but with different criteria.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With multiple sibling search tools available (e.g., search_by_service, search_by_trace, search_errors), there's no indication of when field-based searching is preferred over other search methods or what distinguishes this tool from 'search_logs.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_serviceC
Search logs filtered by service name, optionally with additional filters.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| serviceName | Yes | The service name to filter by | |
| level | No | Log level to filter by | |
| query | No | Additional free-text query to apply | |
| timeRange | No | Time range to search within | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but lacks behavioral details. It doesn't disclose whether this is a read-only operation, potential rate limits, authentication needs, or what the return format looks like (e.g., pagination, structure). The phrase 'Search logs' implies querying, but no further context on behavior is given, leaving significant gaps for a tool with 6 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('Search logs filtered by service name') and adds optional context. There's no wasted verbiage, though it could be slightly more structured by explicitly listing key parameters or alternatives.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no output schema, no annotations), the description is incomplete. It doesn't explain return values, error handling, or behavioral traits like pagination or rate limits. While the schema covers parameters well, the overall context for effective tool use is lacking, especially for a search operation with multiple siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 6 parameters with descriptions and enums. The description adds minimal value beyond implying serviceName is the primary filter and other filters are optional, but doesn't provide additional syntax or meaning. This meets the baseline of 3 when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Search logs filtered by service name' with a verb ('Search') and resource ('logs'), plus the primary filter ('by service name'). It distinguishes from some siblings like 'search_errors' or 'search_by_trace' by specifying service-based filtering, though it doesn't explicitly contrast with 'search_by_field' or 'search_logs' which might overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance with 'optionally with additional filters,' implying flexibility but not specifying when to use this tool versus alternatives. No explicit when/when-not rules or named alternatives are mentioned, leaving the agent to infer usage from sibling tool names like 'search_by_field' or 'search_errors' without clear differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_traceA
Search logs by OpenTelemetry trace ID to see all logs related to a specific request/transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| traceId | Yes | The OpenTelemetry trace ID to search for | |
| size | No | Maximum number of results to return (default: 100) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions searching logs but doesn't disclose behavioral traits like whether this is a read-only operation, potential rate limits, authentication requirements, or what happens with invalid trace IDs. The description is functional but lacks operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently communicates the tool's purpose without unnecessary words. It's front-loaded with the core functionality and every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 3 parameters and no output schema, the description adequately explains what the tool does but lacks information about return format, result structure, or error handling. Without annotations, it should provide more operational context for a tool that presumably returns log data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, providing complete parameter documentation. The description doesn't add meaning beyond what the schema already explains about environment options, trace ID purpose, or size default. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Search logs'), resource ('by OpenTelemetry trace ID'), and purpose ('to see all logs related to a specific request/transaction'). It distinguishes itself from sibling tools like 'search_by_field', 'search_by_service', and 'search_logs' by specifying the unique trace-based search method.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by mentioning 'request/transaction' tracing, but doesn't explicitly state when to use this tool versus alternatives like 'search_by_field' or 'search_logs'. No exclusions or prerequisites are provided, leaving the agent to infer appropriate scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_errorsC
Search for error logs, optionally filtered by service or additional query.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| serviceName | No | Optional service name to filter by | |
| query | No | Additional free-text query to apply | |
| timeRange | No | Time range to search within (default: 1h) | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states it searches error logs with optional filtering, but doesn't disclose behavioral traits like whether this is a read-only operation, rate limits, authentication needs, pagination behavior, or what the return format looks like. For a search tool with 5 parameters and no annotations, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero waste. Efficiently states purpose and key optional features without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 5 parameters, no annotations, and no output schema, the description is inadequate. It doesn't explain return values, error handling, or behavioral constraints, leaving significant gaps for an AI agent to understand how to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 5 parameters thoroughly with descriptions and enums. The description adds minimal value beyond implying filtering capabilities, matching the baseline 3 when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Search') and resource ('error logs'), with optional filtering by service or query. It distinguishes from some siblings like 'get_field_values' or 'get_sample_log' by focusing on errors, but doesn't explicitly differentiate from 'search_logs' or 'search_by_service' which might overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'search_logs', 'search_by_service', or 'search_by_trace'. The description mentions optional filtering but doesn't provide context for choosing between these search tools or specify prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsA
Search OpenSearch logs with a free-text query. Supports Lucene query syntax. Examples: 'error AND authentication', 'status:500', 'message:timeout'
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| query | Yes | Free-text search query using Lucene syntax. Examples: 'error', 'status:500 AND service.name:auth' | |
| timeRange | No | Time range to search within. Defaults to 1h if not specified. | |
| size | No | Maximum number of results to return (default: 50, max: 200) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the query syntax (Lucene) and provides examples, but lacks details on permissions, rate limits, pagination, or error handling, which are important for a search operation with multiple parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by syntax support and examples in a single, efficient sentence. Every element (purpose, syntax, examples) earns its place without redundancy, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (4 parameters, no output schema, no annotations), the description covers the basic purpose and syntax but lacks completeness in behavioral aspects like result format, limitations, or error scenarios, which would help an agent use it more effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all parameters. The description adds value by providing query syntax examples (e.g., 'error AND authentication'), but does not explain parameter interactions or default behaviors beyond what the schema already states, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Search OpenSearch logs') and resource ('logs'), and distinguishes it from siblings by specifying 'free-text query' with Lucene syntax, which differentiates it from field-specific searches like search_by_field or search_by_service.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (searching logs with free-text queries using Lucene syntax), but does not explicitly mention when not to use it or name specific alternatives among the sibling tools, such as search_by_field for structured searches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v1.0.0- First observed
get_field_values - First observed
get_mapping - First observed
get_sample_log - First observed
search_by_field - First observed
search_by_service - First observed
search_by_trace - First observed
search_errors - First observed
search_logs
TDQS
Most tools have distinct purposes, but there is some overlap between search_by_field, search_by_service, search_errors, and search_logs, which could cause confusion about which to use for specific filtering needs. However, the descriptions clarify their specialized roles, such as search_by_service for service filtering and search_errors for error-specific queries, reducing ambiguity.
All tool names follow a consistent verb_noun pattern with snake_case, such as get_field_values, search_by_trace, and search_logs. This uniformity makes the tool set predictable and easy to understand, enhancing usability for agents.
With 8 tools, the server is well-scoped for log analysis in OpenSearch, covering essential operations like discovery (get_field_values, get_mapping, get_sample_log) and various search methods. Each tool serves a clear purpose without feeling excessive or insufficient for the domain.
The tool set provides strong coverage for log querying and discovery, including field analysis, sample inspection, and multiple search types. A minor gap is the lack of tools for log management operations like deleting or exporting logs, but core workflows for analysis are well-supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
- SuperlogOAuthsh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Query Honeycomb observability data: traces, events, metrics, SLOs, triggers, and boards.
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides seamless access to Kibana and Periscope logs through a unified API with KQL and SQL querying, AI-powered log analysis, and support for searching across 1.3+ billion logs in 9 indexes.1-
- AlicenseNot gradedqualityDmaintenanceEnables natural language querying and analysis of OpenTelemetry traces, metrics, and logs stored in Elasticsearch/OpenSearch, allowing AI assistants to investigate performance issues, find root causes, and explore system behavior.1614MIT
- FlicenseAqualityDmaintenanceEnables searching and analyzing AWS CloudWatch logs with support for configurable log groups, time-based searches, and service-specific log stream filtering.5-
- AlicenseAqualityDmaintenanceEnables querying and analyzing Datadog logs through search, aggregation, and index listing.313MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/luis-dominguez-stori/MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server