OpenSearch Logs MCP Server
OpenSearch 日志 MCP 服务器
MCP (Model Context Protocol) 服务器,用于查询 OpenSearch 中的 OpenTelemetry 日志。支持开发 (dev) 和生产 (prod) 环境。
架构
该服务器遵循 SOLID 原则和整洁架构 (Clean Architecture):
src/
├── index.ts # Entry point
├── server.ts # MCP Server setup
├── config/
│ └── environments.ts # Environment configuration
├── types/
│ └── index.ts # Type definitions
├── services/
│ ├── opensearch-client.ts # HTTP client for OpenSearch
│ └── log-search.service.ts # Business logic
├── tools/
│ ├── tool-definitions.ts # Tool schemas
│ └── tool-handlers.ts # Tool execution
└── utils/
├── query-builder.ts # Query construction (Builder pattern)
└── time-range.ts # Time utilities应用原则
单一职责原则 (SRP):每个模块都有单一的职责
开闭原则 (OCP):无需修改现有代码即可轻松添加新工具
依赖倒置原则 (DIP):服务依赖于抽象(接口)
构建者模式 (Builder Pattern):使用
QueryBuilder进行流畅的查询构建
Related MCP server: otel-mcp-server
安装
cd Tools/mcp-opensearch-logs
npm install
npm run buildCursor 配置
将以下内容添加到你的 Cursor 配置 (~/.cursor/mcp.json) 中:
{
"mcpServers": {
"opensearch-logs": {
"command": "node",
"args": ["/ruta/al/proyecto/Tools/mcp-opensearch-logs/dist/index.js"],
"env": {
"OPENSEARCH_DEV_USERNAME": "tu-usuario-dev",
"OPENSEARCH_DEV_PASSWORD": "tu-password-dev",
"OPENSEARCH_PROD_USERNAME": "tu-usuario-prod",
"OPENSEARCH_PROD_PASSWORD": "tu-password-prod"
}
}
}
}可用工具
search_logs
使用 Lucene 语法的自由搜索。
参数 | 类型 | 必填 | 描述 | ||||
environment |
|
| ✅ | 要查询的环境 | |||
query | string | ✅ | Lucene 语法查询 | ||||
timeRange |
|
|
|
|
| ❌ | 时间范围 (默认: 1h) |
size | number | ❌ | 最大结果数 (默认: 50, 最大: 200) |
示例:
"搜索过去一小时内 dev 环境中包含 'error' 的日志"
"搜索过去 6 小时内 prod 环境中状态为 500 的日志"
search_by_trace
搜索 OpenTelemetry 追踪的所有日志。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
traceId | string | ✅ | 追踪 ID | |
size | number | ❌ | 最大结果数 (默认: 100) |
示例:
"获取 dev 环境中 trace abc123 的所有日志"
search_by_service
按服务名称过滤日志。
参数 | 类型 | 必填 | 描述 | ||||
environment |
|
| ✅ | 要查询的环境 | |||
serviceName | string | ✅ | 服务名称 | ||||
level |
|
|
|
|
| ❌ | 日志级别 |
query | string | ❌ | 附加查询 | ||||
timeRange | string | ❌ | 时间范围 | ||||
size | number | ❌ | 最大结果数 |
示例:
"搜索 prod 环境中 stori-ios 服务的日志"
"获取 dev 环境中 stori-ios 服务的错误日志"
search_errors
搜索 ERROR 或更高级别(severityNumber >= 17)的日志。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
serviceName | string | ❌ | 按服务过滤 | |
query | string | ❌ | 附加查询 | |
timeRange | string | ❌ | 时间范围 | |
size | number | ❌ | 最大结果数 |
示例:
"获取 prod 环境中过去一小时的错误"
"搜索 dev 环境中与 KYC 相关的错误"
get_field_values
获取字段的最常见值(聚合)。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
field | string | ✅ | 要聚合的字段 | |
size | number | ❌ | 唯一值的最大数量 (默认: 20) |
示例:
"prod 环境中 'event' 字段有哪些值?"
"获取 dev 环境中最常见的错误类型"
search_by_field
按特定字段和值进行搜索。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
field | string | ✅ | 字段名称 | |
value | string | ✅ | 要搜索的值 | |
timeRange | string | ❌ | 时间范围 | |
size | number | ❌ | 最大结果数 |
示例:
"搜索 prod 环境中 transactionId=abc123 的日志"
get_mapping
获取索引的字段映射。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
示例:
"prod 日志中有哪些可用字段?"
get_sample_log
获取示例日志以查看结构。
参数 | 类型 | 必填 | 描述 | |
environment |
|
| ✅ | 要查询的环境 |
示例:
"给我一个 prod 日志示例以查看其结构"
Lucene 搜索语法
query 字段支持完整的 Lucene 语法:
语法 | 描述 | 示例 |
| 在任何字段中搜索 |
|
| 在特定字段中搜索 |
|
| 通配符 |
|
| 两个词都包含 |
|
| 包含任意一个词 |
|
| 排除词 |
|
| 范围 |
|
| 精确匹配 |
|
时间范围
值 | 描述 |
| 最近 15 分钟 |
| 最近一小时 (默认) |
| 最近 6 小时 |
| 最近 24 小时 |
| 最近 7 天 |
开发
# Desarrollo con watch mode
npm run dev
# Build
npm run build
# Lint
npm run lintOpenTelemetry 日志结构
日志遵循 OpenTelemetry 模式:
{
"time": "2024-01-15T10:30:00.000Z",
"severityText": "ERROR",
"severityNumber": 17,
"body": "Error message",
"attributes": {
"event": "kyc_error",
"kycFlow": "creditL1",
"transactionId": "abc123"
},
"resource": {
"service.name": "stori-ios",
"service.version": "1.0.0"
}
}Available Tools
8 toolsget_field_valuesB
Get the most common values for a specific field. Useful for discovering available services, log levels, or other field values.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| field | Yes | The field to get values for. Examples: 'service.name', 'level', 'host.name' | |
| size | No | Maximum number of unique values to return (default: 20) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the tool retrieves 'most common values,' which implies a statistical or aggregated operation, but doesn't detail aspects like rate limits, authentication needs, error handling, or what 'most common' entails (e.g., based on frequency, time range). For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and followed by a concise usage hint. Every sentence earns its place by adding value: the first defines the action, and the second provides practical context. There is no redundancy or wasted words, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no annotations, no output schema, and moderate complexity (3 parameters with 2 required), the description is partially complete. It covers the purpose and hints at usage but lacks details on behavior, return values, or error cases. For a discovery tool with full schema coverage, it's adequate but has clear gaps in transparency and output expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema by implying the tool is for 'discovering' values, which contextualizes the 'field' parameter. However, it doesn't provide additional semantics, examples, or constraints not covered in the schema descriptions. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get the most common values for a specific field.' It specifies the verb ('Get') and resource ('most common values for a specific field'), and provides concrete examples ('services, log levels, or other field values') that help distinguish it from siblings like 'search_logs' or 'get_sample_log'. However, it doesn't explicitly differentiate from all siblings (e.g., 'get_mapping' might also retrieve field-related data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context with 'Useful for discovering available services, log levels, or other field values,' suggesting it's for exploration or discovery rather than searching or filtering. However, it doesn't explicitly state when to use this tool versus alternatives like 'search_by_field' or 'get_sample_log', nor does it provide exclusions or prerequisites. The guidance is helpful but not comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mappingA
Get the field mapping for the index. Useful for discovering available fields and their types.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It describes the tool's behavior as retrieving field mappings for discovery purposes, which implies a read-only, non-destructive operation. However, it doesn't disclose details like response format, potential errors, rate limits, or authentication needs. The description adds some context but lacks comprehensive behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured: two sentences that directly state the purpose and usage without any fluff. Every word earns its place, and it's front-loaded with the core functionality. This is an excellent example of efficient communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter, no output schema, no annotations), the description is somewhat complete but could be improved. It explains the tool's purpose and high-level use case but doesn't cover what the output looks like (e.g., structure of field mappings) or potential limitations. For a discovery tool, more details on the return format would enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with the 'environment' parameter fully documented including enum values and descriptions. The description doesn't add any parameter-specific information beyond what the schema provides, such as clarifying the 'index' context or field mapping details. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get the field mapping for the index' specifies both the action (get) and resource (field mapping). It distinguishes this from siblings like 'get_field_values' or 'search_by_field' by focusing on metadata discovery rather than data retrieval. However, it doesn't explicitly contrast with all siblings, keeping it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implied usage guidance: 'Useful for discovering available fields and their types' suggests this tool should be used for schema exploration. However, it doesn't explicitly state when to use this versus alternatives like 'get_field_values' (which might retrieve actual values) or when not to use it, nor does it mention prerequisites. This is adequate but lacks explicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_sample_logB
Get a single sample log entry to see the structure and available fields.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions retrieving a 'single sample log entry,' which implies a read-only operation, but doesn't specify if it's safe, if it requires authentication, rate limits, or what the return format looks like. For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior and constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently conveys the tool's purpose and intent without any wasted words. It's front-loaded with the main action ('Get a single sample log entry') and clearly states the goal ('to see the structure and available fields'), making it easy to parse and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, no output schema, no annotations), the description is adequate but not fully complete. It explains the purpose but lacks details on behavioral aspects like safety, return format, or how it differs from sibling tools. Without annotations or an output schema, the description should do more to cover these gaps, but it meets a minimum viable level for a basic read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't add any parameter-specific information beyond what's in the input schema, which has 100% coverage and fully documents the 'environment' parameter with its enum values and description. Since schema coverage is high, the baseline score is 3, as the schema handles the parameter semantics adequately without needing extra details from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get a single sample log entry to see the structure and available fields.' It specifies the verb ('Get'), resource ('sample log entry'), and intent ('to see the structure and available fields'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'search_logs' or 'search_by_field', which might also retrieve log data, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating the tool is for seeing 'structure and available fields,' suggesting it's used for exploration or understanding log formats. However, it doesn't provide explicit guidance on when to use this tool versus alternatives like 'search_logs' or other search tools, nor does it mention any exclusions or prerequisites. The usage is clear in context but lacks detailed comparative advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_fieldC
Search logs by a specific field and value.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| field | Yes | The field name to search. Examples: 'user_id', 'request_id', 'endpoint' | |
| value | Yes | The value to search for | |
| timeRange | No | Time range to search within | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions searching logs but doesn't describe what type of logs, the data source, authentication requirements, rate limits, error handling, or what the output looks like. For a search tool with 5 parameters and no annotations, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It's appropriately sized for the tool's complexity and front-loads the core functionality without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no annotations, no output schema, and multiple sibling tools, the description is incomplete. It doesn't explain the search scope, result format, or how it differs from other search tools. For a search operation in a log system with complex parameters, more context is needed to guide effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal semantic context beyond the input schema, which has 100% coverage with detailed descriptions for all parameters. It mentions 'specific field and value,' which aligns with the 'field' and 'value' parameters but doesn't provide additional insights like field examples beyond those in the schema or how the search is performed. With high schema coverage, the baseline is 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Search logs by a specific field and value,' which is a specific verb+resource combination. However, it doesn't distinguish this tool from sibling tools like 'search_by_service,' 'search_by_trace,' or 'search_logs,' which all appear to search logs but with different criteria.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With multiple sibling search tools available (e.g., search_by_service, search_by_trace, search_errors), there's no indication of when field-based searching is preferred over other search methods or what distinguishes this tool from 'search_logs.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_serviceC
Search logs filtered by service name, optionally with additional filters.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| serviceName | Yes | The service name to filter by | |
| level | No | Log level to filter by | |
| query | No | Additional free-text query to apply | |
| timeRange | No | Time range to search within | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but lacks behavioral details. It doesn't disclose whether this is a read-only operation, potential rate limits, authentication needs, or what the return format looks like (e.g., pagination, structure). The phrase 'Search logs' implies querying, but no further context on behavior is given, leaving significant gaps for a tool with 6 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('Search logs filtered by service name') and adds optional context. There's no wasted verbiage, though it could be slightly more structured by explicitly listing key parameters or alternatives.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no output schema, no annotations), the description is incomplete. It doesn't explain return values, error handling, or behavioral traits like pagination or rate limits. While the schema covers parameters well, the overall context for effective tool use is lacking, especially for a search operation with multiple siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 6 parameters with descriptions and enums. The description adds minimal value beyond implying serviceName is the primary filter and other filters are optional, but doesn't provide additional syntax or meaning. This meets the baseline of 3 when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Search logs filtered by service name' with a verb ('Search') and resource ('logs'), plus the primary filter ('by service name'). It distinguishes from some siblings like 'search_errors' or 'search_by_trace' by specifying service-based filtering, though it doesn't explicitly contrast with 'search_by_field' or 'search_logs' which might overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance with 'optionally with additional filters,' implying flexibility but not specifying when to use this tool versus alternatives. No explicit when/when-not rules or named alternatives are mentioned, leaving the agent to infer usage from sibling tool names like 'search_by_field' or 'search_errors' without clear differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_by_traceA
Search logs by OpenTelemetry trace ID to see all logs related to a specific request/transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| traceId | Yes | The OpenTelemetry trace ID to search for | |
| size | No | Maximum number of results to return (default: 100) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions searching logs but doesn't disclose behavioral traits like whether this is a read-only operation, potential rate limits, authentication requirements, or what happens with invalid trace IDs. The description is functional but lacks operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently communicates the tool's purpose without unnecessary words. It's front-loaded with the core functionality and every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 3 parameters and no output schema, the description adequately explains what the tool does but lacks information about return format, result structure, or error handling. Without annotations, it should provide more operational context for a tool that presumably returns log data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, providing complete parameter documentation. The description doesn't add meaning beyond what the schema already explains about environment options, trace ID purpose, or size default. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Search logs'), resource ('by OpenTelemetry trace ID'), and purpose ('to see all logs related to a specific request/transaction'). It distinguishes itself from sibling tools like 'search_by_field', 'search_by_service', and 'search_logs' by specifying the unique trace-based search method.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by mentioning 'request/transaction' tracing, but doesn't explicitly state when to use this tool versus alternatives like 'search_by_field' or 'search_logs'. No exclusions or prerequisites are provided, leaving the agent to infer appropriate scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_errorsC
Search for error logs, optionally filtered by service or additional query.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| serviceName | No | Optional service name to filter by | |
| query | No | Additional free-text query to apply | |
| timeRange | No | Time range to search within (default: 1h) | |
| size | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states it searches error logs with optional filtering, but doesn't disclose behavioral traits like whether this is a read-only operation, rate limits, authentication needs, pagination behavior, or what the return format looks like. For a search tool with 5 parameters and no annotations, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero waste. Efficiently states purpose and key optional features without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 5 parameters, no annotations, and no output schema, the description is inadequate. It doesn't explain return values, error handling, or behavioral constraints, leaving significant gaps for an AI agent to understand how to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 5 parameters thoroughly with descriptions and enums. The description adds minimal value beyond implying filtering capabilities, matching the baseline 3 when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Search') and resource ('error logs'), with optional filtering by service or query. It distinguishes from some siblings like 'get_field_values' or 'get_sample_log' by focusing on errors, but doesn't explicitly differentiate from 'search_logs' or 'search_by_service' which might overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'search_logs', 'search_by_service', or 'search_by_trace'. The description mentions optional filtering but doesn't provide context for choosing between these search tools or specify prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsA
Search OpenSearch logs with a free-text query. Supports Lucene query syntax. Examples: 'error AND authentication', 'status:500', 'message:timeout'
| Name | Required | Description | Default |
|---|---|---|---|
| environment | Yes | Environment to search: 'dev'/'prod' (iOS) or 'android-dev'/'android-prod' (Android) | |
| query | Yes | Free-text search query using Lucene syntax. Examples: 'error', 'status:500 AND service.name:auth' | |
| timeRange | No | Time range to search within. Defaults to 1h if not specified. | |
| size | No | Maximum number of results to return (default: 50, max: 200) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the query syntax (Lucene) and provides examples, but lacks details on permissions, rate limits, pagination, or error handling, which are important for a search operation with multiple parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by syntax support and examples in a single, efficient sentence. Every element (purpose, syntax, examples) earns its place without redundancy, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (4 parameters, no output schema, no annotations), the description covers the basic purpose and syntax but lacks completeness in behavioral aspects like result format, limitations, or error scenarios, which would help an agent use it more effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all parameters. The description adds value by providing query syntax examples (e.g., 'error AND authentication'), but does not explain parameter interactions or default behaviors beyond what the schema already states, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Search OpenSearch logs') and resource ('logs'), and distinguishes it from siblings by specifying 'free-text query' with Lucene syntax, which differentiates it from field-specific searches like search_by_field or search_by_service.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (searching logs with free-text queries using Lucene syntax), but does not explicitly mention when not to use it or name specific alternatives among the sibling tools, such as search_by_field for structured searches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.0.0- First observed
get_field_values - First observed
get_mapping - First observed
get_sample_log - First observed
search_by_field - First observed
search_by_service - First observed
search_by_trace - First observed
search_errors - First observed
search_logs
TDQS
Scored across 8 tools
Most tools have distinct purposes, but there is some overlap between search_by_field, search_by_service, search_errors, and search_logs, which could cause confusion about which to use for specific filtering needs. However, the descriptions clarify their specialized roles, such as search_by_service for service filtering and search_errors for error-specific queries, reducing ambiguity.
All tool names follow a consistent verb_noun pattern with snake_case, such as get_field_values, search_by_trace, and search_logs. This uniformity makes the tool set predictable and easy to understand, enhancing usability for agents.
With 8 tools, the server is well-scoped for log analysis in OpenSearch, covering essential operations like discovery (get_field_values, get_mapping, get_sample_log) and various search methods. Each tool serves a clear purpose without feeling excessive or insufficient for the domain.
The tool set provides strong coverage for log querying and discovery, including field analysis, sample inspection, and multiple search types. A minor gap is the lack of tools for log management operations like deleting or exporting logs, but core workflows for analysis are well-supported.
Maintenance
Related MCP Connectors
Ingest and search LogsLoom logs from coding agents.
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
- SuperlogOAuthsh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Search log events, investigate anomalies, and manage cases in your Knowledge Grid tenant.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides seamless access to Kibana and Periscope logs through a unified API with KQL and SQL querying, AI-powered log analysis, and support for searching across 1.3+ billion logs in 9 indexes.1-
- AlicenseNot gradedqualityDmaintenanceEnables natural language querying and analysis of OpenTelemetry traces, metrics, and logs stored in Elasticsearch/OpenSearch, allowing AI assistants to investigate performance issues, find root causes, and explore system behavior.12 npm14MIT
- FlicenseAqualityDmaintenanceEnables searching and analyzing AWS CloudWatch logs with support for configurable log groups, time-based searches, and service-specific log stream filtering.5-
- AlicenseAqualityDmaintenanceEnables querying and analyzing Datadog logs through search, aggregation, and index listing.37 npmMIT