sumologic-mcp

A local MCP server that lets AI assistants run Sumo Logic log searches over HTTP.

Prerequisites

• Node.js 18+

• A Sumo Logic Enterprise account with Search Job API access

• Sumo Logic API access key and ID (create one here)

Related MCP server: LogScale MCP Server

Setup

1. Install dependencies:

npm install

2. Copy the example env file and fill in your credentials:

cp .env.example .env

3. Set your deployment endpoint in .env. Examples:

4. Build:

npm run build

Option A: Cursor launches the server automatically (recommended)

Cursor can spawn the MCP process for you over stdio — no need to run npm start manually.

Add this to your Cursor MCP config (~/.cursor/mcp.json):

{
  "mcpServers": {
    "sumologic": {
      "command": "node",
      "args": ["/absolute/path/to/sumologic-mcp/dist/index.js", "--stdio"],
      "env": {
        "ENDPOINT": "https://api.sumologic.com/api/v1",
        "SUMO_API_ID": "your-access-id",
        "SUMO_API_KEY": "your-access-key"
      }
    }
  }
}

Replace /absolute/path/to/sumologic-mcp with the real path to this repo. Credentials can also live in the project's .env file (loaded automatically from the project root).

For development without building, use npx tsx:

{
  "mcpServers": {
    "sumologic": {
      "command": "npx",
      "args": ["tsx", "/absolute/path/to/sumologic-mcp/src/index.ts", "--stdio"]
    }
  }
}

Restart or reload MCP servers in Cursor after changing the config.

Option B: HTTP server (local development)

Start the server manually:

npm start

For development with auto-reload:

npm run dev

HTTP mode requires MCP_API_KEY in your .env. Generate one with:

openssl rand -hex 32

The server listens on http://localhost:3006 by default.

Add this to your Cursor MCP config:

{
  "mcpServers": {
    "sumologic": {
      "url": "http://localhost:3006/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SUMOLOGIC_MCP_API_KEY}"
      }
    }
  }
}

Set SUMOLOGIC_MCP_API_KEY in your shell to match MCP_API_KEY in .env.

Restart the MCP server in Cursor after starting the local server.

Option C: Docker (public cloud hosting)

Run the MCP server on a cloud VM with TLS and API key authentication. Caddy terminates HTTPS and proxies to the app container; port 3006 is not exposed to the host.

Prerequisites

• A domain name (e.g. mcp.yourcompany.com) with an A record pointing to your VM's public IP

• Firewall rules allowing inbound traffic on ports 80 and 443 only

• Docker and Docker Compose installed on the VM

Setup

1. Copy and configure environment variables on the VM:

cp .env.example .env

Set these values in .env:

2. Start the stack:

docker compose up -d

Caddy obtains a Let's Encrypt certificate automatically for MCP_DOMAIN.

Verify deployment

Health check (no auth required):

curl https://mcp.yourcompany.com/health

MCP endpoint rejects unauthenticated requests:

curl -s -o /dev/null -w "%{http_code}" -X POST https://mcp.yourcompany.com/mcp
# Expected: 401

Authenticated request:

curl -X POST https://mcp.yourcompany.com/mcp \
  -H "Authorization: Bearer $MCP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}},"id":1}'

Cursor client config (remote)

{
  "mcpServers": {
    "sumologic": {
      "url": "https://mcp.yourcompany.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SUMOLOGIC_MCP_API_KEY}"
      }
    }
  }
}

Set SUMOLOGIC_MCP_API_KEY in your local shell to match MCP_API_KEY on the server.

Security notes

• Never commit .env or expose MCP_API_KEY in client configs — use ${env:...} interpolation

• Rotate MCP_API_KEY if it is leaked; all clients must update their env var

• Restrict the VM security group to known IP ranges if your team has fixed egress

• Sumo credentials stay server-side; clients only need the MCP Bearer token

Available tools

search_sumologic

Run a Sumo Logic search and return results.

Example queries:

• Raw logs: * | where severity = "error" | limit 20

• Count by service: * | count by _sourceCategory

• Time-bounded: use from and to params with ISO 8601 timestamps

Use resultType: "messages" for raw log lines, records for aggregate/tabular results, and both when unsure.

Environment variables

Health check

curl http://localhost:3006/health

Notes

• Search results have PII fields (_raw, response) automatically redacted before being returned to the AI.

• The Search Job API requires session cookies across requests; this server handles that automatically.

• If you get a 403 error, your account may not have Enterprise Search Job API access.