sumologic-mcp

A local MCP server that lets AI assistants run Sumo Logic log searches over HTTP.

Prerequisites

• Node.js 18+

• A Sumo Logic Enterprise account with Search Job API access

• Sumo Logic API access key and ID (create one here)

Related MCP server: Graylog MCP Server

Setup

1. Install dependencies:

npm install

2. Copy the example env file and fill in your credentials:

cp .env.example .env

3. Set your deployment endpoint in .env. Examples:

4. Build and start:

npm run build
npm start

For development with auto-reload:

npm run dev

The server listens on http://localhost:3006 by default.

Cursor MCP configuration

Add this to your Cursor MCP config (~/.cursor/mcp.json):

{
  "mcpServers": {
    "sumologic": {
      "url": "http://localhost:3006/mcp"
    }
  }
}

Restart the MCP server in Cursor after starting the local server.

Available tools

search_sumologic

Run a Sumo Logic search and return results.

Example queries:

• Raw logs: * | where severity = "error" | limit 20

• Count by service: * | count by _sourceCategory

• Time-bounded: use from and to params with ISO 8601 timestamps

Use resultType: "messages" for raw log lines, records for aggregate/tabular results, and both when unsure.

Environment variables

Health check

curl http://localhost:3006/health

Notes

• Search results have PII fields (_raw, response) automatically redacted before being returned to the AI.

• The Search Job API requires session cookies across requests; this server handles that automatically.

• If you get a 403 error, your account may not have Enterprise Search Job API access.