Allows searching and analyzing AWS CloudWatch logs, with tools for browsing log groups, listing log streams, searching logs with filter patterns, executing CloudWatch Logs Insights queries, and retrieving log group metadata.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@cloudwatch-mcp Search for errors in the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for searching and analyzing AWS CloudWatch logs. Supports configurable log groups, time-based searches, and service-specific log stream filtering.
list_log_groups - Browse available CloudWatch log groups
list_log_streams - Filter streams by prefix and date (perfect for service-based streams like sprive-backend-2026-02-20)
search_logs - Search logs by time range and CloudWatch filter patterns
query_logs_insights - Execute advanced CloudWatch Logs Insights queries
get_log_group_info - Get log group metadata (retention, storage, etc.)
Related MCP server: OpenSearch Logs MCP Server
No installation required. Add directly to your config:
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"cloudwatch": {
"command": "npx",
"args": ["-y", "github:nikhilchintawar/cloudwatch-mcp"],
"env": {
"AWS_REGION": "eu-west-2",
"AWS_PROFILE": "your-profile",
"CLOUDWATCH_LOG_GROUP": "/aws/eks/spv-default-prod-eks/application"
}
}
}
}Claude Code (~/.claude/settings.json):
{
"mcpServers": {
"cloudwatch": {
"command": "npx",
"args": ["-y", "github:nikhilchintawar/cloudwatch-mcp"],
"env": {
"AWS_REGION": "eu-west-2",
"AWS_PROFILE": "your-profile",
"CLOUDWATCH_LOG_GROUP": "/aws/eks/spv-default-prod-eks/application"
}
}
}
}# Clone the repository
git clone https://github.com/nikhilchintawar/cloudwatch-mcp.git
cd cloudwatch-mcp
# Install dependencies
npm install
# Build
npm run buildThen add to your config:
{
"mcpServers": {
"cloudwatch": {
"command": "node",
"args": ["/absolute/path/to/cloudwatch-mcp/build/index.js"],
"env": {
"AWS_REGION": "eu-west-2",
"AWS_PROFILE": "your-profile",
"CLOUDWATCH_LOG_GROUP": "/aws/eks/spv-default-prod-eks/application"
}
}
}
}Claude Desktop (macOS): ~/Library/Application Support/Claude/claude_desktop_config.json
Claude Desktop (Windows): %APPDATA%\Claude\claude_desktop_config.json
Claude Code: ~/.claude/settings.json
Variable | Required | Description |
| Yes | AWS region (e.g., |
| No | Default log group path |
| No | Default stream prefix filter |
The server uses the AWS SDK's default credential provider chain. Choose one method:
Option 1: AWS Profile (Recommended)
{
"env": {
"AWS_REGION": "eu-west-2",
"AWS_PROFILE": "your-profile-name"
}
}Option 2: Temporary Credentials
{
"env": {
"AWS_REGION": "eu-west-2",
"AWS_ACCESS_KEY_ID": "your-access-key",
"AWS_SECRET_ACCESS_KEY": "your-secret-key",
"AWS_SESSION_TOKEN": "your-session-token"
}
}Option 3: AWS SSO
# Login first
aws sso login --profile your-sso-profile{
"env": {
"AWS_REGION": "eu-west-2",
"AWS_PROFILE": "your-sso-profile"
}
}Option 4: IAM Role - Automatic when running on EC2, ECS, or Lambda.
Once configured, you can use natural language to interact with CloudWatch:
"Search for errors in the last hour"
"Show me logs from sprive-backend for today"
"Find all ERROR or WARN messages in the past 30 minutes"
"Run a Logs Insights query to count errors by service"
"List all log streams for 2026-02-20"
list_log_groupsList available CloudWatch log groups.
Parameter | Required | Description |
| No | Filter by name prefix |
| No | Max results (default: 50) |
list_log_streamsList log streams with smart date/service filtering.
Parameter | Required | Description |
| No | Log group name (uses env var default) |
| No | Filter by stream prefix (e.g., |
| No | Filter by date ( |
| No | Max results (default: 50) |
| No |
|
search_logsSearch logs using CloudWatch filter patterns.
Parameter | Required | Description |
| No | Log group name |
| No | Specific stream names to search |
| No | Filter streams by prefix |
| No | CloudWatch filter pattern |
| Yes | Relative ( |
| No | End time (default: now) |
| No | Max results (default: 100) |
query_logs_insightsExecute CloudWatch Logs Insights queries.
Parameter | Required | Description |
| No | Array of log group names |
| Yes | Logs Insights query string |
| Yes | Start time |
| No | End time (default: now) |
| No | Max results (default: 1000) |
get_log_group_infoGet detailed information about a log group.
Parameter | Required | Description |
| No | Log group name |
The startTime and endTime parameters support:
Relative: 30m, 1h, 2d, 1w (minutes, hours, days, weeks ago)
ISO 8601: 2026-02-20T14:30:00Z
Date: 2026-02-20
Unix timestamp: 1740067200000 (ms) or 1740067200 (s)
CloudWatch filter patterns for searching logs:
Simple text: ERROR
OR pattern: ?ERROR ?WARN
JSON field: { $.level = "error" }
Multiple conditions: { $.status >= 400 && $.duration > 1000 }
See AWS documentation for full syntax.
# Watch mode for development
npm run dev
# Build for production
npm run build
# Test with MCP Inspector
AWS_REGION=eu-west-2 AWS_PROFILE=your-profile \
npx @modelcontextprotocol/inspector node build/index.jsMIT
Get detailed information about a specific CloudWatch log group including retention settings and storage
| Name | Required | Description | Default |
|---|---|---|---|
| logGroup | No | Log group name. Uses CLOUDWATCH_LOG_GROUP env var if not provided |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It states 'get detailed information' but does not explicitly declare read-only behavior, side effects, permissions needed, or rate limits. While 'get' implies no mutation, the description lacks explicit behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundancy or fluff. It efficiently conveys the tool's purpose and includes one useful behavioral note about the environment variable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description partially covers return values by mentioning 'retention settings and storage', but it lacks details on other common fields like creation time, stored bytes, or metric filters. For a simple tool, this is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for the parameter, and the description adds value by noting that the logGroup parameter defaults to the CLOUDWATCH_LOG_GROUP environment variable. This provides context beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'get' and identifies the resource as 'CloudWatch log group', mentioning specific details like 'retention settings and storage'. It clearly distinguishes from sibling tools like list_log_groups, which lists groups, and query_logs_insights, which searches logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives (e.g., list_log_groups for listing, search_logs for searching). The description only implies that you need a specific log group name and mentions an environment variable fallback, but does not provide context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List available CloudWatch log groups with optional prefix filter
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of log groups to return (default: 50) | |
| prefix | No | Filter log groups by name prefix |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states the basic operation, omitting details like read-only nature, rate limits, pagination (though 'limit' hints at it), or what happens without a prefix. Important behavioral context is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that communicates the core action and optional filter. It is front-loaded with verb and object, but some additional context could be added without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (two optional parameters, no output schema, no annotations), the description is minimally adequate. However, it lacks information on pagination, return format, or that it lists all groups when no prefix is given. Completeness is sufficient but has gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter schema coverage is 100% with clear descriptions for both 'limit' and 'prefix'. The description adds 'optional prefix filter' but does not provide additional meaning beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the verb 'list', the resource 'CloudWatch log groups', and the optional prefix filter. It distinguishes from sibling tools like get_log_group_info (gets specific group info) and list_log_streams (lists streams within groups), so the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing log groups with an optional filter, but it does not explicitly state when to choose this tool over siblings or mention any prerequisites or alternatives. Usage context is implied but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List log streams in a log group with optional filtering by prefix and date (useful for service-based streams like "sprive-backend-2026-02-20")
| Name | Required | Description | Default |
|---|---|---|---|
| date | No | Filter streams containing this date (YYYY-MM-DD format) | |
| limit | No | Maximum number of streams to return (default: 50) | |
| prefix | No | Filter streams by name prefix (e.g., "sprive-backend") | |
| orderBy | No | Sort order for streams (default: LastEventTime) | LastEventTime |
| logGroup | No | Log group name. Uses CLOUDWATCH_LOG_GROUP env var if not provided |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It mentions filtering behavior and provides an example, but does not disclose pagination, rate limits, or sorting behavior beyond what is in the schema. The description is functional but minimally transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core action and includes a useful example. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a listing tool with no output schema, the description covers the main purpose and filtering options. It could mention return values or pagination behavior, but given the schema documents all parameters, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds a concrete example of how prefix and date work together, but does not significantly enhance understanding of the parameters beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'list log streams in a log group' with specific filtering options (prefix, date). A concrete example is given, and the tool is well-distinguished from siblings like list_log_groups and query_logs_insights.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through the example ('useful for service-based streams') but does not explicitly state when to use this tool versus siblings like query_logs_insights or search_logs. No when-not-to-use or alternative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute CloudWatch Logs Insights queries for advanced log analysis. Supports the full Logs Insights query syntax.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default: 1000) | |
| query | Yes | CloudWatch Logs Insights query string | |
| endTime | No | End time - relative or ISO 8601 (default: now) | |
| logGroups | No | Log group names to query. Uses CLOUDWATCH_LOG_GROUP env var if not provided | |
| startTime | Yes | Start time - relative (30m, 1h, 2d, 1w) or ISO 8601 |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavioral traits. It only states the tool supports full query syntax, but fails to mention whether the operation is read-only, any authorization requirements, rate limits, or what happens on error. This is insufficient for an execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences that efficiently convey the core purpose and capability. There is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and five parameters, the description is incomplete. It does not describe the return format, time range handling, or behavior for invalid queries. More context is needed for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all five parameters, so the descriptions already provide meaning. The tool description adds no additional parameter-level insight beyond 'supports the full query syntax' for the query parameter, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes CloudWatch Logs Insights queries for advanced log analysis, using a specific verb and resource. It effectively distinguishes from sibling tools like 'search_logs' by specifying that it supports the full Logs Insights query syntax.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions 'advanced log analysis' but does not give explicit context, prerequisites, or scenarios where this tool is preferred over sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search CloudWatch logs with filter patterns and time-based queries. Supports relative times (30m, 1h, 2d) and CloudWatch filter patterns.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of log events to return (default: 100) | |
| endTime | No | End time - relative or ISO 8601 or Unix timestamp (default: now) | |
| logGroup | No | Log group name. Uses CLOUDWATCH_LOG_GROUP env var if not provided | |
| startTime | Yes | Start time - relative (30m, 1h, 2d, 1w) or ISO 8601 or Unix timestamp | |
| logStreams | No | Specific log stream names to search. If not provided, searches all streams | |
| filterPattern | No | CloudWatch filter pattern (e.g., "ERROR", "?ERROR ?WARN", "{ $.level = "error" }") | |
| logStreamPrefix | No | Filter streams by prefix (e.g., "sprive-backend-2026-02-20") |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It only mentions input capabilities, not output format, pagination, rate limits, or any side effects. Minimal behavioral info is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no unnecessary words. Efficient but could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters and no output schema or annotations, the description lacks details on return format, default behavior, and how it compares to query_logs_insights. Incomplete for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are well-documented. The description adds context about relative time formats and CloudWatch filter patterns, but this is largely redundant with the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it searches CloudWatch logs using filter patterns and time-based queries. It distinguishes from siblings like list_log_groups and query_logs_insights by specifying the action and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by mentioning supported features, but does not explicitly state when to use this tool vs alternatives like query_logs_insights, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0get_log_group_infolist_log_groupslist_log_streamsquery_logs_insightssearch_logsScored across 5 tools
Each tool has a distinct purpose: getting details, listing groups, listing streams, advanced querying, and simple searching. However, `query_logs_insights` and `search_logs` could be confused for basic searches, though descriptions clarify their different syntaxes.
All tool names follow a consistent verb_noun pattern using snake_case, e.g., `get_log_group_info`, `list_log_groups`, `search_logs`. No mixing of conventions.
With 5 tools, the server covers essential log operations (listing, details, searching, advanced querying) without being bloated. The count is appropriate for a focused CloudWatch Logs interaction.
Core read and query operations are covered, but write operations (create/delete log groups, update retention) are missing. Agents can still work with existing resources, but cannot manage them fully.
Search log events, investigate anomalies, and manage cases in your Knowledge Grid tenant.
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
AWS Cost Explorer cost, forecast, and anomaly reporting through user-connected IAM credentials.
Read-only Amazon SES observability: search events, inspect bounces, pull delivery stats.
