Log Pruner MCP Server
Query OpenSearch API directly to retrieve log entries and return compact tables.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Log Pruner MCP Server read logs from /var/log/app.log"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Log Pruner MCP Server
A Python MCP server that reduces token usage by ~98% when working with log files. Auto-detects file format, strips noise (kubernetes metadata, duplicate fields, boilerplate), and returns only actionable signal. Works with any common log format — no manual conversion needed.
Tools
Tool | What it does |
| Read any log file, return compact table. Auto-detects format and log type (HTTP vs application). |
| Query OpenSearch API directly, return compact table |
| Aggregate summary: level distribution, top loggers/endpoints, error rates |
| Full detail for errors — HTTP 5xx, app-log ERROR/WARN, ImpEx failures, stack traces |
| All entries within N seconds of a timestamp — like |
Related MCP server: AgentCost
Supported Formats
Structured (JSON-based)
Format | Example source |
OpenSearch/Elasticsearch JSON | Kibana export, API response ( |
NDJSON |
|
JSON Array | API responses, custom export tools ( |
OpenSearch/Kibana CSV | Kibana Discover CSV export (with |
Plain Text
Format | Pattern |
Spring Boot |
|
Log4j / Logback |
|
Python logging |
|
Nginx / Apache access |
|
Docker container |
|
Syslog |
|
Generic ISO + level |
|
Generic ISO timestamp |
|
Format detection is automatic — just pass any log file path. No configuration needed.
Log Type Auto-Detection
Type | Detection | Output |
HTTP Access Logs | Has status code, request line, response time | Compact table: timestamp, status, ms, bytes, IP, request |
Application Logs | Has level, message, thread/logger | Compact table: timestamp, level, thread, message |
If HTTP parsing yields no results, tools automatically fall back to application log parsing.
Domain-Specific Error Detection
SAP Commerce ImpEx
get_errors recognizes ImpEx deployment failures that are often logged at INFO level:
dumped: N(where N > 0) — lines that couldn't be importedcould not import N lines— final failure summaryCan not resolve any more lines— resolution failureImpex import failed— SystemSetupExceptionSHUTTING DOWN— context startup failure
These are surfaced as [IMPEX FAILURE] entries alongside regular errors.
The pattern detection system is extensible — add your own domain-specific patterns to
IMPEX_ERROR_PATTERNSinsrc/parser.py.
Setup
1. Install dependencies
cd log-pruner
pip install -r requirements.txt2. Configure OpenSearch (optional, for live API access)
export OPENSEARCH_URL="https://your-opensearch-cluster:9200"
export OPENSEARCH_USER="admin"
export OPENSEARCH_PASSWORD="secret"3. Add to Claude Code
{
"mcpServers": {
"log-pruner": {
"command": "python",
"args": ["/absolute/path/to/log-pruner/server.py"]
}
}
}For live OpenSearch access, add one entry per environment with connection details:
{
"mcpServers": {
"log-pruner-dev": {
"command": "python",
"args": ["/absolute/path/to/log-pruner/server.py"],
"env": {
"OPENSEARCH_URL": "https://dev-opensearch-cluster:9200",
"OPENSEARCH_USER": "admin",
"OPENSEARCH_PASSWORD": "dev-password"
}
},
"log-pruner-staging": {
"command": "python",
"args": ["/absolute/path/to/log-pruner/server.py"],
"env": {
"OPENSEARCH_URL": "https://staging-opensearch-cluster:9200",
"OPENSEARCH_USER": "admin",
"OPENSEARCH_PASSWORD": "staging-password"
}
}
}
}4. Restart Claude Code
5. Add to your project's CLAUDE.md
## Log Analysis
When the user provides a log file or asks to analyze/debug logs:
- Do NOT read the file with the built-in Read tool — it will flood context
- Pass the file path to the log-pruner MCP tools which strip ~98% of noise:
- `mcp__log-pruner__read_logs` — compact table from any log file
- `mcp__log-pruner__summarize_logs` — overview (level distribution, top loggers, error rates)
- `mcp__log-pruner__get_errors` — all errors with full detail
- `mcp__log-pruner__get_context` — entries around a specific timestamp
- `mcp__log-pruner__query_logs` — query live OpenSearch (requires env vars)Usage Examples
Any Plain Text Log File
read_logs(path="app.log")
→ 1327 app log entries
TIMESTAMP | LVL | THREAD | MESSAGE
2026-06-06T15:12:44Z | INFO | main | Starting application
2026-06-06T15:12:45Z | ERROR | http-nio-8080-exec-1 | NullPointerException at line 42
2026-06-06T15:12:46Z | WARN | scheduler-1 | Job took 5000msNginx/Apache Access Logs
read_logs(path="access.log", status_filter="5xx")
→ 3 hits (of 50000 total)
TIMESTAMP | ST | MS | BYTES | FROM | REQUEST
12/Jun/2026:10:53:07Z | 500 | | 56 | 10.0.0.2 | POST /api/login
12/Jun/2026:10:53:09Z | 502 | | 0 | 10.0.0.3 | GET /api/usersNDJSON (kubectl logs, docker logs)
read_logs(path="pod-logs.json")
→ 500 app log entries
TIMESTAMP | LVL | THREAD | MESSAGE
2026-06-06T15:12:44Z | ERROR | | Connection refused
2026-06-06T15:12:45Z | INFO | | Retrying in 5s...Aggregate Summary
summarize_logs(path="deployment.log")
→ === App Log Summary (3808 entries) ===
Level distribution:
INFO: 3749 (98.5%)
WARN: 55 (1.4%)
ERROR: 4 (0.1%)
Top 10 loggers:
3012x de.hybris.platform.impex.jalo.imp.ImpExWorker
215x de.hybris.platform.servicelayer.impex.impl.DefaultImportService
...
Warnings/Errors (22 unique):
[WARN] column absolute of type Discount is read-only...
[ERROR] Can not resolve any more lines...Error Detection (with ImpEx awareness)
get_errors(path="deployment.log")
→ === ImpEx Failures (3) ===
[IMPEX FAILURE] 2026-06-06T15:12:46Z
Thread: main
Logger: de.hybris.platform.impex.jalo.cronjob.ImpExImportJob
Message: Can not resolve any more lines ... Aborting further passes (at pass 3).
=== Errors (2) ===
[ERROR] 2026-06-06T15:12:46Z
Thread: main
Logger: de.hybris.platform.core.Initialization
Message: SystemSetupException: Impex import failed for : '00037874-ImpEx-Import'Troubleshooting Workflow
1. read_logs(path="file.log") → Quick scan (compact, low tokens)
2. summarize_logs(path="file.log") → Level distribution, top loggers
3. get_errors(path="file.log") → All errors + ImpEx failures
4. get_context(path="file.log", timestamp="..") → Entries around a specific timeToken Savings



Input | Without log-pruner | With log-pruner | Savings |
10-hit OpenSearch JSON | ~2,500 tokens | ~50 tokens | ~98% |
4MB CSV export (3,800 rows) | ~400,000 tokens | ~3,000 tokens | ~99% |
1000-line Spring Boot log | ~15,000 tokens | ~200 tokens | ~99% |
Nginx access log (10k lines) | ~150,000 tokens | ~500 tokens | ~99% |
Error extraction from any format | ~400,000 tokens | ~500 tokens | ~99% |
Limitations
Plain text parsing relies on pattern matching — custom formats without a recognized timestamp pattern won't be parsed (lines are skipped)
Application log parsing expects JSON in the
logfield or directlevel/messagefieldsImpEx detection is pattern-based — custom error messages outside the known patterns won't be caught
API mode requires
opensearch-pyand env vars configuredTime filtering uses string comparison (works for ISO timestamps; approximate for other formats)
Available Tools
5 toolsget_contextA
Get full log entries around a specific timestamp — like grep -C for logs. Shows what happened before and after an event for troubleshooting.
Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). timestamp: Center timestamp (ISO format, e.g. "2026-06-03T01:05:05Z"). window_seconds: Seconds before and after timestamp to include (default 5). pod: Optional pod name filter — only show entries from this pod. limit: Max entries to return (default 50).
Inputs: pod, path, index, limit, +2 more. Returns: result
get_errorsA
Get full detail for non-200 responses (errors). Shows stack traces, log bodies, pod info — everything needed for troubleshooting.
Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). query: Additional Lucene query for API mode. time_from: ISO timestamp lower bound. time_to: ISO timestamp upper bound. limit: Max error entries to return (default 20). context_before: Number of log entries to show before each error (default 0). Set to 20 to see what happened leading up to the error.
Inputs: path, index, limit, query, +3 more. Returns: result
query_logsA
Query OpenSearch directly and return compact log table. Requires OPENSEARCH_URL env var.
Args: index: OpenSearch index pattern (e.g. "logs-json-"). query: Lucene query string (e.g. "status:500 AND logs.requestFirstLine:/api/users*"). time_from: ISO timestamp lower bound (e.g. "2026-06-03T01:00:00Z"). time_to: ISO timestamp upper bound. limit: Max entries to fetch (default 50). status_filter: Client-side filter by HTTP status after fetch. min_response_time: Client-side filter by min response time (ms).
Inputs: index (required), limit, query, time_to, +3 more. Returns: result
read_logsA
Read an OpenSearch log file (JSON or CSV) and return compact log table. Strips kubernetes metadata, duplicate fields — ~98% token reduction. Supports both HTTP access logs and application logs (auto-detected).
Args: path: Path to the OpenSearch JSON or CSV export file. limit: Max entries to return (default 100). status_filter: Only show entries with this HTTP status (e.g. "500", "4xx"). Only applies to HTTP access logs. min_response_time: Only show entries slower than this (ms). Only applies to HTTP access logs. time_from: ISO timestamp lower bound filter (e.g. "2026-06-03T01:05:05Z"). time_to: ISO timestamp upper bound filter.
Inputs: path (required), limit, time_to, time_from, +2 more. Returns: result
summarize_logsA
Aggregate log summary: top endpoints, error rates, slowest requests, unique IPs. Provide either path (file) or index (API).
Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). query: Lucene query string for API mode. time_from: ISO timestamp lower bound for API mode. time_to: ISO timestamp upper bound for API mode. limit: Max entries to analyze (default 200).
Inputs: path, index, limit, query, +2 more. Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 5 tools
Each tool has a distinct purpose: get_context retrieves logs around a timestamp, get_errors filters errors, query_logs queries OpenSearch directly, read_logs reads from a file, and summarize_logs aggregates. No two tools overlap in functionality.
All tool names follow a consistent verb_noun pattern in snake_case: get_context, get_errors, query_logs, read_logs, summarize_logs. The naming is predictable and clear.
With 5 tools, the server is well-scoped for log analysis. Each tool covers a specific operation (read, query, error extraction, context, summary) without redundancy or excessive complexity.
The tool set covers all essential log analysis operations: reading, querying, error inspection, context retrieval, and summarization. No obvious gaps for the intended domain of log troubleshooting.
Maintenance
Related MCP Connectors
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
Syslog receiver and MCP server for homelab log intelligence.
Syslog receiver and MCP server for homelab log intelligence.
Analytics for MCP servers. Find out which of your tools agents get wrong. MCPulse shows you which tools AI agents retry, which come back empty, and which they never call at all. Two lines inside your own server. It never sees your arguments or your results. getmcpulse.com
Related MCP Servers
- FlicenseBqualityDmaintenanceA Python-based MCP server that enables AI-assisted log file analysis with features for filtering, parsing, and interpreting log outputs, plus executing and analyzing test runs with varying verbosity levels.1212-
- AlicenseNot gradedqualityDmaintenanceMCP server that analyzes AI agent session logs to find token waste and optimization opportunities.19 npmMIT
- AlicenseAqualityDmaintenanceMCP server for log file analysis. Gives LLMs the ability to efficiently analyze large log files without loading them into context.7101MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides structure-aware code analysis (symbol trees, dependencies, docs) to reduce AI agent token consumption by up to 99%, along with Git commit intelligence.MIT