# sumo-logic-mcp

MCP server for Sumo Logic — 48 tools for searching logs, managing monitors, alerts, dashboards, collectors, metrics, content library, users, roles, fields, partitions, lookup tables, and ingest budgets.

Generic and org-agnostic. Any team can plug in their own Sumo Logic credentials and start querying.

> **Note:** This is an experimental, community-driven project — not an official Sumo Logic product. Feel free to test it and use it.

## Installation

```bash
pip install sumo-logic-mcp
```

Or run without installing (via [uv](https://docs.astral.sh/uv/)):

```bash
uvx sumo-logic-mcp
```

## Setup

### 1. Get Access Credentials

1. Log in to your Sumo Logic account (e.g., `https://<your-org>.sumologic.com`)
2. Click on your profile icon (top right) and go to **Preferences**
3. Scroll to **My Access Keys** and click **Add Access Key**
4. Give it a name, leave scopes to default or set as needed
5. Copy both the **Access ID** and **Access Key**

### 2. Configure Your MCP Client

Add to your MCP client configuration (e.g., `~/.cursor/mcp.json` or Claude Desktop config):

```json
{
  "mcpServers": {
    "sumologic": {
      "command": "uvx",
      "args": ["sumo-logic-mcp"],
      "env": {
        "SUMOLOGIC_ACCESS_ID": "<your-access-id>",
        "SUMOLOGIC_ACCESS_KEY": "<your-access-key>",
        "SUMOLOGIC_ENDPOINT": "https://api.sumologic.com"
      }
    }
  }
}
```

**Or run directly:**

```bash
export SUMOLOGIC_ACCESS_ID="your-access-id"
export SUMOLOGIC_ACCESS_KEY="your-access-key"
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp
```

## Tool Reference

### Search & Analytics (4 tools)

| Tool | Description | Required Params |
|---|---|---|
| `search_logs` | Execute a log search (full lifecycle: create job, poll, fetch, cleanup) | `query` |
| `get_search_status` | Check status of a running search job | `job_id` |
| `get_search_results` | Fetch messages or records from a search job | `job_id` |
| `cancel_search` | Cancel a running search job | `job_id` |

**`search_logs` optional params:** `from_time` (default `-15m`), `to_time` (default `now`), `timezone` (default `UTC`), `limit` (default `100`), `by_receipt_time`, `timeout` (default `300s`).

**Time formats:** ISO 8601 (`2024-01-15T09:00:00`), relative (`-15m`, `-1h`, `-2d`, `-1w`), epoch ms (`1718745600000`), or `now`.

### Monitor Management (10 tools)

| Tool | Description | Required Params |
|---|---|---|
| `list_monitors` | List all monitors | — |
| `search_monitors` | Search by name or status filter | `query` |
| `get_monitor` | Get full monitor configuration | `monitor_id` |
| `create_monitor` | Create a new monitor | `name`, `query`, `threshold` |
| `update_monitor` | Update monitor config (read-modify-write) | `monitor_id`, `fields_json` |
| `delete_monitor` | Delete a monitor (irreversible) | `monitor_id` |
| `enable_monitor` | Enable a disabled monitor | `monitor_id` |
| `disable_monitor` | Disable a monitor | `monitor_id` |
| `get_monitor_status` | Get current health/triggering state | `monitor_id` |
| `get_monitor_history` | Get alert history for a monitor | `monitor_id` |

### Alert Management (3 tools)

| Tool | Description | Required Params |
|---|---|---|
| `get_active_alerts` | Get all currently firing alerts | — |
| `get_alert_details` | Get detailed alert info for a monitor | `monitor_id` |
| `resolve_alert` | Resolve an alert by disabling its monitor | `monitor_id` |

### Dashboard Management (5 tools)

| Tool | Description | Required Params |
|---|---|---|
| `list_dashboards` | List dashboards with pagination | — |
| `get_dashboard` | Get full dashboard config | `dashboard_id` |
| `create_dashboard` | Create a dashboard with panels and layout | `title`, `panels_json`, `layout_json` |
| `update_dashboard` | Update dashboard config (read-modify-write) | `dashboard_id`, `fields_json` |
| `delete_dashboard` | Delete a dashboard (irreversible) | `dashboard_id` |

### Collector & Source Management (8 tools)

| Tool | Description | Required Params |
|---|---|---|
| `list_collectors` | List all collectors | — |
| `get_collector` | Get collector configuration | `collector_id` |
| `create_hosted_collector` | Create a new Hosted collector | `name` |
| `update_collector` | Update collector config (with ETag locking) | `collector_id`, `fields_json` |
| `delete_collector` | Delete a collector and its sources | `collector_id` |
| `list_sources` | List sources on a collector | `collector_id` |
| `get_source` | Get source configuration | `collector_id`, `source_id` |
| `create_http_source` | Create an HTTP source (returns endpoint URL) | `collector_id`, `name` |

### Metrics (4 tools)

| Tool | Description | Required Params |
|---|---|---|
| `query_metrics` | Execute a metrics query | `query` |
| `list_metric_definitions` | Discover available metric names | — |
| `get_metric_metadata` | Get dimensions for a metric | `metric_name` |
| `list_metric_namespaces` | List metric content types | — |

### Content Library (3 tools)

| Tool | Description | Required Params |
|---|---|---|
| `get_personal_folder` | Get your personal content folder and children | — |
| `get_folder` | Get a folder and its child items | `folder_id` |
| `get_content_by_path` | Look up content by library path | `path` |

### Administration (8 tools)

| Tool | Description | Required Params |
|---|---|---|
| `list_users` | List all users with emails, roles, status | — |
| `list_roles` | List roles with capabilities and filters (v2) | — |
| `list_fields` | List all fields (built-in + custom) | — |
| `list_field_extraction_rules` | List FERs with scopes and parse expressions | — |
| `list_partitions` | List partitions with routing and retention | — |
| `list_lookup_tables` | List lookup tables with schemas | — |
| `get_lookup_table` | Get a lookup table's config and fields | `table_id` |
| `list_ingest_budgets` | List ingest budgets with scopes and capacity | — |

### Utility (3 tools)

| Tool | Description | Required Params |
|---|---|---|
| `check_connection` | Verify API connectivity and auth | — |
| `get_account_usage` | Get account status and ingestion info | — |
| `validate_query` | Check if a query is syntactically valid | `query` |

## Usage Examples

Once configured, just ask your AI assistant naturally:

```
"Search for 500 errors in the last hour"
"Show me all critical alerts"
"Create a monitor for high error rates on our API"
"List all hosted collectors"
"What CPU metrics are available?"
"Show me the field extraction rules"
"List all partitions and their retention periods"
```

## Development

```bash
git clone https://github.com/rajfirke/sumo-logic-mcp.git
cd sumo-logic-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

# Lint
ruff check src/ tests/

# Test
pytest -v

# Run locally
export SUMOLOGIC_ACCESS_ID="..."
export SUMOLOGIC_ACCESS_KEY="..."
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp
```

## Architecture

```
src/sumo_logic_mcp/
├── __init__.py          # Exports mcp, triggers tool registration
├── __main__.py          # Entry point: python -m sumo_logic_mcp
├── server.py            # FastMCP instance + lifespan (shared HTTP client)
├── client.py            # Async HTTP client (httpx, Basic Auth, retry, cookies)
├── validation.py        # Time parsing and validation
└── tools/
    ├── __init__.py      # Imports all tool modules
    ├── search.py        # 4 search tools
    ├── monitors.py      # 10 monitor tools
    ├── alerts.py        # 3 alert tools
    ├── dashboards.py    # 5 dashboard tools
    ├── collectors.py    # 8 collector/source tools
    ├── metrics.py       # 4 metrics tools
    ├── content.py       # 3 content library tools
    ├── admin.py         # 8 admin tools (users, roles, fields, partitions, etc.)
    └── utils.py         # 3 utility tools
```