# @rog0x/mcp-log-tools

Log analysis and processing tools for AI agents, exposed via the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/).

## Tools

### parse_logs

Parse log content in common formats: JSON logs, Apache/Nginx access logs, syslog, and structured logs. Supports custom regex patterns with named capture groups. Extracts timestamp, level, message, source, and additional structured fields.

### filter_logs

Filter parsed log entries by:

- Log level (ERROR, WARN, INFO, DEBUG)
- Date range (ISO 8601)
- Keyword search (case-insensitive)
- Regex pattern matching
- Source/logger name

Returns matched entries along with level occurrence counts.

### analyze_logs

Analyze log patterns to surface operational insights:

- Top 10 most frequent errors (normalized)
- Error rate over time (hourly buckets)
- Request volume per hour
- Slowest endpoints (from HTTP access logs)
- Anomaly detection (sudden spikes or drops using standard deviation)

### format_logs

Convert between log formats and produce reports:

- JSON to plain text, plain to JSON, CSV, or table
- ANSI colorization by log level
- Structured field extraction
- Summary report generation

### log_stats

Compute comprehensive log statistics:

- Total and non-empty line counts
- Level distribution with percentages
- Date range coverage
- Unique IP addresses and request counts
- Top user agents
- HTTP status code distribution
- Throughput (entries per second)

## Setup

```bash
npm install
npm run build
```

## Usage with Claude Desktop

Add to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "log-tools": {
      "command": "node",
      "args": ["path/to/mcp-log-tools/dist/index.js"]
    }
  }
}
```

## Supported Log Formats

| Format | Example |
|--------|---------|
| JSON | `{"timestamp":"2024-01-15T10:30:00Z","level":"ERROR","message":"Connection failed"}` |
| Apache/Nginx | `127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET /index.html HTTP/1.1" 200 2326` |
| Syslog | `Jan  1 00:00:00 hostname process[1234]: Something happened` |
| Structured | `2024-01-15T10:30:00.000Z [ERROR] [ModuleName] Something failed` |
| Custom | Any format using a regex with named capture groups |

## License

MIT