Skip to main content
Glama
sandraschi

Observability MCP Server

analyze_log_patterns

Identifies common log patterns and error spikes using Loki queries over configurable time windows, helping detect anomalies and potential issues in observability data.

Instructions

Analyze log patterns and anomalies using Loki queries.

This tool identifies common log patterns, error spikes, and potential issues by analyzing log data over time windows.

Input Schema

NameRequiredDescriptionDefault
queryYesBase LogQL query to analyze
time_windowNoTime window for analysis (e.g., "1h", "24h", "7d")1h
min_occurrencesNoMinimum occurrences to consider a pattern significant

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It does convey that analysis happens over a time window and that patterns must meet a significance bar, but it omits whether the call is read-only, whether it requires a live Loki connection, and any cost/latency implications of scanning large windows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action. The second sentence partially restates the first ('identifies common log patterns' echoes 'analyze log patterns'), so it is efficient but not maximally tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and full schema coverage, return values and parameters are covered elsewhere. What is missing is the operational context an agent needs to choose this tool over its siblings and to know what kind of LogQL query is appropriate as input.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each of the three parameters is already documented in the schema, including the LogQL query base and time-window format. The description adds no further semantics such as whether the base query may contain aggregation or how min_occurrences interacts with the window.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Analyze log patterns and anomalies using Loki queries') and elaborates with what it surfaces: patterns, error spikes, potential issues. It is clearly distinguishable from raw retrieval tools like query_loki_logs, though it never names the sibling it differs from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by 'analyzing log data over time windows'. There is no explicit statement of when to choose this over query_loki_logs or correlate_logs_and_metrics, and no prerequisites or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.