The rlg-mcp server exposes RustLogs (rlg) log streams as MCP tools over stdio, enabling LLM agents to read, filter, and analyze structured log files via three tools:
tail_log: Retrieve the last N parseable rlg records from a log file (default: 100), rendered in Logfmt, with newest records last.
filter_log: Filter records by minimum severity level (TRACE, DEBUG, VERBOSE, INFO, WARN, ERROR, FATAL, CRITICAL), by component name, and render results in any supported rlg LogFormat (e.g., Logfmt, JSON).
summarize_errors: Scan a log file and return a JSON map of component → error_count for all ERROR-and-above records, providing a fast error taxonomy for triage.
All tools are read-only, idempotent, and non-destructive, making them safe for use by AI agents such as Claude Desktop, Cursor, or mcp.run agents.
This is the Cargo workspace root. The library lives at
crates/rlg. Ten companion crates ship from this
workspace, all at lockstep version 0.0.11.
Crate | What it does | Use case |
Near-lock-free structured logging engine. 65k-slot ring buffer, deferred formatting, 14 output formats, native OS sinks ( | Embed structured logging in any Rust binary or library. | |
| Pipe | |
Model Context Protocol server exposing rlg streams as tools to LLM agents. | Claude Desktop, Cursor, mcp.run agents reading your logs. | |
OpenTelemetry network exporter (OTLP/HTTP JSON). | Ship records to Honeycomb, Datadog, Tempo, Jaeger, otelcol. | |
| axum, tonic, hyper, | |
| Structured logging from JS or WASI 0.2 components. | |
PII / secret redaction between | Compliance, GDPR, audit-trail safety. Built-in patterns for cards, JWTs, bearers, emails, IPs, AWS keys. | |
Test utilities — capture rlg records in a | Downstream library tests verifying their structured log output. | |
Log digest / analytics: count by level, top components, top errors, latency percentiles. CLI + library mode. | Operational dashboards, daily error reports, oncall triage. | |
| Automatic host-level context on every record without app code changes. | |
|
| Maintainer automation. |
[dependencies]
rlg = "0.0.12"
rlg-otlp = "0.0.12" # ship to an OTLP collector
rlg-tower = "0.0.12" # HTTP middleware
rlg-redact = "0.0.12" # PII redaction
[dev-dependencies]
rlg-test = "0.0.12" # assertions in your testsCLI binaries:
cargo install rlg-cli # the `rlg` binary
cargo install rlg-mcp # the `rlg-mcp` MCP server
cargo install rlg-report # the `rlg-report` digest toolRelated MCP server: log-mcp
The MCP server crate, rlg-mcp, exposes rlg
log streams to LLM agents as three MCP tools over the stdio transport:
tail_log — path, optional n (default 100) → last n parseable records, rendered in Logfmt.
filter_log — path, optional min_level / component / format → records matching every supplied filter, in the chosen LogFormat.
summarize_errors — path → JSON map of component → error_count for ERROR-and-above records.
.
├── Cargo.toml # workspace manifest (profiles, members)
├── README.md # ← you are here
├── CHANGELOG.md / CONTRIBUTING.md / SECURITY.md
├── LICENSE-{APACHE,MIT}
├── crates/
│ ├── rlg/ # core library
│ ├── rlg-cli/ # `rlg` binary + filter/render lib
│ ├── rlg-mcp/ # MCP server
│ ├── rlg-otlp/ # OTLP/HTTP exporter
│ ├── rlg-tower/ # tower::Layer
│ ├── rlg-wasm/ # wasm-bindgen + WASI 0.2 component
│ ├── rlg-redact/ # PII / secret scrubber (Aho-Corasick)
│ ├── rlg-test/ # test utilities
│ ├── rlg-report/ # log digest binary + lib
│ ├── rlg-ebpf/ # Enricher trait + eBPF (Linux) scaffold
│ └── xtask/ # internal automation (publish = false)
└── .github/
└── workflows/
├── ci.yml # delegates to sebastienrousseau/pipelines
└── release.yml # workspace-aware crates.io publisherCore docs: crates/rlg/README.md · docs.rs/rlg
Contributing & signing policy: CONTRIBUTING.md
Security policy: SECURITY.md
Release notes: CHANGELOG.md
Dual-licensed under Apache 2.0 or MIT, at your option.
Select rlg records by minimum severity and/or component and render them in any rlg LogFormat. Use this to narrow a log to what matters (e.g. WARN-and-above for one service); use tail_log for a raw recent slice and summarize_errors when you only need per-component error totals.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Filesystem path to an rlg log file to read. | |
| format | No | rlg LogFormat name to render matched records in (e.g. Logfmt, JSON). Defaults to Logfmt. | Logfmt |
| component | No | Keep only records whose component matches this exact value. Omit to keep all components. | |
| min_level | No | Keep only records at or above this severity. Omit to keep all levels. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds behavioral context: it filters and renders records in a specified format, which is not in annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences, front-loaded with the core action, and every sentence adds value. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's 4 parameters, no output schema, and good annotations, the description covers purpose, parameters, usage guidance, and alternatives comprehensively. It is complete for an AI agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description references 'minimum severity and/or component', which maps to min_level and component parameters, but does not add significant meaning beyond what the schema already provides (e.g., format has defaults and examples in schema).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs and resources: 'Select rlg records by minimum severity and/or component and render them in any rlg LogFormat.' It clearly distinguishes itself from siblings by naming alternatives (tail_log, summarize_errors) and their purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is provided: 'Use this to narrow a log to what matters (e.g. WARN-and-above for one service); use tail_log for a raw recent slice and summarize_errors when you only need per-component error totals.' This tells both when to use this tool and when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Group ERROR-and-above rlg records by component and count them, giving a quick error taxonomy for triage. Use this for an at-a-glance failure breakdown; use filter_log when you need the underlying records rather than counts.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Filesystem path to an rlg log file to scan for ERROR-and-above records. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds context that it groups by component and only includes ERROR-and-above severity, which is useful beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, no unnecessary words. Second sentence provides usage guidance with sibling tool reference.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description completely explains what it does, how to use it, and when to choose alternatives. Annotations cover safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter 'path'. The description does not add new parameter details beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool groups ERROR-and-above rlg records by component and counts them, providing a quick error taxonomy. It distinguishes from sibling tool filter_log by noting it gives counts rather than underlying records.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use this tool ('for an at-a-glance failure breakdown') and when to use filter_log instead ('when you need the underlying records rather than counts').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the last N parseable rlg (RustLogs) records from a log file, newest last. Use this to glance at the most recent activity in a log; use filter_log when you need to select records by level or component, and summarize_errors for an aggregated error count.
| Name | Required | Description | Default |
|---|---|---|---|
| n | No | How many of the most recent parseable records to return (default 100). | |
| path | Yes | Filesystem path to an rlg log file (Logfmt/JSON records, one per line). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only, idempotent, non-destructive. The description adds that it returns only parseable records and newest-last ordering, which are behavioral details beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no redundancy. First sentence states purpose and behavior; second sentence provides usage guidance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tail tool with 2 parameters and no output schema, the description fully covers purpose, output ordering, file format (rlg, parseable), and usage context including siblings. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds context about log format (rlg) and ordering ('newest last'), which enriches understanding beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the last N parseable rlg records from a log file, newest last. It distinguishes from siblings (filter_log, summarize_errors) by naming them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool (glance at recent activity) and when to use alternatives (filter_log for level/component selection, summarize_errors for aggregated count).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
filter_logsummarize_errorstail_logThis server cannot be deployed
Scored across 3 tools
Each tool has a clearly distinct purpose: filter_log selects by severity/component, summarize_errors provides aggregated counts, and tail_log returns recent raw records. There is no overlap, and the descriptions explicitly guide when to use which.
All tool names follow a consistent verb_noun pattern in snake_case: filter_log, summarize_errors, tail_log. The verbs (filter, summarize, tail) are descriptive and predictable.
Three tools is an appropriate count for a focused logging server. Each tool provides a necessary operation (tail, filter, summarize) without redundancy or bloat.
The tool set covers the core operations for log analysis: tailing raw logs, filtering by severity/component, and summarizing errors. Minor gaps like searching by pattern could exist, but for the stated domain of rlg records, it is largely complete.
MCP server for progressive tool usage at any scale (see https://klavis.ai)
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Analytics for MCP servers. Find out which of your tools agents get wrong. MCPulse shows you which tools AI agents retry, which come back empty, and which they never call at all. Two lines inside your own server. It never sees your arguments or your results.
