# Log Insight MCP Server

A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that connects AI assistants like Claude to [VMware Log Insight](https://docs.vmware.com/en/VMware-vRealize-Log-Insight/index.html), enabling natural-language log querying and analysis.

## Overview

This server acts as a bridge between MCP-compatible clients (such as Claude Code or Claude Desktop) and a VMware Log Insight instance. It exposes two tools that allow an AI assistant to query and analyze logs on your behalf:

- **`query_logs`** — Query logs between a start and end time, with an optional keyword filter.
- **`search_logs_for_errors`** — Search for error patterns (e.g. `error`, `critical`, `exception`, `fatal`, `fail`) within a time range.

The server manages authentication with Log Insight automatically, including session renewal and retry on expiry.

## Architecture

```
MCP Client (Claude)  ──HTTP POST──▶  MCP Server (:3000)  ──HTTPS──▶  Log Insight API (:9543)
                                       │
                                       ├─ /mcp      (MCP protocol endpoint)
                                       └─ /health   (health check)
```

**Key components:**

| File | Role |
|------|------|
| `src/index.ts` | HTTP server, MCP session management |
| `src/loginsight-client.ts` | Log Insight REST API client with auth handling |
| `src/tools/query-logs.ts` | MCP tool definitions and handlers |

## Prerequisites

- **Node.js** v18 or later
- **npm**
- A running **VMware Log Insight** instance accessible over the network

## Local Setup

### 1. Clone the repository

```bash
git clone <repo-url>
cd log-insight-mcp-server
```

### 2. Install dependencies

```bash
npm install
```

### 3. Configure environment variables

Create a `.env` file in the project root (or copy and edit the existing one):

```env
LOGINSIGHT_URL=https://your-loginsight-host
LOGINSIGHT_USERNAME=admin
LOGINSIGHT_PASSWORD=your-password
```

| Variable | Required | Description |
|----------|----------|-------------|
| `LOGINSIGHT_URL` | Yes | Base URL of your Log Insight instance (e.g. `https://10.10.10.119`) |
| `LOGINSIGHT_USERNAME` | Yes | Log Insight user with API access |
| `LOGINSIGHT_PASSWORD` | Yes | Password for the above user |
| `PORT` | No | Server port (defaults to `3000`) |

The server will exit with an error if any required variable is missing.

### 4. Build

```bash
npm run build
```

This compiles TypeScript from `src/` into `dist/`.

### 5. Run

**Production:**

```bash
npm start
```

**Development (watch mode):**

```bash
npm run dev
```

The server starts on `http://localhost:3000`. Verify it is running:

```bash
curl http://localhost:3000/health
```

## Connecting an MCP Client

### Claude Code

Add the server to your Claude Code MCP configuration:

```json
{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}
```

### Claude Desktop

Add to your Claude Desktop config (`claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}
```

Once connected, you can ask Claude questions like:

- *"Show me all logs from the last hour"*
- *"Search for errors between 2025-01-01T00:00:00Z and 2025-01-01T12:00:00Z"*
- *"Find any fatal or critical log entries from yesterday"*

## Available Tools

### `query_logs`

Query logs within a time range.

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `startTime` | string (ISO 8601) | Yes | Start of the time range |
| `endTime` | string (ISO 8601) | Yes | End of the time range |
| `keyword` | string | No | Text to search for in log messages |
| `limit` | number (1–20000) | No | Max results to return (default: 200) |

### `search_logs_for_errors`

Search for error-pattern logs within a time range.

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `startTime` | string (ISO 8601) | Yes | Start of the time range |
| `endTime` | string (ISO 8601) | Yes | End of the time range |
| `errorPattern` | string | No | Error keyword to match (default: `"error"`) |
| `limit` | number (1–20000) | No | Max results to return (default: 500) |

## Cloud Foundry Deployment

### Prerequisites

- [CF CLI](https://docs.cloudfoundry.org/cf-cli/install-go-cli.html) installed and logged in (`cf login`)
- Your Log Insight instance must be reachable from the CF environment

### Push with inline variables

The Node.js buildpack automatically runs `npm run build` during staging, so no local pre-build is needed. Supply credentials at deploy time so they never appear in committed files:

```bash
cf push \
  --var loginsight-url=https://your-loginsight-host \
  --var loginsight-username=admin \
  --var loginsight-password=your-password
```

### Push with a vars file

Alternatively, create a `vars.yml` file (already gitignored):

```yaml
loginsight-url: https://your-loginsight-host
loginsight-username: admin
loginsight-password: your-password
```

Then deploy:

```bash
cf push --vars-file vars.yml
```

### Verify

```bash
cf app log-insight-mcp
curl https://<your-app-route>/health
```

## Scripts

| Command | Description |
|---------|-------------|
| `npm start` | Run the server |
| `npm run dev` | Run in watch mode (auto-restart on changes) |
| `npm run build` | Compile TypeScript to `dist/` |

## License

ISC