de en es ja ko ru zh

log-analyzer-mcp

Name: log-analyzer-mcp
Author: yufeizhou666

by yufeizhou666

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

log-analyzer-mcp

一个提供日志分析和系统指标工具的 MCP（模型上下文协议）服务器。通过 stdio 传输连接到 Claude Code，并公开 5 个用于搜索、计数和分析本地日志文件的工具。

功能

工具	描述
`search_logs`	通过关键字或正则表达式搜索日志文件
`count_by_level`	按严重性级别（ERROR/WARN/INFO/DEBUG）统计日志条目
`query_by_timerange`	在特定时间范围内过滤日志
`get_system_metrics`	获取 CPU、内存和磁盘使用指标
`explain_error`	格式化错误内容以进行 AI 辅助分析

Related MCP server: ai-ssh-mcp

快速开始

# Install dependencies
npm install

# Build TypeScript
npm run build

# Run the server
npm start

开发

# Run with hot reload
npm run dev

与 Claude Code 集成

将服务器添加到 Claude Code：

# Project-level (only available in this directory)
claude mcp add log-analyzer -- node /path/to/log-analyzer-mcp/dist/index.js

# User-level (available globally)
claude mcp add log-analyzer --scope user -- node /path/to/log-analyzer-mcp/dist/index.js

验证连接：

claude mcp list

工具详情

search_logs

通过关键字或正则表达式搜索日志文件。支持搜索单个 .log 文件或整个目录。

{
  "keywords": ["ERROR", "timeout"],
  "regex": "connection.*failed",
  "logPath": "/var/log",
  "limit": 100
}

count_by_level

按严重性级别统计日志条目，可选择按时间范围过滤。

{
  "logPath": "/var/log",
  "startTime": "2026-04-29T00:00:00Z",
  "endTime": "2026-04-30T00:00:00Z"
}

query_by_timerange

在特定时间范围内过滤日志，并可选择级别过滤器。

{
  "startTime": "2026-04-29T00:00:00Z",
  "endTime": "2026-04-30T00:00:00Z",
  "logPath": "/var/log",
  "level": "ERROR",
  "limit": 100
}

get_system_metrics

获取 CPU、内存和磁盘指标。支持 Windows 和 Linux。

{
  "metrics": ["cpu", "memory", "disk"]
}

explain_error

格式化错误内容以进行 AI 辅助的根本原因分析。

{
  "errorContent": "java.lang.NullPointerException\n  at com.example.Service.process(Service.java:42)",
  "contextLines": 10
}

架构

src/
├── index.ts           # MCP Server entry point
├── tools/             # Individual MCP tool implementations
├── utils/
│   ├── log_parser.ts  # Timestamp/level parsing, keyword/regex matching
│   └── metrics.ts     # Cross-platform CPU/memory/disk metrics
└── types/             # TypeScript type definitions

该服务器使用 @modelcontextprotocol/sdk 和 StdioServerTransport。工具通过 CallToolRequestSchema 处理程序进行注册。

关键设计决策

流处理：使用 readline + createReadStream 处理大型日志文件，而无需将其全部加载到内存中
跨平台：Windows (WMIC) 和 Linux (top/free/df) 双路径实现，具有运行时平台检测功能
容错解析：非标准日志格式会被保留而不是丢弃（缺失级别默认为 INFO，缺失时间戳默认为当前时间）

许可证

MIT

Available Tools

5 tools

count_by_levelB

Count log entries by severity level (ERROR, WARN, INFO, DEBUG)

ParametersJSON Schema

Name	Required	Description	Default
`logPath`	No	Path to log file or directory	/var/log
`startTime`	No	Start time in ISO8601 format
`endTime`	No	End time in ISO8601 format

TDQS

B3.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully disclose behavior. It only states the counting operation but omits details such as read-only nature, error handling for missing paths, or output format. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with action and levels. No wasted words. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has 3 parameters, no output schema, and no annotations. Description is too brief; does not explain output format, behavior with directories vs files, or case sensitivity of levels. Incomplete for a tool aggregating log data by severity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no extra meaning beyond the schema; it does not explain how parameters like startTime/endTime relate to the counting logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'Count', the resource 'log entries', and the grouping 'by severity level' with explicit levels. It distinguishes from siblings like search_logs and query_by_timerange which do different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for counting log entries by level but does not explicitly state when to use this over alternatives like search_logs or query_by_timerange. No prerequisites or exclusions provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_errorC

AI-assisted error analysis. Formats error content for AI analysis.

ParametersJSON Schema

Name	Required	Description	Default
`errorContent`	Yes	The error log or stack trace to analyze
`contextLines`	No	Number of context lines around the error

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It implies a read-only analysis but does not explicitly state whether the tool modifies data, requires authentication, or has rate limits. The phrase 'formats error content' suggests it is non-destructive, but this is not confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, efficient for a simple tool. However, the second sentence ('Formats error content for AI analysis') is somewhat redundant with the first, and the title is null so the description stands alone.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 params and no output schema, the description is adequate but does not describe the output format. Given sibling tools (search_logs, count_by_level), it fits well but could mention that the result is formatted text for consumption by an AI.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with both parameters documented. The description adds no new meaning beyond what the schema provides; it merely repeats 'error log or stack trace' and 'number of context lines'. Baseline 3 applies due to high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it does AI-assisted error analysis and formats error content for AI analysis. It specifies the verb 'analyze' and resource 'error content'. However, it does not explicitly differentiate from siblings like search_logs which might also process errors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like search_logs or get_system_metrics. It lacks prerequisites, when-not-to-use scenarios, or context for invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_system_metricsB

Get CPU, memory, and disk metrics from the system

ParametersJSON Schema

Name	Required	Description	Default
`metrics`	No	Which metrics to retrieve: cpu, memory, disk

TDQS

B3.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It only states the action without disclosing side effects, permissions, or potential limitations (e.g., read-only, resource cost).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that conveys the tool's purpose efficiently with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description fails to explain return format, data granularity, or operational context (e.g., whether metrics are real-time or cached). It leaves significant gaps for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single parameter 'metrics', which already defines its meaning. The tool description adds no extra semantic value beyond identifying the metrics types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'CPU, memory, and disk metrics from the system'. It directly distinguishes from sibling tools like 'search_logs' or 'count_by_level', which handle different data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving system metrics, but no explicit guidance on when to use it versus alternatives or exclusions. Siblings are distinct, so the context is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_by_timerangeC

Query logs within a specific time range

ParametersJSON Schema

Name	Required	Description	Default
`startTime`	Yes	Start time in ISO8601 format
`endTime`	Yes	End time in ISO8601 format
`logPath`	No	Path to log file or directory	/var/log
`level`	No	Filter by log level
`limit`	No	Maximum number of results

TDQS

C2.8/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It only states the basic operation without revealing any behavioral traits (e.g., read-only, performance, pagination, or effects). This is insufficient for an agent to understand the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short (6 words), which is concise but at the expense of completeness. It leaves out essential information for an agent to use it effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, so the description should explain return values, but it does not. The tool has 5 parameters and no annotations, yet the description covers only the basic purpose, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The tool description adds minimal meaning beyond the schema (only reiterating the time range). It does not compensate for any missing parameter context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Query', resource 'logs', and constraint 'within a specific time range'. It provides a specific purpose but does not distinguish from sibling tool 'search_logs' which may have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'search_logs' or 'count_by_level'. The description lacks context for appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_logsA

Search log files by keywords or regex patterns. Returns matching log entries with timestamps.

ParametersJSON Schema

Name	Required	Description	Default
`keywords`	No	Keywords to search for in log files
`regex`	No	Regular expression pattern to match
`logPath`	No	Path to log file or directory	/var/log
`limit`	No	Maximum number of results

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It states the tool returns matching log entries with timestamps, which is helpful, but omits details like case sensitivity, regex+keyword interaction, and pagination. Basic coverage but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. First sentence states action and method, second states output. Front-loaded, every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters and no output schema, the description covers core functionality but lacks details on parameter interplay (e.g., can keywords and regex be used together?) and default behavior of logPath and limit. Adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 4 parameters. The tool description adds minimal extra meaning beyond restating search mechanisms and output; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches log files using keywords or regex patterns, and returns matching entries with timestamps. This verb+resource specificity distinguishes it from siblings like count_by_level and explain_error.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description does not mention when to prefer search_logs over count_by_level, explain_error, or query_by_timerange, leaving the agent without comparative context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

5 tool updatesv1.0.0May 6, 2026
- First observedcount_by_level
- First observedexplain_error
- First observedget_system_metrics
- First observedquery_by_timerange
- First observedsearch_logs

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.4/5.0

Scored 2026-05-06 04:05 across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: counting by level, error explanation, system metrics, time-range queries, and keyword search. No overlap in functionality.

Naming Consistency4/5

Names follow a verb-oriented pattern (count, explain, get, query, search) but mix styles: some use 'by_' (count_by_level, query_by_timerange) while others are plain verb_noun (explain_error, get_system_metrics, search_logs). Mostly consistent but with minor deviations.

Tool Count5/5

5 tools is well-scoped for a log analysis server, covering essential operations without being too few or excessive.

Completeness4/5

Core log analysis tasks are covered: search, count by level, time-range queries, error explanation, and system metrics. Minor gaps exist, such as lacking a tool to list log sources or aggregate statistics beyond level counting.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

LogsLoom A
io.github.efim23
Ingest and search LogsLoom logs from coding agents.
Observability Monitoring Developer Tools
41
Foam Observability
io.github.foam-ai
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Observability Monitoring Developer Tools
2
SuperlogOAuth
sh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Monitoring Observability
21,039
mcp A
com.googleapis.compute
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
Cloud Platforms Networking & Infrastructure OS Automation
292

Related MCP Servers

Aliyun MCP Server
Cloud Platforms Search RAG Systems
nailuoGG
F
license
B
quality
C
maintenance
A Claude integration tool that enables users to query and analyze Aliyun (Alibaba Cloud) Simple Log Service logs through natural language commands.
Updated 2 years ago (2025-03-26 06:13 UTC)
1
29 npm
2
-
ai-ssh-mcp
Shell Access Command Line
guozhiwei01
A
license
A
quality
D
maintenance
Enables natural language SSH server management via Claude Code, allowing users to read logs, check services, run commands, and transfer files across multiple servers.
Updated 6 months ago (2026-03-27 06:37 UTC)
6
MIT
mcp-system-monitor
Monitoring Observability
VZilvinskus
F
license
A
quality
D
maintenance
Enables Claude to monitor CPU, memory, disk, processes, network connections, Docker containers, and system logs for system diagnostics and troubleshooting.
Updated 6 months ago (2026-04-03 20:14 UTC)
5
-
mcp-it-ops
Monitoring Observability
bastiaan365
F
license
A
quality
D
maintenance
Exposes homelab and IT-ops tools to Claude, including system health monitoring, Grafana alert states, Docker container status, Loki logs, SMART disk health, and more.
Updated 5 months ago (2026-04-19 15:04 UTC)
8
1
-