Log Analyzer MCP
🔍 Stop copy-pasting logs into AI. Let Claude read them directly.
An MCP server for AI-powered log analysis. Parse, search, and debug log files across 9+ formats — right from Claude Code.
📊 At a Glance
| 14 MCP tools | 9+ log formats |
| 280 tests | 81%+ coverage |
🎬 Demo
Analyzing logs with 14 specialized tools
🤔 Why?
| Without log-analyzer-mcp | With log-analyzer-mcp |
|---|---|
| Copy-paste chunks of logs | Point Claude at the file |
| Lose context between pastes | Full file access |
| Manual format parsing | Auto-detection |
| Miss related errors | Smart correlation |
✨ Features
- Auto-Detection — Identifies format from 9+ common log types
- Smart Search — Pattern matching with context, regex, and time filtering
- Error Extraction — Groups similar errors, captures stack traces
- Natural Language — Ask questions like "what errors happened today?"
- Sensitive Data Scan — Detect PII, credentials, and secrets
- Multi-File Analysis — Correlate events across distributed systems
- Streaming — Handles 1GB+ files without memory issues
🚀 Quick Start
# Install (adds to Claude Code automatically)
uvx codesdevs-log-analyzer install
Then in Claude Code:
Analyze /var/log/app.log and tell me what's causing the errors
📦 Installation
One-liner (Recommended)
uvx codesdevs-log-analyzer install
Manual
pip / uv / Claude Code config
# pip
pip install codesdevs-log-analyzer
# uv
uv tool install codesdevs-log-analyzer
Add to ~/.claude/settings.json:
{
"mcpServers": {
"log-analyzer": {
"command": "uvx",
"args": ["codesdevs-log-analyzer"]
}
}
}
📋 Supported Formats
| Format | Example |
|---|---|
| Syslog | Jan 15 10:30:00 hostname process[pid]: message |
| Apache/Nginx | 127.0.0.1 - - [15/Jan/2026:10:30:00] "GET /path" 200 |
| JSON Lines | {"timestamp": "...", "level": "ERROR", "message": "..."} |
| Docker | 2026-01-15T10:30:00.123Z stdout message |
| Python | 2026-01-15 10:30:00,123 - module - ERROR - message |
| Java/Log4j | 2026-01-15 10:30:00,123 ERROR [thread] class - message |
| Kubernetes | level=error msg="..." ts=2026-01-15T10:30:00Z |
| Generic | Any line with recognizable timestamp |
⚡ Performance
| Metric | Value |
|---|---|
| 100MB log file | < 10 seconds |
| Memory footprint | Streaming (no full load) |
| Max tested size | 1GB+ |
| Format detection | < 100ms |
🛠️ Available Tools
| Tool | Description |
|---|---|
log_analyzer_parse |
Detect format and extract metadata |
log_analyzer_search |
Search with context lines |
log_analyzer_extract_errors |
Extract and group errors |
log_analyzer_summarize |
Generate debugging summary |
log_analyzer_correlate |
Find related events |
log_analyzer_watch |
Monitor for new entries |
log_analyzer_ask |
Natural language queries |
log_analyzer_scan_sensitive |
Detect PII/credentials |
| + 6 more | Full reference → |
💡 Examples
Find errors:
Extract all errors from /var/log/app.log, group similar ones
Search with context:
Search for "timeout" in app.log with 5 lines of context
Correlate events:
What happened 60 seconds before each OutOfMemoryError?
Scan for secrets:
Check /var/log/app.log for accidentally logged credentials
🔧 Development
git clone https://github.com/Fato07/log-analyzer-mcp
cd log-analyzer-mcp
uv sync
uv run pytest -v --cov
📈 Star History
📄 License
MIT License - see LICENSE for details.
Found this useful? Give it a ⭐ on GitHub!
Report bugs ·
Request features ·
Discussions ·
Full docs
Metadata
Release files for codesdevs-log-analyzer 0.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| codesdevs_log_analyzer-0.5.0.tar.gz | 712.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| codesdevs_log_analyzer-0.5.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 826.4 kB
Release files / codesdevs_log_analyzer-0.5.0.tar.gz
| Download URL | codesdevs_log_analyzer-0.5.0.tar.gz |
|---|---|
| Size | 712.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d5c4622a002705e4df3a03bb64b8e539c96e5b022f2ea8f24c64d1e39c10aa39
|
|
BLAKE2b-256 checksum How to use checksums |
ade772ae2e5624e7f25c16d1656055b520ec68f2d1019d1cffb887e61334cb11
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jan 16, 2026.
Transparency logRelease files / codesdevs_log_analyzer-0.5.0-py3-none-any.whl
| Download URL | codesdevs_log_analyzer-0.5.0-py3-none-any.whl |
|---|---|
| Size | 114.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
be737b74a1c0a7a9544a5dc2d928912c966ae0c5b49541c791f3a3418f7d0e1e
|
|
BLAKE2b-256 checksum How to use checksums |
db1d54f4cbe84c6fb70052ff6c7cd433b4ebf0332ae054728bf522866e31b81f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jan 16, 2026.
Transparency log