Log Detective MCP
MCP server implementing core log analysis tools of Log Detective for use by other agents.
The server uses the Drain3 algorithm to cluster log messages into templates and extract a representative subset of snippets, reducing large logs to a manageable size for downstream analysis.
Installation
Requires Python 3.11+.
pip install .
Or with uv:
uv pip install .
Usage
Running the server
logdetective-mcp
Or directly:
python -m logdetective_mcp.main
MCP client configuration
Claude Code
claude mcp add logdetective -- logdetective-mcp
Claude Desktop
Add to your Claude Desktop configuration file:
{
"mcpServers": {
"logdetective": {
"command": "logdetective-mcp"
}
}
}
Tools
extract_log_snippets
Extracts representative log snippets using Drain3 clustering. The tool chunks the log into logical messages, clusters similar messages, and returns one representative snippet per cluster.
Log content can be provided in three ways (exactly one must be used):
| Parameter | Type | Description |
|---|---|---|
log_text |
str |
Raw log text passed directly. |
log_path |
str |
Path to a log file on the server's filesystem. |
log_url |
str |
HTTP(S) URL to fetch log content from. |
Optional parameters:
| Parameter | Type | Default | Description |
|---|---|---|---|
max_clusters |
int |
8 | Maximum number of snippets to extract. |
max_snippet_len |
int |
2000 | Maximum character length per snippet. |
skip_patterns |
list[str] |
null |
List of regex patterns. Chunks matching any pattern are excluded before clustering. |
Returns a list of Snippet objects, each with line_number (position in the original log) and text (the extracted snippet content).
Size limits
All downloaded inputs (via log_url) are limited to 100 MB regardless of format.
Downloads are streamed in chunks and aborted as soon as the limit is exceeded.
Archives read via log_path are also checked against the 100 MB limit during decompression.
Compressed file support
Both tools transparently decompress archived log files. Supported formats:
- Single-file compression:
.gz,.bz2,.xz,.lzma - Archives:
.zip,.tar,.tar.gz,.tar.bz2,.tar.xz
Format is detected from the file extension (or URL path). Archives must contain exactly one file.
Zip bomb protection is enforced via:
- Maximum decompressed size of 100 MB
- Maximum compression ratio of 100:1
- Pre-check of declared sizes in zip/tar headers
- No recursive decompression (nested archives are not unpacked)
Contributing
All changes to this repository must pass pre-commit checks and tests.
uv run pytest tests/
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file logdetective_mcp-0.5.0.tar.gz.
File metadata
- Download URL: logdetective_mcp-0.5.0.tar.gz
- Upload date:
- Size: 64.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.12.9
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ce39c4adcb3f290cea5b6bc83ed04b2716e13789cbb35cf89cc066e99365e988
|
|
| MD5 |
174aeb2f4889b8382661da6e8a98abf0
|
|
| BLAKE2b-256 |
4a5afe46de2600a24911753136063c250ff7ee520c27c5e24f94d4ea9935673e
|
Provenance
The following attestation bundles were made for logdetective_mcp-0.5.0.tar.gz:
Publisher:
publish.yml on fedora-copr/logdetective-mcp
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
logdetective_mcp-0.5.0.tar.gz -
Subject digest:
ce39c4adcb3f290cea5b6bc83ed04b2716e13789cbb35cf89cc066e99365e988 - Sigstore transparency entry: 2289194108
- Sigstore integration time:
-
Permalink:
fedora-copr/logdetective-mcp@8676059f605a4603ca70b5d9ca72c699217e3a86 -
Branch / Tag:
refs/tags/v0.5.0 - Owner: https://github.com/fedora-copr
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8676059f605a4603ca70b5d9ca72c699217e3a86 -
Trigger Event:
release
-
Statement type:
File details
Details for the file logdetective_mcp-0.5.0-py3-none-any.whl.
File metadata
- Download URL: logdetective_mcp-0.5.0-py3-none-any.whl
- Upload date:
- Size: 14.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.12.9
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
94fe615ff0f40d8eb5edbcfa65b6e1ee581042f254da8308385c21c2aaec7054
|
|
| MD5 |
d9e05fd92dc336895a3123edac7aaaf6
|
|
| BLAKE2b-256 |
86ee4246d56588d4c641638c2d3cab05ddb299a3ed3a2171e034505b36f63467
|
Provenance
The following attestation bundles were made for logdetective_mcp-0.5.0-py3-none-any.whl:
Publisher:
publish.yml on fedora-copr/logdetective-mcp
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
logdetective_mcp-0.5.0-py3-none-any.whl -
Subject digest:
94fe615ff0f40d8eb5edbcfa65b6e1ee581042f254da8308385c21c2aaec7054 - Sigstore transparency entry: 2289194141
- Sigstore integration time:
-
Permalink:
fedora-copr/logdetective-mcp@8676059f605a4603ca70b5d9ca72c699217e3a86 -
Branch / Tag:
refs/tags/v0.5.0 - Owner: https://github.com/fedora-copr
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8676059f605a4603ca70b5d9ca72c699217e3a86 -
Trigger Event:
release
-
Statement type:
