LogIntel MCP Server

Universal Model Context Protocol (MCP) server that connects LLMs to application logs across Datadog, Grafana Loki, AWS CloudWatch, and local log files.

Ask your AI assistant questions like:

• "Why did orders spike at 2 AM?"
• "Find all timeout errors in the payment service from last hour"
• "Correlate 500 errors across api, payment, and db services"
• "Compare error rates before and after the deployment at 3 PM"

Features

• 🔌 Multi-backend support — Datadog, Grafana Loki, AWS CloudWatch, local files
• 🔍 Natural language queries — Ask in plain English, get structured results
• 📁 Local file provider — Search, filter, tail, and aggregate JSON/regex/plain-text logs
• ☁️ CloudWatch provider — Query AWS CloudWatch Logs Insights with natural language
• 📊 Datadog provider — Search and aggregate via Datadog Logs v2 API
• 🔥 Loki provider — Query Grafana Loki with LogQL label matchers and metric queries
• 🧠 Intelligent analysis — Root cause analysis, cross-service correlation, anomaly detection
• 🔗 Cross-service correlation — Trace ID, timestamp proximity, and field matching
• ⚡ Caching & pagination — TTL cache for repeated queries; cursor-based pagination
• 🛡️ Read-only by default — Safe to use in production; no log mutation

MCP Tools

MCP Prompts

Quick Start

Installation

PyPI (recommended)

pip install logintel-mcp

# Or with uv
uv pip install logintel-mcp
uvx -y logintel-mcp --config ~/.logintelrc.yaml

npm (wrapper)

npx -y logintel-mcp-server --config ~/.logintelrc.yaml

Docker (GHCR)

docker run --rm -v "$HOME/.logintelrc.yaml:/etc/logintel/.logintelrc.yaml" \
  ghcr.io/firas-mcp-servers/logintel-mcp-server:latest

From source

git clone https://github.com/firas-mcp-servers/logintel-mcp-server.git
cd logintel-mcp-server
poetry install

Configuration

Create a .logintelrc.yaml file:

sources:
  datadog-prod:
    type: datadog
    apiKey: "${DATADOG_API_KEY}"
    appKey: "${DATADOG_APP_KEY}"
    site: "datadoghq.com"
    defaultIndexes: ["main", "prod"]

  loki-default:
    type: loki
    url: "http://localhost:3100"
    defaultLabels:
      app: "api"

  cloudwatch-app:
    type: cloudwatch
    region: "us-east-1"
    profile: "production"
    logGroups:
      - "/aws/lambda/my-app"

  local-app:
    type: local
    paths:
      - "/var/log/myapp/*.log"
    parseJson: true
    timestampField: "timestamp"
    levelField: "level"
    serviceField: "service"

defaults:
  timeRange: "1h"
  maxResults: 100
  timezone: "UTC"

intelligence:
  enableCaching: true
  cacheTtlSeconds: 60
  anomalySensitivity: "medium"
  maxCorrelationDepth: 3

Run the Server

# stdio transport (default)
logintel-mcp --config ~/.logintelrc.yaml

# Or via Python module
python -m logintel --config ~/.logintelrc.yaml

Claude Desktop Integration

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "log-intel": {
      "command": "uvx",
      "args": ["-y", "logintel-mcp", "--config", "/path/to/.logintelrc.yaml"]
    }
  }
}

Or with Docker:

{
  "mcpServers": {
    "log-intel": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/path/to/.logintelrc.yaml:/etc/logintel/.logintelrc.yaml",
        "ghcr.io/firas-mcp-servers/logintel-mcp-server:latest"
      ]
    }
  }
}

Cursor Integration

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "log-intel": {
      "command": "npx",
      "args": ["-y", "logintel-mcp-server", "--config", "./.logintelrc.yaml"]
    }
  }
}

Development

# Install dependencies
poetry install --with dev

# Run tests (100% coverage gate)
poetry run pytest --cov=src/logintel --cov-fail-under=100

# Or use the convenience tasks
poetry run poe test       # full suite with coverage
poetry run poe test-fast  # quick run without coverage
poetry run poe lint       # ruff check
poetry run poe fix        # ruff check --fix + ruff format
poetry run poe check      # lint + test combo

# Run MCP Inspector for manual testing
poetry run python -m logintel --config ./examples/config.yaml
# In another terminal:
npx -y @modelcontextprotocol/inspector

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    MCP Host (Claude/Cursor/etc.)            │
│                         ┌─────────┐                         │
│                         │  LLM    │                         │
│                         └────┬────┘                         │
│                              │ MCP Protocol (JSON-RPC)      │
└──────────────────────────────┼───────────────────────────────┘
                               │
                    ┌──────────▼──────────┐
                    │  LogIntel MCP Server │
                    │   (this project)     │
                    └──────────┬──────────┘
                               │
         ┌─────────────────────┼─────────────────────┐
         │                     │                     │
   ┌─────▼─────┐       ┌──────▼──────┐     ┌───────▼───────┐
   │  Datadog  │       │Grafana Loki │     │AWS CloudWatch │
   │   APIs    │       │  HTTP API   │     │  Logs Insights│
   └───────────┘       └─────────────┘     └───────────────┘
         │                     │                     │
         └─────────────────────┼─────────────────────┘
                               │
                        ┌──────▼──────┐
                        │ Local Files │
                        │  (fs/grep)  │
                        └─────────────┘

Roadmap

License

MIT