sumo-logic-mcp

MCP server for Sumo Logic — 48 tools for searching logs, managing monitors, alerts, dashboards, collectors, metrics, content library, users, roles, fields, partitions, lookup tables, and ingest budgets.

Generic and org-agnostic. Any team can plug in their own Sumo Logic credentials and start querying.

Note: This is an experimental, community-driven project — not an official Sumo Logic product. Feel free to test it and use it.

Installation

pip install sumo-logic-mcp

Or run without installing (via uv):

uvx sumo-logic-mcp

Setup

1. Get Access Credentials

1. Log in to your Sumo Logic account (e.g., https://<your-org>.sumologic.com)
2. Click on your profile icon (top right) and go to Preferences
3. Scroll to My Access Keys and click Add Access Key
4. Give it a name, leave scopes to default or set as needed
5. Copy both the Access ID and Access Key

2. Configure Your MCP Client

Add to your MCP client configuration (e.g., ~/.cursor/mcp.json or Claude Desktop config):

{
  "mcpServers": {
    "sumologic": {
      "command": "uvx",
      "args": ["sumo-logic-mcp"],
      "env": {
        "SUMOLOGIC_ACCESS_ID": "<your-access-id>",
        "SUMOLOGIC_ACCESS_KEY": "<your-access-key>",
        "SUMOLOGIC_ENDPOINT": "https://api.sumologic.com"
      }
    }
  }
}

Or run directly:

export SUMOLOGIC_ACCESS_ID="your-access-id"
export SUMOLOGIC_ACCESS_KEY="your-access-key"
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp

Tool Reference

Search & Analytics (4 tools)

search_logs optional params: from_time (default -15m), to_time (default now), timezone (default UTC), limit (default 100), by_receipt_time, timeout (default 300s).

Time formats: ISO 8601 (2024-01-15T09:00:00), relative (-15m, -1h, -2d, -1w), epoch ms (1718745600000), or now.

Monitor Management (10 tools)

Alert Management (3 tools)

Dashboard Management (5 tools)

Collector & Source Management (8 tools)

Metrics (4 tools)

Content Library (3 tools)

Administration (8 tools)

Utility (3 tools)

Usage Examples

Once configured, just ask your AI assistant naturally:

"Search for 500 errors in the last hour"
"Show me all critical alerts"
"Create a monitor for high error rates on our API"
"List all hosted collectors"
"What CPU metrics are available?"
"Show me the field extraction rules"
"List all partitions and their retention periods"

Development

git clone https://github.com/rajfirke/sumo-logic-mcp.git
cd sumo-logic-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

# Lint
ruff check src/ tests/

# Test
pytest -v

# Run locally
export SUMOLOGIC_ACCESS_ID="..."
export SUMOLOGIC_ACCESS_KEY="..."
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp

Architecture

src/sumo_logic_mcp/
├── __init__.py          # Exports mcp, triggers tool registration
├── __main__.py          # Entry point: python -m sumo_logic_mcp
├── server.py            # FastMCP instance + lifespan (shared HTTP client)
├── client.py            # Async HTTP client (httpx, Basic Auth, retry, cookies)
├── validation.py        # Time parsing and validation
└── tools/
    ├── __init__.py      # Imports all tool modules
    ├── search.py        # 4 search tools
    ├── monitors.py      # 10 monitor tools
    ├── alerts.py        # 3 alert tools
    ├── dashboards.py    # 5 dashboard tools
    ├── collectors.py    # 8 collector/source tools
    ├── metrics.py       # 4 metrics tools
    ├── content.py       # 3 content library tools
    ├── admin.py         # 8 admin tools (users, roles, fields, partitions, etc.)
    └── utils.py         # 3 utility tools