rog0x/mcp-log-tools

Log analysis and processing tools for AI agents, exposed via the Model Context Protocol (MCP).
Tools
parse_logs
Parse log content in common formats: JSON logs, Apache/Nginx access logs, syslog, and structured logs. Supports custom regex patterns with named capture groups. Extracts timestamp, level, message, source, and additional structured fields.
filter_logs
Filter parsed log entries by:
- Log level (ERROR, WARN, INFO, DEBUG)
- Date range (ISO 8601)
- Keyword search (case-insensitive)
- Regex pattern matching
- Source/logger name
Returns matched entries along with level occurrence counts.
analyze_logs
Analyze log patterns to surface operational insights:
- Top 10 most frequent errors (normalized)
- Error rate over time (hourly buckets)
- Request volume per hour
- Slowest endpoints (from HTTP access logs)
- Anomaly detection (sudden spikes or drops using standard deviation)
format_logs
Convert between log formats and produce reports:
- JSON to plain text, plain to JSON, CSV, or table
- ANSI colorization by log level
- Structured field extraction
- Summary report generation
log_stats
Compute comprehensive log statistics:
- Total and non-empty line counts
- Level distribution with percentages
- Date range coverage
- Unique IP addresses and request counts
- Top user agents
- HTTP status code distribution
- Throughput (entries per second)
Setup
Usage with Claude Desktop
Add to your claude_desktop_config.json:
Supported Log Formats
| Format | Example |
|--------|---------|
| JSON | {"timestamp":"2024-01-15T10:30:00Z","level":"ERROR","message":"Connection failed"} |
| Apache/Nginx | 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET /index.html HTTP/1.1" 200 2326 |
| Syslog | Jan 1 00:00:00 hostname process[1234]: Something happened |
| Structured | 2024-01-15T10:30:00.000Z [ERROR] [ModuleName] Something failed |