kascada/logmcp

MCP server — read-only log access for AI assistants. Debug your Linux server with AI, without giving the AI shell access.
No SSH. No write permissions. The AI reads your logs over HTTPS and helps you diagnose problems, while your server stays fully under your control.
LogMCP is an open-source MCP server that exposes log files on a remote Linux server to AI assistants (Claude Code, VS Code, Claude Desktop). Access is read-only, token-authenticated, and fully audited via syslog.
Get Started
Option A: Quickstart (no root required)
Try LogMCP in under a minute — no config file, no root, no systemd:
The command checks your group memberships (adm, systemd-journal), generates a bearer token and a self-signed TLS certificate, starts the server, and prints a ready-to-paste claude mcp add command.
**Running as root?** Pass --user and LogMCP will add the user to the required groups and re-launch as that user — root is not needed for future starts.
> **Note:** Token and certificate are ephemeral. The token changes on every start. For a permanent setup use Option B.
After testing, remove the server from Claude Code:
---
Option B: Permanent installation (recommended)
**1. Install**
Or install the pre-built .deb (replace x.y.z with the latest version):
**2. Run the setup wizard**
Guides you through TLS mode, bearer token, and systemd service — then prints a ready-to-paste client config snippet.
**3. Add to your AI client**
Paste the output into your MCP client config. Done — your AI can now read the server's logs.
---
The Key Advantage: Let the AI Debug Without Touching Your Server
You give the AI a read-only window into your logs. That's it.
- No SSH access required — the AI connects like any HTTPS client
- No write permissions — the AI cannot change, delete, or execute anything
- No shell access — not even read access beyond the whitelisted log paths
- Works from anywhere — your laptop, Claude Desktop, a remote CI agent
- Every access is audited via syslog on the server
This makes LogMCP ideal for situations where you need AI-assisted debugging but cannot or do not want to grant shell access: production servers, customer machines, hardened environments, or any setup where least-privilege matters.
> **SSH is also supported.** If your AI client is Claude Code running locally with an SSH key, you can use LogMCP over an SSH tunnel instead of a public HTTPS endpoint. See SSH Tunnel Setup below.
Features
- Read-only access to log files — the AI cannot modify anything
- Whitelist/blacklist glob patterns for fine-grained access control
- systemd journal (journald://) as a virtual log source
- Multi-token auth — per-client bearer tokens with revocation
- External authenticator support — delegate token verification to any CLI program
- TLS support: self-signed, custom cert, or behind Caddy reverse proxy
- Audit trail via syslog (access only, no log content)
- Guided interactive setup wizard
- Systemd service integration
- Extensions — expose external CLI tools or Redis-RPC workers as additional MCP tools
- Macros — define composite MCP tools as YAML files, no code required
- fail2ban integration and in-process rate limiting
Setup Details
The wizard (sudo logmcp setup) covers:
- Deployment mode (direct TLS or behind Caddy)
- Port and bearer token configuration
- Systemd service installation
- Client configuration snippets for Claude Code, VS Code, and Claude Desktop
Whitelist/blacklist and journald are configured directly in /etc/logmcp/config.yaml after setup.