Log Analyzer Mcp

io.github.Fato07Published by GitHub account Fato07v0.4.2Updated Oct 25, 2026

AI-powered log analysis - parse, search, extract errors across 9+ formats

Overview

AI-generated overview

A local MCP server that lets an assistant parse, search, summarize and debug log files across 9+ formats without copy-pasting them.

What you can do
Parse log files, auto-detect their format and extract metadata and timestamps across 9+ formats such as syslog, Apache/Nginx, JSON Lines, Docker, Python, Java/Log4j and Kubernetes logs, streaming large files instead of loading them fully into memory. Search logs with pattern matching, regex, context lines and time filters. Extract and group similar errors, capture stack traces and generate debugging summaries. Correlate related events across multiple files and monitor files for new entries. Answer natural-language questions about logs and scan them for PII, credentials and secrets.
When to use it
Useful when debugging applications or servers from log files and you want the assistant to read the files directly rather than pasting chunks, especially for large or multi-file logs, error grouping, time-based correlation, or checking logs for accidentally leaked secrets.
Requirements
Runs as a local process over stdio on the user's desktop. Requires Python with uv or pip to install the codesdevs-log-analyzer package; the README recommends a one-line uvx install or a manual entry in the Claude Code settings file. No accounts, API keys or environment variables are declared.
Before you install
The server reads log files on your machine, which may contain sensitive data; the sensitive-data scan is a detection aid, not a guarantee. The watch tool monitors files for new entries. Review what file paths you point it at before use.

Installation

In SourceWeft

  1. Open Log Analyzer Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Log Analyzer MCP

[MCP Registry] [PyPI version] [PyPI Downloads] [License: MIT] [Python 3.10+] [GitHub stars]

🔍 Stop copy-pasting logs into AI. Let Claude read them directly.

An MCP server for AI-powered log analysis. Parse, search, and debug log files across 9+ formats — right from Claude Code.

📊 At a Glance

14 MCP tools9+ log formats
280 tests81%+ coverage

🎬 Demo

[Log Analyzer MCP Demo]

Analyzing logs with 14 specialized tools

🤔 Why?

Without log-analyzer-mcpWith log-analyzer-mcp
Copy-paste chunks of logsPoint Claude at the file
Lose context between pastesFull file access
Manual format parsingAuto-detection
Miss related errorsSmart correlation

✨ Features

  • Auto-Detection — Identifies format from 9+ common log types
  • Smart Search — Pattern matching with context, regex, and time filtering
  • Error Extraction — Groups similar errors, captures stack traces
  • Natural Language — Ask questions like "what errors happened today?"
  • Sensitive Data Scan — Detect PII, credentials, and secrets
  • Multi-File Analysis — Correlate events across distributed systems
  • Streaming — Handles 1GB+ files without memory issues

🚀 Quick Start

bash
# Install (adds to Claude Code automatically)uvx codesdevs-log-analyzer install

Then in Claude Code:

Analyze /var/log/app.log and tell me what's causing the errors

📦 Installation

One-liner (Recommended)

bash
uvx codesdevs-log-analyzer install

Manual

pip / uv / Claude Code config
bash
# pippip install codesdevs-log-analyzer
# uvuv tool install codesdevs-log-analyzer

Add to ~/.claude/settings.json:

json
{  "mcpServers": {    "log-analyzer": {      "command": "uvx",      "args": ["codesdevs-log-analyzer"]    }  }}

📋 Supported Formats

FormatExample
SyslogJan 15 10:30:00 hostname process[pid]: message
Apache/Nginx127.0.0.1 - - [15/Jan/2026:10:30:00] "GET /path" 200
JSON Lines{"timestamp": "...", "level": "ERROR", "message": "..."}
Docker2026-01-15T10:30:00.123Z stdout message
Python2026-01-15 10:30:00,123 - module - ERROR - message
Java/Log4j2026-01-15 10:30:00,123 ERROR [thread] class - message
Kuberneteslevel=error msg="..." ts=2026-01-15T10:30:00Z
GenericAny line with recognizable timestamp

⚡ Performance

MetricValue
100MB log file< 10 seconds
Memory footprintStreaming (no full load)
Max tested size1GB+
Format detection< 100ms

🛠️ Available Tools

ToolDescription
log_analyzer_parseDetect format and extract metadata
log_analyzer_searchSearch with context lines
log_analyzer_extract_errorsExtract and group errors
log_analyzer_summarizeGenerate debugging summary
log_analyzer_correlateFind related events
log_analyzer_watchMonitor for new entries
log_analyzer_askNatural language queries
log_analyzer_scan_sensitiveDetect PII/credentials
+ 6 moreFull reference →

💡 Examples

Find errors:

Extract all errors from /var/log/app.log, group similar ones

Search with context:

Search for "timeout" in app.log with 5 lines of context

Correlate events:

What happened 60 seconds before each OutOfMemoryError?

Scan for secrets:

Check /var/log/app.log for accidentally logged credentials

🔧 Development

bash
git clone https://github.com/Fato07/log-analyzer-mcpcd log-analyzer-mcpuv syncuv run pytest -v --cov

📈 Star History

[Star History Chart]

📄 License

MIT License - see LICENSE for details.


Found this useful? Give it a ⭐ on GitHub!

Report bugs · Request features · Discussions · Full docs

Built by Fato07 at CodesDevs

Source: README.md at commit bcf0b38

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts