Jarroba Tools · Logs

io.github.InvaratoPublished by GitHub account Invaratov0.3.0Updated Oct 29, 2026

Lets your AI read a CI log far too big for its context. 12 tools, takes a file path.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant analyze large CI or production log files by path instead of pasting them into context.

What you can do
  • Analyze a log file: format, event count, levels, time range, errors with root cause, frequent patterns
  • Detect trends: what spiked, what is new, and what stopped appearing
  • Inspect context around a moment and find field=value pairs that distinguish a group of events
  • Group lines into templates, including rare ones, and reduce a log to a character budget
  • Parse stack traces across Java, Python, Node, Go, .NET, Rust, Ruby and PHP
  • Lint log quality, convert between formats, order rotated logs, and check or suggest a log profile
When to use it
Useful when debugging a failing CI run or production incident where the log is far too large to paste, or when you want an assistant to answer questions about a log file on disk without spending context on repeated lines.
Requirements
Runs locally over stdio via npx from the npm package @jarroba/mcp-logs, so Node.js and network access for the first download are needed. No account, endpoint or API key. Optional JARROBA_MCP_DOMAINS selects which tool domains are published.
Before you install
The tools can read any file the launching process can read, so they are as privileged as the MCP host. Log content returned to the model enters its context and is not sanitized, making hostile log text an indirect prompt-injection channel. Lint output masks secrets but the log itself is still read in full.

Installation

In SourceWeft

  1. Open Jarroba Tools · Logs in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@jarroba/mcp-logs

An MCP server that lets your AI read a log it could never fit in its context.

bash
claude mcp add jarroba-logs -- npx -y @jarroba/mcp-logs
jsonc
// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-logs": { "command": "npx", "args": ["-y", "@jarroba/mcp-logs"] } } }

12 tools · ~5.5k tokens of context · stdio, runs on your machine · nothing is uploaded.

Why this exists

Every log tool for an AI takes pasted text. A production or CI log is tens or hundreds of MB, so pasting is not an option — and the interesting part is never the part you would have pasted.

These tools take a file path. The server runs in Node, so it opens the file itself and hands back only what fits. An agent debugging a red CI run cannot read the log; it can ask questions about it.

The tools

log_analyzeFormat, number of events (a 40-line stack trace is one), levels, time range, errors with their root cause resolved, most frequent patterns.
log_trendsWhen did it start. Compares each pattern against itself, not against total volume — in a busy service everything rises at 9am and nothing happened. Returns what spiked, what is new, and what stopped appearing: the last one raises no counter anywhere and is often the worse news.
log_aroundWhat else clustered around a moment. What started before is a candidate explanation; what came after is usually a consequence. Correlation is not causation, and order is what separates them.
log_distinguishWhat sets a group of events apart from the rest: the field=value pairs over-represented in it (by default, in the errors). Of 300 errors, 92% on version=2.4.1 against 4% of the rest is the deploy that broke it — found without reading 300 errors. Unique-per-event fields are skipped: they identify, they do not distinguish.
log_patternsGroups lines into templates (Drain): "connected to 10.0.0.1" and "connected to 10.0.0.7" are one message. Also returns the rare ones, which is usually what you were looking for.
log_reduceCuts to a character budget keeping errors with their full trace, the window before, and whatever appears only once. Repeats collapse to [xN]. For handing a big log to a model without spending the context on the same line repeated.
log_stacktraceJava/JVM, Python, Node, Go, .NET, Rust, Ruby, PHP: the Caused by chain, the root cause, and the first frame of your code — inferred from the trace if you do not say.
log_lintWhether the log is well written, not what happened: secrets printed, one line flooding the file, timestamps with no time zone (which make two machines impossible to correlate), the clock going backwards, no request id. Secrets come back masked.
log_convertJSON / logfmt / syslog 5424 / CSV / OpenTelemetry / ECS — saying up front what the conversion loses.
log_rotationPuts rotated logs in time order. Rotation numbering runs backwards against time (app.log.3 is older than app.log.1) and alphabetically app.log.10 sorts before app.log.9. Use it first, or you read them backwards.
log_profile_check
log_profile_suggest		A reusable profile describing how your team's logs look. check returns every error with its exact field, so a model can correct itself in one pass.

Make your agent use it (Claude Code hook)

An agent with these tools will still Read a 300 MB log out of habit. hooks/big-log-read.mjs is a PreToolUse hook that stops a Read of a big log (by name: *.log, rotated *.log.N[.gz], *.jsonl, anything under logs/; by size: 2 MB, JT_BIG_LOG_BYTES to change it) and tells the agent to call log_analyze / log_reduce with the path instead. Everything else goes through untouched.

json
{ "hooks": { "PreToolUse": [ { "matcher": "Read", "hooks": [  { "type": "command", "command": "node /path/to/big-log-read.mjs" } ] } ] } }

Two things it will not do

  • It will not invent the server's time zone. That is not in the log, and guessing it shifts the entire timeline without anyone noticing. log_profile_suggest says so instead of filling it in.
  • It will not tell you how long anything took if the log has no timestamps. It says it cannot.

Privacy, and an honest note

Transport is stdio: your MCP host launches this as a subprocess and talks over stdin/stdout. There is no endpoint, no account and no telemetry. npx downloads the package from npm to your machine the first time; after that nothing goes out.

Two things worth knowing rather than discovering:

  • These tools read whatever the process that launched them can read. That is the point — it is how a 200 MB log becomes answerable — so they are exactly as privileged as your MCP host.
  • What a tool returns enters your model's context. A log file with hostile text inside it is an indirect prompt-injection channel, the same way a web page is. Nothing here sanitizes that.

Every tool declares MCP annotations: all are readOnlyHint: true, and all are openWorldHint: true because the answer comes from the disk rather than from the arguments.

More

Part of Jarroba Tools — the same engine as the web tools, so the answer is identical. Want everything (90 tools, databases, diagrams, test auditing, SPARQL)? @jarroba/mcp.

MIT — see LICENSE. Source: github.com/Invarato/jarroba-mcp.

Source: mcp/packages/logs/README.md at commit b94171a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

10
  1. v0.3.0LatestOct 29, 2026
  2. v0.2.0Oct 23, 2026
  3. v0.1.11Oct 21, 2026
  4. v0.1.10Oct 18, 2026
  5. v0.1.9Oct 9, 2026
  6. v0.1.7Oct 2, 2026
  7. v0.1.6Sep 29, 2026
  8. v0.1.5Sep 26, 2026
  9. v0.1.4Sep 16, 2026
  10. v0.1.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts