Jarroba Tools · Logs

io.github.Invarato由 GitHub 账号 Invarato 发布v0.3.0更新于 Oct 29, 2026

Lets your AI read a CI log far too big for its context. 12 tools, takes a file path.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

本地 MCP 服务器,让助手按文件路径分析超大 CI 或生产日志,而不必把日志粘贴进上下文。

可以做什么
  • 分析日志文件:格式、事件数、级别、时间范围、带根因的错误、高频模式
  • 检测趋势:哪些模式突增、哪些是新出现的、哪些已停止出现
  • 查看某一时刻前后的上下文,并找出区分某组事件的字段=值组合
  • 把日志行归并为模板(含稀有模板),并按字符预算压缩日志
  • 解析 Java、Python、Node、Go、.NET、Rust、Ruby、PHP 的堆栈跟踪
  • 检查日志质量、转换格式、按时间排序轮转日志,以及检查或建议日志配置档
适用场景
适合在排查失败的 CI 运行或生产事故时使用,尤其是日志大到无法粘贴的情况;也适合让助手直接回答关于磁盘上日志文件的问题,而不必为重复行消耗上下文。
运行要求
通过 npx 从 npm 包 @jarroba/mcp-logs 以 stdio 在本地运行,需要 Node.js,首次下载需要网络。无需账号、端点或 API 密钥。可选环境变量 JARROBA_MCP_DOMAINS 用于选择发布哪些工具域。
安装前请注意
这些工具能读取启动进程可读的任何文件,因此权限等同于 MCP 宿主。返回给模型的日志内容会进入其上下文且未做净化,恶意日志文本构成间接提示注入渠道。lint 输出会遮蔽密钥,但日志本身仍被完整读取。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Jarroba Tools · Logs,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@jarroba/mcp-logs

An MCP server that lets your AI read a log it could never fit in its context.

bash
claude mcp add jarroba-logs -- npx -y @jarroba/mcp-logs
jsonc
// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-logs": { "command": "npx", "args": ["-y", "@jarroba/mcp-logs"] } } }

12 tools · ~5.5k tokens of context · stdio, runs on your machine · nothing is uploaded.

Why this exists

Every log tool for an AI takes pasted text. A production or CI log is tens or hundreds of MB, so pasting is not an option — and the interesting part is never the part you would have pasted.

These tools take a file path. The server runs in Node, so it opens the file itself and hands back only what fits. An agent debugging a red CI run cannot read the log; it can ask questions about it.

The tools

log_analyzeFormat, number of events (a 40-line stack trace is one), levels, time range, errors with their root cause resolved, most frequent patterns.
log_trendsWhen did it start. Compares each pattern against itself, not against total volume — in a busy service everything rises at 9am and nothing happened. Returns what spiked, what is new, and what stopped appearing: the last one raises no counter anywhere and is often the worse news.
log_aroundWhat else clustered around a moment. What started before is a candidate explanation; what came after is usually a consequence. Correlation is not causation, and order is what separates them.
log_distinguishWhat sets a group of events apart from the rest: the field=value pairs over-represented in it (by default, in the errors). Of 300 errors, 92% on version=2.4.1 against 4% of the rest is the deploy that broke it — found without reading 300 errors. Unique-per-event fields are skipped: they identify, they do not distinguish.
log_patternsGroups lines into templates (Drain): "connected to 10.0.0.1" and "connected to 10.0.0.7" are one message. Also returns the rare ones, which is usually what you were looking for.
log_reduceCuts to a character budget keeping errors with their full trace, the window before, and whatever appears only once. Repeats collapse to [xN]. For handing a big log to a model without spending the context on the same line repeated.
log_stacktraceJava/JVM, Python, Node, Go, .NET, Rust, Ruby, PHP: the Caused by chain, the root cause, and the first frame of your code — inferred from the trace if you do not say.
log_lintWhether the log is well written, not what happened: secrets printed, one line flooding the file, timestamps with no time zone (which make two machines impossible to correlate), the clock going backwards, no request id. Secrets come back masked.
log_convertJSON / logfmt / syslog 5424 / CSV / OpenTelemetry / ECS — saying up front what the conversion loses.
log_rotationPuts rotated logs in time order. Rotation numbering runs backwards against time (app.log.3 is older than app.log.1) and alphabetically app.log.10 sorts before app.log.9. Use it first, or you read them backwards.
log_profile_check
log_profile_suggest
A reusable profile describing how your team's logs look. check returns every error with its exact field, so a model can correct itself in one pass.

Make your agent use it (Claude Code hook)

An agent with these tools will still Read a 300 MB log out of habit. hooks/big-log-read.mjs is a PreToolUse hook that stops a Read of a big log (by name: *.log, rotated *.log.N[.gz], *.jsonl, anything under logs/; by size: 2 MB, JT_BIG_LOG_BYTES to change it) and tells the agent to call log_analyze / log_reduce with the path instead. Everything else goes through untouched.

json
{ "hooks": { "PreToolUse": [ { "matcher": "Read", "hooks": [  { "type": "command", "command": "node /path/to/big-log-read.mjs" } ] } ] } }

Two things it will not do

  • It will not invent the server's time zone. That is not in the log, and guessing it shifts the entire timeline without anyone noticing. log_profile_suggest says so instead of filling it in.
  • It will not tell you how long anything took if the log has no timestamps. It says it cannot.

Privacy, and an honest note

Transport is stdio: your MCP host launches this as a subprocess and talks over stdin/stdout. There is no endpoint, no account and no telemetry. npx downloads the package from npm to your machine the first time; after that nothing goes out.

Two things worth knowing rather than discovering:

  • These tools read whatever the process that launched them can read. That is the point — it is how a 200 MB log becomes answerable — so they are exactly as privileged as your MCP host.
  • What a tool returns enters your model's context. A log file with hostile text inside it is an indirect prompt-injection channel, the same way a web page is. Nothing here sanitizes that.

Every tool declares MCP annotations: all are readOnlyHint: true, and all are openWorldHint: true because the answer comes from the disk rather than from the arguments.

More

Part of Jarroba Tools — the same engine as the web tools, so the answer is identical. Want everything (90 tools, databases, diagrams, test auditing, SPARQL)? @jarroba/mcp.

MIT — see LICENSE. Source: github.com/Invarato/jarroba-mcp.

来源:mcp/packages/logs/README.md,提交 b94171a

工具

0
SourceWeft 尚未在沙箱中启动过该软件包,因此其工具未知。

版本历史

10
  1. v0.3.0最新Oct 29, 2026
  2. v0.2.0Oct 23, 2026
  3. v0.1.11Oct 21, 2026
  4. v0.1.10Oct 18, 2026
  5. v0.1.9Oct 9, 2026
  6. v0.1.7Oct 2, 2026
  7. v0.1.6Sep 29, 2026
  8. v0.1.5Sep 26, 2026
  9. v0.1.4Sep 16, 2026
  10. v0.1.2Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分