Provides containerized deployment options for the SEQ MCP server, supporting various environment configurations and networking setups for connecting to SEQ instances.
Supports configuration through .env files for setting SEQ server connection details and authentication credentials.
Offers integration with GitHub Container Registry for pulling pre-built Docker images of the SEQ MCP server.
Provides automated CI/CD pipeline for building, testing, and publishing SEQ MCP server images to container registries.
Allows running the SEQ MCP server directly with Node.js, supporting configuration through environment variables or .env files.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SEQ MCP Server show me all error logs from the last 2 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP (Model Context Protocol) server that enables LLMs to query and analyze logs from SEQ structured logging server.
Search Events: Query logs with powerful SEQ filter syntax
Get Event Details: Retrieve complete information about specific log events
Analyze Logs: Statistical analysis of log patterns over time periods
List Signals: Access saved searches/signals configured in SEQ
Health Check: Monitor SEQ server status
Related MCP server: Graylog MCP Server
Node.js 18+
Access to a SEQ server instance
SEQ API key (optional but recommended for secure instances)
# Using GitHub Container Registry
docker pull ghcr.io/roeej/seq-mcp:latest
# Or using Docker Hub
docker pull roeej/seq-mcp:latestgit clone https://github.com/RoeeJ/seq-mcp.git
cd seq-mcp
npm install
npm run buildVariable | Description | Default | Required |
| URL of your SEQ server |
| Yes |
| API key for authentication | - | No* |
| Default number of events to return |
| No |
| Request timeout in milliseconds |
| No |
*Required if your SEQ instance has authentication enabled
Copy the example environment file:
cp .env.example .envEdit .env with your SEQ server details:
SEQ_URL=http://your-seq-server:5341
SEQ_API_KEY=your-api-key-hereOpen Claude Desktop settings
Navigate to "Developer" → "Edit Config"
Add the SEQ server configuration:
{
"mcpServers": {
"seq": {
"command": "node",
"args": ["/absolute/path/to/seq-mcp/dist/index.js"],
"env": {
"SEQ_URL": "http://localhost:5341",
"SEQ_API_KEY": "your-api-key-here"
}
}
}
}Open Claude Desktop settings
Navigate to "Developer" → "Edit Config"
Add the SEQ server configuration:
{
"mcpServers": {
"seq": {
"command": "node.exe",
"args": ["C:\\path\\to\\seq-mcp\\dist\\index.js"],
"env": {
"SEQ_URL": "http://localhost:5341",
"SEQ_API_KEY": "your-api-key-here"
}
}
}
}Create a .env file in your project root:
SEQ_URL=http://localhost:5341
SEQ_API_KEY=your-api-key-hereAdd to your Claude Code MCP configuration:
{
"seq": {
"command": "node",
"args": ["/path/to/seq-mcp/dist/index.js"]
}
}{
"seq": {
"command": "node",
"args": ["/path/to/seq-mcp/dist/index.js"],
"env": {
"SEQ_URL": "http://localhost:5341",
"SEQ_API_KEY": "your-api-key-here",
"SEQ_DEFAULT_LIMIT": "200",
"SEQ_TIMEOUT": "60000"
}
}
}Set environment variables in your shell:
# macOS/Linux - add to ~/.bashrc or ~/.zshrc
export SEQ_URL="http://localhost:5341"
export SEQ_API_KEY="your-api-key-here"
# Windows PowerShell
$env:SEQ_URL = "http://localhost:5341"
$env:SEQ_API_KEY = "your-api-key-here"Then use a simple configuration:
{
"seq": {
"command": "node",
"args": ["/path/to/seq-mcp/dist/index.js"]
}
}Open your SEQ instance in a web browser
Navigate to Settings → API Keys
Click "Add API Key"
Provide a title (e.g., "MCP Server")
Set appropriate permissions (typically "Read" is sufficient)
Copy the generated API key
Once configured, you can query your logs naturally:
"Show me all error logs from the last hour"
"Find logs containing 'timeout' errors"
"Analyze the log patterns for my API service"
"What are the most common errors in the last 24 hours?"
"Get details for event ID abc123"Search for events with filters:
- query: SEQ filter syntax (e.g., "Level = 'Error'" or "@Message like '%failed%'")
- count: Number of results (1-1000)
- fromDate/toDate: ISO date strings
- level: Filter by log levelGet detailed information about a specific event by ID.
Analyze log patterns:
- query: Optional SEQ filter
- timeRange: 1h, 6h, 24h, 7d, or 30d
- groupBy: Property name to group resultsList all configured signals (saved searches) in SEQ.
Check SEQ server health status.
Verify SEQ is running:
curl http://localhost:5341/api/healthCheck API key permissions: Ensure your API key has "Read" permissions
Network/Firewall: Ensure the MCP server can reach your SEQ instance
Timeout errors: Increase SEQ_TIMEOUT for large queries
"Unauthorized": Check your API key is correct
"Connection refused": Verify SEQ_URL and that SEQ is running
"Timeout": Query may be too complex, try adding more specific filters
# Run in development mode
npm run dev
# Run tests
npm test
# Lint code
npm run lint
# Type check
npm run typecheckLevel = 'Error' - All error logs
@Message like '%timeout%' - Messages containing "timeout"
Application = 'MyApp' and Level in ['Warning', 'Error'] - Warnings and errors from MyApp
@Timestamp > Now() - 1h - Events from last hour
StatusCode >= 400 - HTTP errors
Environment = 'Production' and ResponseTime > 1000 - Slow production requests
UserId = '12345' - All logs for specific user
@Exception is not null - All logs with exceptions
If SEQ is running in Docker:
{
"seq": {
"command": "node",
"args": ["/path/to/seq-mcp/dist/index.js"],
"env": {
"SEQ_URL": "http://host.docker.internal:5341",
"SEQ_API_KEY": "your-api-key"
}
}
}For cloud-hosted SEQ instances:
{
"seq": {
"command": "node",
"args": ["/path/to/seq-mcp/dist/index.js"],
"env": {
"SEQ_URL": "https://seq.yourcompany.com",
"SEQ_API_KEY": "your-api-key",
"SEQ_TIMEOUT": "60000"
}
}
}# Basic usage
docker run --rm \
-e SEQ_URL=http://host.docker.internal:5341 \
-e SEQ_API_KEY=your-api-key \
ghcr.io/roeej/seq-mcp:latest
# With all environment variables
docker run --rm \
-e SEQ_URL=http://your-seq-server:5341 \
-e SEQ_API_KEY=your-api-key \
-e SEQ_DEFAULT_LIMIT=200 \
-e SEQ_TIMEOUT=60000 \
ghcr.io/roeej/seq-mcp:latestAdd to your Claude Desktop configuration:
{
"mcpServers": {
"seq": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e", "SEQ_URL=http://host.docker.internal:5341",
"-e", "SEQ_API_KEY=your-api-key",
"ghcr.io/roeej/seq-mcp:latest"
]
}
}
}{
"seq": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e", "SEQ_URL=http://your-seq-server:5341",
"-e", "SEQ_API_KEY=your-api-key",
"ghcr.io/roeej/seq-mcp:latest"
]
}
}Create a docker-compose.yml:
version: '3.8'
services:
seq-mcp:
image: ghcr.io/roeej/seq-mcp:latest
environment:
- SEQ_URL=http://seq:5341
- SEQ_API_KEY=${SEQ_API_KEY}
networks:
- seq-network
seq:
image: datalust/seq:latest
ports:
- "5341:5341"
environment:
- ACCEPT_EULA=Y
networks:
- seq-network
networks:
seq-network:
driver: bridgeMCP Server: Handles tool definitions and request routing
SEQ Client: Manages API communication with SEQ
Type Safety: Full TypeScript with Zod validation
Error Handling: Graceful degradation and meaningful error messages
API keys are never logged or exposed
All requests are validated before execution
Timeout protection for long-running queries
Read-only operations (no log modification)
Supports both HTTP and HTTPS connections
This project uses GitHub Actions for continuous integration and deployment:
CI: Runs on every push and PR to ensure code quality
Linting with ESLint
Type checking with TypeScript
Unit tests with Vitest
Multi-version Node.js testing (18.x, 20.x)
Docker Publishing:
Automatically builds and publishes to GitHub Container Registry on main branch
Publishes to Docker Hub on version tags
Multi-platform builds (linux/amd64, linux/arm64)
Semantic versioning tags
Tag your release:
git tag v1.0.0
git push origin v1.0.0The GitHub Action will automatically:
Build multi-platform Docker images
Push to ghcr.io/roeej/seq-mcp:1.0.0
Push to dockerhub/roeej/seq-mcp:1.0.0 (requires secrets setup)
For Docker Hub publishing (optional):
DOCKERHUB_USERNAME: Your Docker Hub username
DOCKERHUB_TOKEN: Docker Hub access token
Note: GitHub Container Registry (ghcr.io) publishing works automatically with the repository's GITHUB_TOKEN, no additional setup required.
Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request
MIT
Analyze log patterns and statistics over a time period
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| timeRange | No | ||
| groupBy | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions analyzing 'patterns and statistics' but doesn't specify what kind of patterns (e.g., error trends, performance metrics) or statistics (e.g., counts, averages) are returned, nor does it address permissions, rate limits, or data freshness. This leaves significant gaps for a tool with 3 parameters and no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that gets straight to the point without unnecessary words. It's appropriately sized for a basic tool definition, though it could be more informative without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters with 0% schema coverage, no annotations, no output schema, and sibling tools that might overlap (e.g., 'search_events'), the description is incomplete. It doesn't clarify the tool's scope, output format, or how it differs from related tools, making it inadequate for confident agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but fails to do so. It mentions 'time period' which loosely maps to 'timeRange', but doesn't explain 'query' (SEQ query filter) or 'groupBy' (property to group results by). The description adds minimal value beyond what's implied by parameter names, leaving semantics largely undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool 'analyze log patterns and statistics over a time period', which provides a clear verb ('analyze') and resource ('logs'), but it's somewhat vague about what specific analysis is performed. It doesn't distinguish this tool from potential siblings like 'search_events' or 'list_signals', leaving ambiguity about its unique function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives like 'search_events' or 'list_signals'. It mentions a 'time period' but doesn't specify scenarios where pattern/statistical analysis is preferred over other log-related operations, leaving the agent to guess based on tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check the health status of the SEQ server
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool checks health status but doesn't add context such as what 'health' entails (e.g., uptime, resource usage, error rates), whether it requires authentication, or if it has rate limits. This leaves significant gaps in understanding the tool's behavior beyond its basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's function without any wasted words. It is front-loaded with the core purpose, making it easy for an agent to parse quickly and understand what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema, no annotations), the description is minimal but adequate for basic understanding. However, it lacks details on what the health check returns (e.g., status codes, metrics) or how it differs from sibling tools, making it incomplete for optimal agent usage in a broader context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter information is needed. The description appropriately doesn't discuss parameters, and since there are none, it compensates well by focusing on the tool's purpose, earning a high baseline score for this dimension.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Check') and resource ('health status of the SEQ server'), making it immediately understandable. However, it doesn't differentiate from sibling tools like 'analyze_logs' or 'get_event', which might also provide health-related information, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'analyze_logs' or 'list_signals', which could potentially offer health insights. It implies usage for checking server health but lacks explicit context or exclusions, leaving the agent to infer when this is the appropriate choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed information about a specific log event
| Name | Required | Description | Default |
|---|---|---|---|
| eventId | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves detailed information but doesn't cover critical aspects like whether it's read-only, requires authentication, has rate limits, or what the output format looks like. This leaves significant gaps for a tool that presumably accesses log data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with zero wasted words, making it highly efficient and front-loaded. It directly communicates the core functionality without unnecessary elaboration, earning full marks for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations, output schema, and low schema coverage, the description is incomplete. It doesn't address behavioral traits, output details, or parameter nuances, which are essential for a tool that interacts with log events. This leaves the agent under-informed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions retrieving a 'specific log event' by ID, which aligns with the single 'eventId' parameter in the schema. However, with 0% schema description coverage, the schema provides no parameter details, and the description doesn't add meaningful semantics beyond the basic mapping, such as ID format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('detailed information about a specific log event'), making it immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'search_events' or 'analyze_logs', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'search_events' or 'list_signals'. It implies usage for retrieving a single event by ID but doesn't specify prerequisites, exclusions, or contextual recommendations, leaving the agent with minimal direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all configured signals (saved searches) in SEQ
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('List all configured signals') but doesn't describe traits like pagination, rate limits, authentication needs, or what 'configured signals' entails. This leaves significant gaps for a tool that likely interacts with a system's saved searches.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any wasted words. It's front-loaded and appropriately sized for a simple listing tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of listing saved searches in a system like SEQ, the description is incomplete. With no annotations, no output schema, and minimal behavioral details, it doesn't provide enough context for an agent to understand the full scope, such as the format of returned signals or any system-specific constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, meaning no parameters are documented in the schema. The description implies no parameters are needed by stating 'List all configured signals', which aligns with the schema. This provides adequate semantic context, though it doesn't add extra details beyond the schema's emptiness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all configured signals (saved searches) in SEQ'), providing a specific purpose. However, it doesn't explicitly differentiate from sibling tools like 'search_events' or 'get_event', which might also retrieve signal-related data, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, context for usage, or comparisons to sibling tools like 'search_events' or 'get_event', leaving the agent with no usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search for events in SEQ logs with powerful filtering
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| count | No | ||
| fromDate | No | ||
| toDate | No | ||
| level | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only mentions 'powerful filtering' without detailing behavioral traits like pagination, rate limits, authentication needs, or what 'search' entails operationally. It fails to disclose critical aspects for a search tool with 5 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('search for events') without unnecessary words. It's appropriately sized for the tool's complexity, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, no annotations, no output schema), the description is incomplete. It lacks details on parameter usage, behavioral context, and output expectations, making it insufficient for an agent to effectively invoke the tool without guesswork.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters are undocumented in the schema. The description does not compensate by explaining any parameters (e.g., query syntax, date formats, level options), leaving all 5 parameters semantically unclear beyond their names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('search') and resource ('events in SEQ logs'), specifying the domain. It mentions 'powerful filtering' which hints at capabilities but doesn't explicitly differentiate from sibling tools like 'analyze_logs' or 'get_event', keeping it at 4 instead of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'analyze_logs' or 'get_event' is provided. The description implies general search functionality but lacks explicit context, prerequisites, or exclusions, leaving the agent without usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
analyze_logscheck_healthget_eventlist_signalssearch_eventsEach tool has a clearly distinct purpose: analyze_logs for pattern analysis, check_health for server status, get_event for retrieving specific events, list_signals for listing saved searches, and search_events for filtered searches. There is no overlap in functionality, making tool selection unambiguous.
All tool names follow a consistent verb_noun pattern with clear, descriptive verbs (analyze, check, get, list, search) and specific nouns (logs, health, event, signals, events). The naming is uniform and predictable throughout the set.
With 5 tools, the server is well-scoped for log management and monitoring in SEQ. Each tool serves a distinct and necessary function, such as health checks, event retrieval, and log analysis, without being overly sparse or bloated.
The toolset covers core log management operations well, including health monitoring, event retrieval, searching, and analysis. A minor gap exists in update/delete operations for signals or events, but agents can likely work around this for typical monitoring workflows.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
SEO research, audits, backlinks, GSC, and content workflow tools for AI agents.
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Code intelligence for LLMs. Analyze, search, and retrieve code from any public git repository.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/RoeeJ/seq-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
