Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Log Intelligence MCP what errors occurred in ticket JIRA-123?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Semantic log ingestion, hybrid retrieval, and cleanup for the Rapid7 SI Triage Automation POC. This is the "Application Logs MCP" in the architecture diagram: it turns raw log files (downloaded from Jira tickets by the companion Jira/Confluence MCP) into a queryable vector index, and serves the most relevant log chunks back to the triage agent during defect analysis.
Ingest — reads raw log files for a ticket, parses them into logical entries (a header line plus its stack-trace/continuation lines), groups them into semantic, token-budgeted chunks, embeds each chunk, and stores the vectors in a per-ticket collection.
Query — given a natural-language question, runs hybrid retrieval (dense vector similarity + BM25 keyword matching, fused with Reciprocal Rank Fusion) and returns the top-k chunks with full provenance (source file, line range, time span, log levels, trace ids).
Stats — cheap aggregate view of a ticket's logs (level histogram, error count, time span, distinct trace ids).
Delete — after the defect pipeline finishes, removes the ticket's vectors and the raw local log files, freeing disk and clearing stale data.
Related MCP server: log-mcp
Tool | Purpose |
| Parse → chunk → embed → store all logs for a ticket. Reads from the shared |
| Hybrid semantic + keyword retrieval of the most relevant chunks. |
| Ingestion manifest + stored-chunk count + entry summary. |
| Remove vectors and (optionally) raw files. Cleanup step. |
Chunk quality decides retrieval quality, so the chunker is the heart of this MCP.
Entry-aware. Logs are first assembled into entries: a timestamped header
plus every continuation line (\tat …, Caused by:, … N more, wrapped
messages). An entry is atomic — it is never split across chunks, which is
what guarantees a stack trace always travels with the ERROR line that produced
it.
Token-budgeted for Claude. Chunks target ~1000 tokens and are capped at
1600 (CHUNK_*_TOKENS). Large enough to hold a full error + stack trace +
surrounding context; small enough that top-k results stay focused and the
agent's Phase-1 prompt stays bounded.
Semantically grouped. Packing prefers to break at natural boundaries — a new trace/correlation id, or a fresh ERROR — so related lines for one request land in the same chunk.
Overlap without cutting. Each chunk is seeded with the trailing whole entries of the previous chunk (~150 tokens) so context isn't lost at boundaries, but entries are never sliced mid-way.
Oversized entries. A single entry larger than the hard max (e.g. a giant
stack trace) is emitted whole and flagged oversized rather than truncated.
Token counting uses a fast, conservative character-based estimate (logs are
punctuation-heavy, so this slightly over-estimates and keeps chunks safely under
budget). Set USE_ANTHROPIC_TOKENIZER=1 to use exact Claude token counts when
network is available.
Dense and sparse retrieval catch different things: embeddings capture semantic
similarity ("payment failed" ≈ "authorization error"), while BM25 nails exact
identifiers (TokenVaultException, a trace id, a filename). We run both and fuse
their rankings with Reciprocal Rank Fusion:
rrf_score(d) = Σ_retriever weight / (RRF_K + rank_retriever(d))RRF fuses ranks rather than raw scores, so the two different score scales don't
need fragile normalisation. Tunables: RRF_K (default 60), DENSE_WEIGHT,
SPARSE_WEIGHT, CANDIDATE_POOL, DEFAULT_TOP_K.
Every heavy dependency sits behind an adapter with a real pure-Python fallback, so the whole pipeline runs and is testable with no network, and flips to the production backend by changing one env var.
Concern | Production (default when installed) | Offline fallback (real, not mock) |
Embeddings |
| Deterministic hashed n-gram TF-IDF on numpy |
Vector store | Chroma (persistent) | Per-ticket numpy |
Sparse | Pure-Python BM25 (always) | same |
Token count | Anthropic exact counter (optional) | character estimate |
EMBED_BACKEND=auto uses sentence-transformers if importable, else the hashing
embedder. VECTOR_BACKEND=auto uses Chroma if importable, else the numpy store.
Force a backend with EMBED_BACKEND=sentence-transformers|bedrock|hashing and
VECTOR_BACKEND=chroma|numpy.
The offline fallbacks are genuine implementations (real vectors, real persistence, real similarity search) — they exist so the POC runs anywhere, not to fake results.
cd log-intelligence-mcp
python -m venv .venv && source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e . # installs mcp, chromadb, sentence-transformers, numpy, uvicorn
cp .env.example .env # adjust if needed
# stdio (for a local MCP client / Claude Desktop):
python -m log_intelligence_mcp --transport stdio
# HTTP (streamable-http, served at http://127.0.0.1:8081/mcp):
python -m log_intelligence_mcp --transport httpThis server is one of four processes in the SI Triage POC (this + the Jira/Confluence and Historical KB MCPs + the orchestrator). For the full multi-service manual startup sequence,
.envlayout across all four repos, and end-to-end test steps, seeorchestrator-agent/si-triage-automation/README.md→ "Running the full system manually".
The first sentence-transformers run downloads the model (needs network once). With no network / no heavy deps installed, it automatically uses the offline fallbacks — the server still starts and every tool works.
{
"mcpServers": {
"log-intelligence": {
"command": "python",
"args": ["-m", "log_intelligence_mcp", "--transport", "stdio"],
"env": { "SI_DATA_DIR": "/absolute/path/to/si_data" }
}
}
}Both servers share one directory tree, SI_DATA_DIR (default ./si_data) — set
it to the same absolute path for both.
si_data/
logs/<ticket_id>/… # written by the Jira MCP, read by this MCP
vector_store/ # owned by this MCP
meta/<ticket_id>.json # ingestion manifest written by this MCPTypical flow: Jira MCP get_ticket downloads log attachments into
logs/<ticket_id>/ → this MCP ingest_ticket_logs(ticket_id) indexes them →
agent calls query_logs(...) during analysis → delete_ticket_logs(ticket_id)
cleans up at the end.
pytest # in the POC environment (needs `pip install pytest`)
python tests/_runner.py # offline harness used when pytest isn't installedThe suite covers entry assembly, the chunker invariants (no split entry, token budget respected, stack trace kept whole, overlap present, every line covered, oversized handling), BM25, hashed embeddings, the numpy store round-trip, hybrid fusion, and a full ingest → query → stats → delete end-to-end. 20 tests, all offline.
See .env.example for every variable. Key ones: SI_DATA_DIR,
CHUNK_TARGET_TOKENS/CHUNK_MAX_TOKENS/CHUNK_MIN_TOKENS/CHUNK_OVERLAP_TOKENS,
EMBED_BACKEND/EMBED_MODEL, VECTOR_BACKEND, RRF_K/DENSE_WEIGHT/SPARSE_WEIGHT,
DEFAULT_TOP_K, MCP_HTTP_HOST/MCP_HTTP_PORT (default 8081), LOG_LEVEL/LOG_JSON.
Clean up a ticket after the pipeline completes: remove embeddings and raw files.
Deletes the ticket's vectors from the store and (by default) the raw log files the Jira MCP downloaded locally, freeing disk and clearing stale data.
| Name | Required | Description | Default |
|---|---|---|---|
| ticket_id | Yes | ||
| delete_raw | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses exactly what gets deleted: ticket vectors from the store and, by default, locally downloaded raw log files. It lacks explicit irreversibility or permission notes but is not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with a clear summary and followed by concise elaboration. Every sentence adds value and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no annotations and no output schema, the description covers the key facts: what is deleted, when to run it, and the default raw-file behavior. It could mention irreversibility or error cases, but it is largely complete for its simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It connects delete_raw to 'by default the raw log files' and connects ticket_id to 'the ticket's vectors'. This adds meaningful semantics beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action ('Clean up a ticket') and clearly identifies the resources being affected: embeddings and raw log files. This distinguishes it from sibling tools like ingest_ticket_logs, query_logs, and get_log_stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit temporal context: 'after the pipeline completes', and explains the intended benefit ('freeing disk and clearing stale data'). It does not name explicit alternatives or when-not-to-use cases, but the context is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Cheap aggregate stats for a ticket's ingested logs (levels, errors, time span).
| Name | Required | Description | Default |
|---|---|---|---|
| ticket_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosure. While 'aggregate stats' implies a read-only operation, it does not explicitly state that it does not modify logs, nor does it mention any permissions, error behavior, or performance characteristics beyond 'cheap'. Given the sibling tools include destructive actions, this omission is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the essential information ('Cheap aggregate stats') and lists the key stat categories. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, no output schema, and no annotations, the description covers the core purpose and what to expect. It could be more explicit about the exact structure of the returned stats, but it provides enough context for an agent to decide to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds context by mentioning 'a ticket's ingested logs', which clarifies that ticket_id refers to a ticket that has logs. However, it does not describe the format or additional constraints beyond the schema's basic type. It provides minimal added meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as providing aggregate stats for a ticket's ingested logs, specifying the types of stats (levels, errors, time span). It distinguishes from sibling tools like query_logs (raw logs) and ingest_ticket_logs (adding logs) by focusing on aggregate summaries rather than raw data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by saying 'cheap aggregate stats' which suggests it is a lightweight alternative to querying full logs, but it does not explicitly name alternatives or state when not to use it. It provides clear context but no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Parse, semantically chunk, embed, and store all log files for a ticket.
Reads raw files the Jira MCP downloaded to <data_dir>/logs/<ticket_id>/
(or an explicit paths list). Chunks are entry-aware and token-budgeted
for Claude Sonnet/Opus. Returns ingestion stats including token distribution.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | ||
| ticket_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the full processing pipeline (parse, chunk, embed, store), mentions token-budgeting behavior for Claude models, and notes that it returns ingestion stats. This is transparent about the action and side-effects (storing) without overpromising.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first summarizes the core operation; the second provides input details and output. It is front-loaded with the purpose and contains no filler. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-step ingestion tool with no output schema or annotations, the description covers the necessary context: input source, processing behavior, and output type (stats). It does not detail return format or error cases, but those are not critical for tool selection, and the missing details are compensated by the clear pipeline description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains that 'ticket_id' is used to locate the default directory and that 'paths' is an optional explicit list override. This adds meaning beyond the raw schema and clarifies the role of each parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Parse, semantically chunk, embed, and store all log files for a ticket.' It names the specific resource (log files) and the ticket scope. It also distinguishes from siblings by mentioning storage/ingestion, whereas siblings are query/delete operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that it reads raw files from a default Jira MCP download location or an explicit 'paths' list, giving clear context on when to use it (after downloading logs). It does not explicitly state when not to use it or name alternatives, but the purpose is unambiguous and the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Hybrid semantic + keyword (BM25) retrieval of the most relevant log chunks.
Combines dense vector similarity with BM25 lexical matching, fused via Reciprocal Rank Fusion. Returns ranked chunks with provenance metadata (source file, line range, time span, levels, trace ids).
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| top_k | No | ||
| ticket_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool fuses results via Reciprocal Rank Fusion, returns ranked chunks, and includes provenance metadata (source file, line range, time span, levels, trace ids). This is useful behavioral context beyond the schema, as it tells the agent what to expect in the response shape. However, it does not disclose potential rate limits, permission requirements, or whether the operation is read-only, but given no annotations this is a decent effort.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact: two sentences plus a brief list. It front-loads the core purpose and provides a clear list of metadata fields. No fluff or redundant phrasing. It earns its place by adding valuable context without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and 0% schema description coverage, the description does an adequate job explaining the retrieval logic and result metadata, but it lacks critical information about the ticket_id parameter's role and whether the query is natural language or keyword-based. It also does not mention pagination or result limits beyond top_k. For a retrieval tool with no annotations and no output schema, it leaves some gaps, but it covers the essential behavioral aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions the 'query' parameter implicitly but does not explain the syntax or meaning of 'ticket_id', 'top_k', or 'query' beyond what the schema provides (name, type, default). The description says 'Retrieval of the most relevant log chunks' which involves the 'query' but does not elaborate on how 'ticket_id' scopes the search (needed pre-requisite). The top_k default is in schema but not contextualized. The description adds some value (provenance metadata) but lacks per-parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it performs 'Hybrid semantic + keyword (BM25) retrieval of the most relevant log chunks.' It explicitly mentions combining dense vector similarity and BM25 lexical matching, which distinguishes it from siblings like ingest_ticket_logs (data ingestion) and delete_ticket_logs (data deletion). The verb 'query_logs' is specific to retrieval, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when the agent needs to retrieve relevant log chunks for a given ticket, but it does not explicitly state when to use it versus alternatives. It mentions 'most relevant log chunks' but does not specify conditions like 'use when you need to find logs without knowing exact filters' or contrast with get_log_stats (which likely provides aggregated views). No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0delete_ticket_logsget_log_statsingest_ticket_logsquery_logsEach tool targets a distinct operation: ingest loads and embeds logs, query retrieves relevant chunks, get_log_stats returns aggregates, and delete removes data. There is no meaningful overlap between the two read tools because one returns ranked search results and the other returns summary statistics.
All tool names follow a clean verb_noun snake_case pattern (ingest_ticket_logs, query_logs, get_log_stats, delete_ticket_logs). Object naming varies slightly between ticket_logs and logs, but this does not break the overall consistency.
Four tools cover the full log-intelligence pipeline for a ticket: ingestion, retrieval, stats, and cleanup. The count is appropriately scoped; every tool earns its place.
The set provides the necessary lifecycle: create/ingest, read via query and stats, and delete/cleanup. Logs are effectively immutable, so an update operation is not a meaningful gap.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Personal knowledge base MCP server with semantic search, auto-categorization, metadata extraction
MCP server for searching Airweave collections with natural language queries.
Hosted MCP memory: save sessions/decisions once, search from Claude, Cursor, ChatGPT. EU-hosted FTS.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/anands-bounteous/log-intelligence-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
