openobserve-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@openobserve-mcpsearch my app_logs for errors in the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
openobserve-mcp
An MCP server that lets any MCP client — Claude Code, Cursor, a custom agent — query an OpenObserve instance: logs, traces, and metrics.
Quick start
npm install
npm run build
npm run o2:up # OpenObserve on http://localhost:5080
npm run seed # sample logs, traces, and metrics
npm run smoke # call every tool over a real stdio MCP sessionnpm run smoke should print eight ok lines. Log in to the UI at http://localhost:5080 with root@example.com / Complexpass#123.
Related MCP server: otel-mcp
Connecting a client
Claude Code
claude mcp add openobserve \
--env O2_URL=http://localhost:5080 \
--env O2_ORG=default \
--env O2_USER=root@example.com \
--env O2_PASSWORD='Complexpass#123' \
-- node /absolute/path/to/openobserve-mcp/dist/index.jsRestart the client afterwards — MCP servers are loaded at session start.
Any client (JSON config)
{
"mcpServers": {
"openobserve": {
"command": "node",
"args": ["/absolute/path/to/openobserve-mcp/dist/index.js"],
"env": {
"O2_URL": "http://localhost:5080",
"O2_ORG": "default",
"O2_USER": "root@example.com",
"O2_PASSWORD": "Complexpass#123"
}
}
}
}Configuration
Variable | Default | Purpose |
|
| Base URL of the instance |
|
| Organization id |
| — | Login email |
| — | Password |
See .env.example. Credentials are read from the process environment only; nothing is written to disk.
Tools
Tool | Purpose |
| Enumerate streams, optionally filtered by type |
| Field names and types for a stream |
| Stream count, storage, pipelines, alerts, dashboards |
| Rows matching a SQL |
|
|
| Recent traces with root operation, duration, services |
| Every span of one trace, ordered by start time |
| PromQL over a time range |
Time ranges
Every time argument takes an ISO timestamp or relative shorthand: 30s, 15m, 2h, 7d, 1w. end_time defaults to now.
aggregate_logs table token
Write the table as the literal token stream; it is substituted with the real stream name in FROM / JOIN position only, so a column or string literal containing the word is left alone.
{
"stream": "app_logs",
"sql": "SELECT service, COUNT(*) AS c FROM stream GROUP BY service ORDER BY c DESC",
"start_time": "1h"
}Logs and traces live in separate indexes. To aggregate spans, pass "stream_type": "traces" — otherwise OpenObserve reports stream not found.
Layout
src/
index.ts entrypoint — stdio transport only
server.ts builds a wired McpServer (importable for tests)
config.ts environment → Config
client.ts OpenObserve HTTP API wrapper
time.ts ISO / relative range parsing → micros + seconds
tools/
index.ts registers every tool
helpers.ts JSON result shape, SQL quoting, shared schema
streams.ts list_streams, get_schema, get_org_summary
logs.ts search_logs, aggregate_logs
traces.ts search_traces, get_trace
metrics.ts query_metrics
scripts/
seed.mjs sample logs, traces, metrics
smoke.mjs stdio MCP client — exercises every tool
docker-compose.yml local OpenObserveAdding a tool means one file in src/tools/ plus a line in src/tools/index.ts.
Verified against
OpenObserve public.ecr.aws/zinclabs/openobserve:latest (v0.15.x), MCP SDK 1.25, Node 22.
Endpoint paths are version-sensitive. Two in particular differ from what the API docs suggest: stream schema is /api/{org}/streams/{stream}/schema (not /api/{org}/{stream}/schema), and there is no /traces/{trace_id} endpoint — get_trace searches the trace stream by id instead. If you upgrade OpenObserve, re-run npm run smoke.
Development
npm run watch # tsc --watch
npm run smoke # regression check against a live instance
node scripts/smoke.mjs list # inspect registered tools
node scripts/smoke.mjs get_schema '{"stream":"app_logs"}'scripts/smoke.mjs speaks the real MCP protocol over stdio, so it catches schema and transport regressions that a direct HTTP test would miss.
Available Tools
8 toolsaggregate_logsA
Run an aggregation query (COUNT, AVG, SUM, GROUP BY). Write the table name as stream and it is substituted with the real stream.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | Full SQL using the literal token `stream` as the table, e.g. "SELECT level, COUNT(*) AS c FROM stream GROUP BY level" | |
| stream | Yes | Stream name | |
| end_time | No | ISO timestamp. Defaults to now. | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' | |
| stream_type | No | Which store to search. Trace streams are not searchable as logs. | logs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It usefully discloses the stream-substitution behavior, but it does not state whether the operation is read-only, how results are returned, or any query limitations. The aggregation phrasing implies a safe read, but richer behavioral context is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The first sentence states the core function, and the second provides a critical usage detail. It is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has five parameters and no output schema, but the schema descriptions cover all parameters and the description explains the key substitution mechanism. It does not detail return values or error behavior, but for an aggregation query the return shape is largely determined by the user's SQL, so the description plus schema are sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds valuable meaning beyond the schema by explaining that the literal token `stream` in the SQL is replaced with the real stream name, which is essential for correctly constructing both the `sql` and `stream` parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Run an aggregation query' and enumerates the supported operations (COUNT, AVG, SUM, GROUP BY). This clearly distinguishes it from sibling search/query tools and leaves no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for aggregations, but it does not explicitly state when to prefer this tool over alternatives like search_logs or query_metrics. There are no when-not-to-use instructions or direct sibling comparisons, so the guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_org_summaryA
Get organization summary: stream count, storage, pipelines, alerts, dashboards
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only lists what the summary includes but gives no information about side effects, permissions, output format, or how the data is aggregated. This leaves significant behavioral ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a colon-separated list, highly concise and immediately clear. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool is simple, the description covers the main elements of an organization summary but does not explain format, units, or caveats. For a tool with no output schema, it provides enough for basic understanding but lacks depth.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description mentions the content areas covered. Since there are no parameters to document, the description provides adequate semantic context for the tool's function.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get organization summary' and lists specific data points (stream count, storage, pipelines, alerts, dashboards), making its purpose explicit. It distinguishes itself from sibling tools that focus on individual entities like streams, traces, or logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not explain when to use this summary tool versus listing streams or searching logs, and there is no mention of scenarios where it should be preferred or avoided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_schemaA
Get the field names and types for a stream
| Name | Required | Description | Default |
|---|---|---|---|
| stream | Yes | Stream name | |
| stream_type | No | Type of stream | logs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action ('get') without mentioning read-only semantics, permissions, rate limits, error behavior, or response format. The lack of such details leaves users guessing about operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is appropriately sized for the tool's simplicity, stating the core function in a clear and direct manner.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, parameters are fully covered by the schema, and the description provides a clear indication of the return content (field names and types). No output schema exists, but the description sufficiently conveys what to expect. It lacks only minor additional context about stream_type distinctions, which the schema already handles.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already documented. The description adds the high-level purpose ('field names and types') but does not elaborate on the stream_type parameter or its default. Baseline of 3 is appropriate since the schema carries the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves field names and types for a stream, which is a specific verb+resource combination. It distinguishes itself from siblings like list_streams (which lists streams) and search_logs (which searches logs) by focusing on schema metadata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need stream schema information, but provides no explicit guidance on when to use it over alternatives, nor any exclusions. It is not misleading, but lacks proactive usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_traceA
Get every span of a single trace, ordered by start time
| Name | Required | Description | Default |
|---|---|---|---|
| stream | No | Trace stream name | default |
| end_time | No | ISO timestamp. Defaults to now. | |
| trace_id | Yes | The trace ID to retrieve | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description must shoulder the full burden of behavioral disclosure. It does mention that results are ordered by start time and that it returns every span, but it omits critical behavioral details such as pagination, response format, error handling, or time-range limits. Since this is a read-only retrieval, the safety profile is inferred, but the lack of concrete details about the output and edge cases leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence (12 words) that immediately conveys the core function. It front-loads the key information and contains no filler. Every word adds value, making it an ideal example of concise, well-structured documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters and no output schema, the description provides the essential purpose but lacks details about the return structure (e.g., what a span consists of), potential limitations, or how it handles missing traces. It is adequate for basic understanding but misses important contextual information that a complex observability tool might require. The schema helps with parameters, but the absence of output schema and richer behavioral context leaves the description minimally viable but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions cover 100% of the parameters (stream, end_time, trace_id, start_time) with clear explanations. The tool description itself does not add any additional parameter semantics. Since schema coverage is high, the baseline of 3 applies; the description neither enhances nor detracts from the parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states exactly what the tool does: 'Get every span of a single trace, ordered by start time.' It specifies the action (get), the resource (spans of a single trace), and a distinguishing detail (ordered by start time). This clearly differentiates it from the sibling tool 'search_traces', which likely finds traces rather than retrieving all spans of a known trace.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage context: when you have a specific trace ID and need all its spans. However, it does not explicitly mention when not to use this tool or suggest alternatives like 'search_traces' for finding traces. The context is clear but lacks exclusions or explicit alternative guidance, which prevents a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_streamsA
List available streams (logs, metrics, traces) in OpenObserve
| Name | Required | Description | Default |
|---|---|---|---|
| stream_type | No | Filter by stream type |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. The verb 'list' implies a read-only, non-destructive operation, but the description does not explicitly confirm safety, permissions, or output format. It provides minimal behavioral context beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, focused sentence that immediately states the purpose with no filler or redundant detail. The structure is clean and front-loaded with the verb.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with one optional parameter, the description is adequate. It implies a list output and the schema covers filtering. However, it does not explicitly mention all stream types supported by the enum, and there is no output schema, but the tool's simplicity makes this a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the single parameter stream_type with an enum and description, so the description adds no additional semantic value. The parenthetical in the description lists a subset of enum values, but it does not explain parameter behavior or format beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('list') and a clear resource ('available streams'), with a parenthetical enumerating common stream types. This directly states what the tool does and distinguishes it from siblings like search_logs or aggregate_logs, which operate on stream data rather than enumerating streams.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. No alternatives, prerequisites, or exclusions are mentioned. The sibling tools suggest different use cases, but the description does not connect to them or provide any context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_metricsA
Query metrics with PromQL over a time range (Prometheus query_range)
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Resolution step | 60s |
| query | Yes | PromQL expression | |
| end_time | No | ISO timestamp. Defaults to now. | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the tool queries metrics over a range and references Prometheus query_range, which implies a read-only operation, but it does not disclose output format, time-range limits, pagination, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core action and resource. There is no redundancy or filler; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description could usefully mention the return format (e.g., Prometheus matrix) and any time-range constraints. The schema documents parameters well, but the overall tool context is under-specified for an agent that needs to understand what to expect from the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented. The description adds only the 'PromQL' and 'time range' context, which is already reflected in the schema descriptions, adding minimal semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Query metrics with PromQL over a time range', which clearly identifies the tool's purpose and distinguishes it from log/trace siblings. The parenthetical 'Prometheus query_range' further anchors the exact API behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this tool to query Prometheus metrics over a time range. It does not explicitly mention when not to use it or name alternatives, but the metric/time-range framing is enough to guide tool selection among the listed siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsA
Search logs with an optional SQL WHERE clause, newest first
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows to return | |
| query | No | SQL WHERE clause without the WHERE keyword, e.g. "level='error'" | |
| stream | Yes | Stream name to search | |
| end_time | No | ISO timestamp. Defaults to now. | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It adds useful facts like 'newest first' and 'optional SQL WHERE clause', but does not address response format, pagination, error behavior, or time range semantics beyond what the schema already specifies. It provides some value but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys core functionality and two key behaviors (SQL filter, newest first). Every word earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 params, no output schema), the description covers the main action but omits details about return values, limit application, or error handling. The schema fills parameter gaps, but the description could be stronger by adding expected output or when to prefer this over sibling search/aggregation tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add extra parameter-level meaning; it merely restates the optional SQL WHERE clause, which is already detailed in the query parameter description. No boost needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('search') and resource ('logs'), and adds valuable detail about the optional SQL WHERE clause and newest-first ordering. This clearly differentiates it from sibling tools like search_traces (traces) and aggregate_logs (aggregation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives. It implies usage for searching logs with filtering, but does not mention when not to use it, prerequisites, or relationships to siblings like search_traces or aggregate_logs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_tracesA
List recent traces with their root operation, duration, and participating services
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum traces to return | |
| filter | No | Filter, e.g. "service_name='api'" | |
| stream | No | Trace stream name | default |
| end_time | No | ISO timestamp. Defaults to now. | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It only says 'list recent traces' and does not specify ordering, default time window, pagination behavior, or error handling. This is minimal beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the primary action and resource, then lists the key output fields. No filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and schema together cover the basic purpose and all inputs, but with no output schema and no annotations, the description lacks contextual details like sorting, pagination, or typical usage patterns. It is adequate but has room for improvement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already fully documents all five parameters, including defaults and examples. The description adds no parameter-specific meaning, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and resource ('recent traces'), and specifies the returned fields (root operation, duration, participating services). This distinguishes it from sibling tools like get_trace (single trace) and search_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing recent traces, but provides no explicit when-to-use guidance, exclusions, or alternatives. It does not mention when to prefer this over get_trace or search_logs, leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v1.0.0- First observed
aggregate_logs - First observed
get_org_summary - First observed
get_schema - First observed
get_trace - First observed
list_streams - First observed
query_metrics - First observed
search_logs - First observed
search_traces
TDQS
Each tool targets a distinct aspect of OpenObserve: streams, schema, org summary, logs, traces, metrics. Search vs. aggregate vs. query are clearly differentiated by descriptions, and search_traces vs. get_trace are separate listing vs. detail operations.
All tool names use snake_case with a verb_noun structure (list_, get_, search_, aggregate_, query_). The verbs accurately reflect the operation, and the nouns denote the target resource. This is highly predictable.
With 8 tools covering streams, schema, logs, traces, and metrics, the surface is well-scoped without being bloated. Each tool fills a necessary role for an observability MCP server.
The set provides a comprehensive read-only query surface: listing streams, inspecting schemas, searching and aggregating logs, listing traces with details, and querying metrics. No obvious dead ends or missing critical operations for the core domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Cloud hosted Okahu MCP server that helps you manage genAI trace data
- SpanlyOAuthcom.spanly
MCP observability. Query live traffic, errors, duration, and alerts from your AI agent.
Related MCP Servers
- AlicenseBqualityCmaintenanceA read-only MCP server for OpenObserve Community Edition that works over the REST API. Provides tools for searching logs, traces, stream schemas, and dashboards - no Enterprise license required.817GPL 3.0
- AlicenseAqualityDmaintenanceMCP server that gives AI agents access to your application's OpenTelemetry traces for querying, analysis, and debugging.5162MIT
- AlicenseNot gradedqualityBmaintenanceAn MCP server that enables AI assistants to query and explore your OpenObserve observability data. Provides read-only access to logs, metrics, and traces for analysis and troubleshooting.5MIT
- AlicenseAqualityBmaintenanceMCP server for AI agent observability, providing trace and span logging, search, latency/tokens/cost metrics, and anomaly detection using an in-memory buffer.638MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/devShahriar/OpenObserve-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server