Skip to main content
Glama
jagadeesh52423

Graylog MCP Server

šŸ” Graylog MCP Server

An MCP server that gives AI assistants direct access to your Graylog logs -- search, aggregate, analyze, and cluster log data through natural language.

What It Does

This server exposes your Graylog instance(s) as MCP tools, so AI assistants like Claude, Cursor, and others can query logs on your behalf. Instead of context-switching to the Graylog UI, you describe what you're looking for and the assistant handles the rest.

25 tools covering:

  • Log search -- full-text and field-filtered queries with pagination, exact/fuzzy matching, and configurable field selection

  • Contextual analysis -- fetch surrounding messages around a specific log entry

  • Aggregations -- histograms, field statistics, and two-dimensional field-over-time breakdowns

  • Log clustering -- group similar messages into structural templates using Drain3, with persistent template libraries per connection

  • Events -- search Graylog events, list event definitions and notifications

  • Saved searches -- save, list, and reuse query configurations

  • Multi-connection -- switch between Graylog instances (e.g., nonprod vs prod) within one session

  • Stream & field discovery -- list streams, discover distinct field values

Related MCP server: log-mcp

Prerequisites

Installation

No installation needed. Configure your MCP client to run:

{
  "mcpServers": {
    "graylog": {
      "command": "npx",
      "args": ["graylog-mcp-server"]
    }
  }
}

From source

git clone https://github.com/jagadeesh52423/graylog-mcp.git
cd graylog-mcp
npm install

Then point your MCP client to the local entry point:

{
  "mcpServers": {
    "graylog": {
      "command": "node",
      "args": ["/absolute/path/to/graylog-mcp/src/index.js"]
    }
  }
}

Configuration

Create ~/.graylog-mcp/config.json:

{
  "connections": {
    "nonprod": {
      "baseUrl": "http://graylog-nonprod:9000",
      "apiToken": "your_api_token"
    },
    "prod": {
      "baseUrl": "http://graylog-prod:9000",
      "apiToken": "your_prod_api_token",
      "defaultFields": ["timestamp", "message", "level", "source", "PODNAME"]
    }
  },
  "defaultFields": ["timestamp", "gl2_message_id", "source", "env", "level", "message", "logger_name"]
}

Option

Scope

Description

connections

Root

Named Graylog instances, each with baseUrl and apiToken

defaultFields

Root

Global default fields returned in search results

defaultFields

Connection

Per-connection override (takes priority over global)

If no defaultFields are set, all fields (*) are returned.

Override the config path with the GRAYLOG_CONFIG_PATH environment variable:

{
  "mcpServers": {
    "graylog": {
      "command": "npx",
      "args": ["graylog-mcp-server"],
      "env": {
        "GRAYLOG_CONFIG_PATH": "/path/to/custom/config.json"
      }
    }
  }
}

MCP Client Config Locations

Client

Config file

Claude Code

~/.claude/mcp.json

Cursor

~/.cursor/mcp.json

Claude Desktop (macOS)

~/Library/Application Support/Claude/claude_desktop_config.json

Usage

Once connected, talk to your AI assistant naturally. Some examples:

Connect to nonprod and show me error logs from the last hour
What are the top error sources in production over the past 6 hours?
Show me a histogram of level 3 errors over the past day, broken down by hour
Cluster the last 1000 error messages and show me the top patterns
Show me the messages surrounding log ID 01KH5PDR893AZJQBYJJ87AQTW5

Time Ranges

Relative: 30m, 1h, 2d, 1w, 3M, 1y

Absolute: provide from/to as ISO timestamps (2024-01-15T09:00:00Z) or Unix millis.

Default is 15 minutes if unspecified.

Available Tools

Connection Management

Tool

Description

list_connections

List configured Graylog connections

use_connection

Switch to a named connection

Tool

Description

fetch_graylog_messages

Search logs with query, filters, time range, pagination

get_surrounding_messages

Get messages around a specific log entry by ID or timestamp

list_streams

List available Graylog streams

list_field_values

Discover distinct values for a field (top N by count)

Aggregations

Tool

Description

get_log_histogram

Time-bucketed message counts

get_field_aggregation

Group by field with metrics (count, sum, avg, min, max)

get_field_time_aggregation

Two-dimensional: field values over time intervals

debug_histogram_query

Debug helper for empty histogram results

Log Clustering

Tool

Description

cluster_log_messages

Group similar messages into structural templates (Drain3)

list_log_templates

List learned templates for the active connection

delete_log_template

Remove a template

rename_log_template

Give a template a human-readable label

export_log_templates

Export template library as JSON

import_log_templates

Bulk import templates (merge or replace)

Templates are persisted at ~/.graylog-mcp/templates/<connection>.json and improve over time as more messages are clustered.

Events

Tool

Description

search_events

Search Graylog events with filters

get_event_definitions

List event definitions

get_event_notifications

List event notifications

Saved Searches

Tool

Description

save_search

Save a query configuration for reuse

list_saved_searches

List all saved searches

get_saved_search

Retrieve a saved search by name

delete_saved_search

Delete a saved search

Project Structure

src/
ā”œā”€ā”€ index.js                          Server bootstrap and request routing
ā”œā”€ā”€ config.js                         Connection config and field defaults
ā”œā”€ā”€ query.js                          Query building and Graylog API client
ā”œā”€ā”€ tools.js                          Tool schema definitions (25 tools)
ā”œā”€ā”€ timerange.js                      Flexible time range parsing
ā”œā”€ā”€ aggregations.js                   Histogram, field stats, time-series
ā”œā”€ā”€ events.js                         Graylog events API
ā”œā”€ā”€ saved-searches.js                 Persistent saved search store
ā”œā”€ā”€ clustering/
│   ā”œā”€ā”€ index.js                      Strategy registry
│   ā”œā”€ā”€ preprocess.js                 Message normalization and tokenization
│   ā”œā”€ā”€ formatter.js                  Cluster response formatting
│   ā”œā”€ā”€ template-store.js             Per-connection template persistence
│   └── strategies/
│       └── drain3.js                 Drain3 log clustering algorithm
└── tools/
    ā”œā”€ā”€ cluster-errors.js             cluster_log_messages handler
    └── template-mgmt.js              Template CRUD handlers

Adding a Clustering Algorithm

  1. Create src/clustering/strategies/<name>.js implementing hydrate, serialize, and cluster (see drain3.js)

  2. Register it in src/clustering/index.js

  3. Pass algorithm: "<name>" to cluster_log_messages

License

MIT

Available Tools

23 tools
cluster_log_messagesA

Cluster similar log messages into Drain3-style templates. Fetches messages with the same args as fetch_graylog_messages, then groups them by structural similarity. Templates are persisted per connection and reused across calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoAbsolute end time (ISO)
fromNoAbsolute start time (ISO)
fieldNoField to cluster on. Default 'message'.
queryNoQuery string (same as fetch_graylog_messages)
filtersNoField filters
readOnlyNoIf true, do not update template library. Default false.
algorithmNoClustering algorithm. Default 'drain3'.
streamIdsNoOptional stream IDs
timeRangeNoTime range (e.g. '1h', '30m')
exactMatchNoWrap query in quotes (default true)
sampleSizeNoMax messages to fetch & cluster. Default 1000, max 10000.
maxChildrenNoMax templates per length bucket (LRU evict beyond this). Default 100.
includeSamplesNoSample messages per cluster (first/middle/last by time). Default 3.
minClusterSizeNoSingletons collapsed under '_misc' cluster. Default 2.
similarityThresholdNoDrain3 similarity threshold 0-1. Default 0.6. Lower = more aggressive merging.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing side effects. It states 'Templates are persisted per connection and reused across calls,' revealing statefulness. It does not mention performance cost or partial updates, but the core side-effect is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the purpose, and follows up with a useful behavior note. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex tool with 15 parameters and no output schema. The description omits the return format, performance implications, and relationship to sibling template-management tools (e.g., list_log_templates, delete_log_template). It only mentions persistence and reuse, which is insufficient for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description references fetch_graylog_messages to explain shared query parameters but adds no unique syntax or behavior beyond what the schema already provides. No compensation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Cluster' with a clear resource ('log messages') and specifies the output ('Drain3-style templates'). It also distinguishes itself from sibling fetch_graylog_messages by stating it fetches using the same args but groups them by structural similarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly references fetch_graylog_messages for the same query arguments, implying this tool is for clustering instead of raw retrieval. It also notes that templates are persisted and reused across calls, indicating when consistency matters. No explicit exclusions are given, but the context is sufficient for most decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

debug_histogram_queryA

Debug helper to test if the histogram query finds any messages at all. Use this if histogram returns empty buckets.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range
fromNoStart time for absolute range
queryNoQuery to test
filtersNoField filters to test
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '30m', '2d')
exactMatchNoIf true (default), wraps the query in quotes for exact match.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the tool's debug purpose but gives no details about side effects, permissions, or what the tool actually returns (e.g., count, boolean, raw messages). This is a significant gap for a tool that executes queries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the main purpose, and contains no wasted words. It effectively communicates the core idea in minimal space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description should clarify return values or behavior. It states the purpose but does not explain what 'finds messages' means (e.g., output structure, success criteria). This is adequate for a simple debug helper but leaves some ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 7 parameters have descriptions in the schema. The tool description adds no additional parameter semantics beyond what the schema already provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a 'Debug helper to test if the histogram query finds any messages at all,' which is a specific verb+resource combination. It distinguishes itself from sibling tools like get_log_histogram by focusing on debugging empty histogram buckets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this if histogram returns empty buckets,' providing a clear condition for when to use the tool. It doesn't mention alternatives or exclusions, but the use case is well-defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_log_templateB

Delete a learned log template by ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
templateIdYesTemplate ID (e.g. tpl_a3f1b2)

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral transparency. While 'Delete' implies a destructive action, it does not disclose whether deletion is permanent, requires special permissions, or has side effects on dependent resources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys the essential information without any filler or redundant content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple ID-based delete operation with complete schema coverage, the description is minimally viable. However, it lacks context about irreversibility, failure behavior, or consequences when templates are in use, which would be valuable for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions already fully cover the single parameter with 100% coverage, including an example format. The description adds no additional parameter semantics beyond restating 'by ID', so the baseline of 3 for high schema coverage is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Delete'), the resource ('learned log template'), and the method ('by ID'). It is specific and distinguishes itself from sibling tools like rename_log_template and delete_saved_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, such as when to use delete_saved_search or when a template should be deleted. It does not mention prerequisites like listing templates to obtain a valid ID.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_log_templatesA

Export all learned templates for the active connection as JSON.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It states the operation is an 'export' which implies read-only, and specifies the scope and format. However, it does not explicitly disclose whether this operation has side effects, requires special permissions, or what happens if no templates exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately states the action, the subject, the scope, and the output format. Every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, this description is quite complete: it specifies what is exported (all learned templates), from where (active connection), and in what format (JSON). Small gap: it is ambiguous whether the JSON is returned directly or written to a file, but that is not a major omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema describes 100% of them (none). Baseline for 0 parameters is 4, and the description adds no conflicting information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Export' and clearly identifies the resource as 'all learned templates for the active connection' with the output format 'JSON'. This clearly distinguishes it from sibling tools like list_log_templates (which lists them) and import_log_templates (which imports).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage in the context of the active connection, but it does not explicitly state when to use this tool versus alternatives like list_log_templates or import_log_templates. No exclusions or alternative suggestions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_graylog_messagesB

Fetch messages from the active Graylog connection. Use 'use_connection' first to select a connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
pageNoPage number (starts at 1). Default: 1
queryNoThe query to search for, with the respective fields and values
fieldsNoComma-separated field names to return, or '*' for all fields. Default: returns key fields only (timestamp, gl2_message_id, source, env, level, message, logger_name, thread_name, PODNAME)
filtersNoField filters (e.g. {"env": "marketplace_loki", "level": 7, "source": "prefr-management"})
pageSizeNoNumber of messages per page. Default: 50
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
exactMatchNoIf true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search.
searchTimeRangeInSecondsNo[DEPRECATED] Use timeRange instead. Time range in seconds

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only states the action and the prerequisite but fails to mention read-only nature, error handling when no connection is active, pagination behavior, or any side effects. This is insufficient for a tool that fetches data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences totaling 21 words—with no filler. It front-loads the primary action and includes a useful prerequisite. Every word contributes to clarity, making it an exemplary model of brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's complexity (11 parameters, nested objects, no output schema, no annotations), the description offers no guidance on parameter usage, result format, or how it interacts with siblings like list_streams or get_surrounding_messages. The prerequisite mention helps slightly, but overall it leaves substantial gaps for a tool with this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides complete descriptions for all 11 parameters, so the baseline is 3. The tool description does not add any additional parameter-level detail or context beyond what the schema already supplies, so the score remains at baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's function as fetching messages from the active Graylog connection, specifying the verb (Fetch), resource (messages), and scope (active Graylog connection). It also references the prerequisite of using 'use_connection', which helps distinguish it from other list/get tools in the sibling set, though it doesn't explicitly contrast with similar message retrieval tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear prerequisite: 'Use use_connection first to select a connection.' This provides context for when to use the tool. However, it does not mention alternatives or when not to use it, such as comparing with get_surrounding_messages or search_events, leaving the usage guidance implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_event_definitionsB

Get Graylog event definitions. Use 'use_connection' first to select a connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number (starts at 1). Default: 1
queryNoSearch query to filter event definitions
perPageNoNumber of results per page. Default: 25

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It mentions the connection prerequisite but does not state whether this is a read-only operation, what the response format is, how pagination behaves beyond the schema, or any potential side effects. This is insufficient for a tool with no annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states the core function, the second gives a necessary usage hint. It is front-loaded and every word earns its place, making it appropriately concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with pagination and no output schema, the description is incomplete. It does not explain what the response contains, whether results are scoped to the selected connection, or anything about the data returned. The connection prerequisite is useful but does not compensate for the lack of return-value and behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters (page, query, perPage) have descriptions in the schema, giving 100% schema coverage. The tool description adds no extra parameter information, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves Graylog event definitions, using the verb 'Get' with a specific resource. It implicitly differentiates from the sibling tool 'get_event_notifications' by focusing on definitions rather than notifications, though it does not explicitly mention that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear prerequisite: 'Use 'use_connection' first to select a connection.' However, it provides no guidance on when to use this tool versus alternatives like 'get_event_notifications' or 'search_events', and no exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_event_notificationsA

Get Graylog event notifications. Use 'use_connection' first to select a connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number (starts at 1). Default: 1
perPageNoNumber of results per page. Default: 25

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden of behavioral disclosure. It does reveal that a connection must be selected first, which is useful. Yet it omits details like pagination behavior beyond the schema, what happens if no connection is selected, or the response format. As a read-only 'Get' operation, the risk is lower, but the description is still relatively thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the purpose, and includes a separate actionable prerequisite. No words are wasted, and the structure is clear and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool shape (2 optional params, no output schema), the description is mostly adequate but leaves some gaps. It doesn't explain what event notifications are, how they relate to event definitions or search_events, or what the return value looks like. The prerequisite about use_connection helps, but additional context about alternatives would make it more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for both parameters (page, perPage) with clear descriptions. The tool description adds no additional parameter meaning beyond what the schema already states, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get') and the resource ('Graylog event notifications'), distinguishing it from other tools like get_event_definitions or search_events by name. However, it does not explicitly differentiate itself from sibling tools in the description text, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear prerequisite: 'Use use_connection first to select a connection.' This tells the agent when to use the tool relative to a specific sibling. However, it does not mention when not to use it or alternative tools, so it is not fully explicit but still strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_field_aggregationC

Aggregate log messages by field values with statistics. Get counts, sums, averages, etc. for field values.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
fieldYesField to aggregate on (e.g., 'source', 'env', 'logger_name', 'level')
limitNoMaximum number of field values to return. Default: 20
queryNoQuery to filter messages
filtersNoField filters (e.g. {"env": "production"})
metricsNoMetrics to calculate. Default: ['count']
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
exactMatchNoIf true (default), wraps the query in quotes for exact match.
valueFieldNoNumeric field for sum/avg/min/max calculations (required for non-count metrics)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions that counts, sums, averages, etc. are returned, but omits critical behaviors like default metrics (count), the need for valueField with non-count metrics, default limit of 20, time range handling, and exact match behavior. This is insufficient for a complex aggregation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the core action. It is two sentences with no fluff, though the phrase 'etc.' is vague and the second sentence somewhat restates the first. Still, it is efficiently sized for the clarity it provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 11 parameters, nested objects, no output schema, and no annotations, making it high complexity. The description does not explain return structure, required valueField for non-count metrics, default limit, or relationships among parameters. It is too minimal to fully prepare an agent for correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds examples of aggregate types (counts, sums, averages) that correspond to the metrics parameter, but does not explain relationships between parameters (e.g., valueField required for sum/avg/min/max) or defaults beyond what the schema already states. It adds marginal value over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool aggregates log messages by field values with statistics like counts, sums, and averages. It identifies the action (aggregate) and resource (log messages/field values), but does not explicitly differentiate from sibling tools like get_field_time_aggregation or list_field_values, so it misses the sibling differentiation point.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives, such as get_field_time_aggregation for time-based aggregation or list_field_values for simple value listing. The description implies a use case but provides no explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_field_time_aggregationC

Two-dimensional aggregation: field values over time. Shows how field values change over time intervals.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
fieldYesField to aggregate on (e.g., 'source', 'env', 'level')
limitNoMaximum number of field values to return. Default: 10
queryNoQuery to filter messages
filtersNoField filters (e.g. {"env": "production"})
intervalNoTime interval for buckets (e.g., '1m', '5m', '1h', 'auto'). Default: 'auto'
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
exactMatchNoIf true (default), wraps the query in quotes for exact match.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It only states that field values change over time intervals, but does not disclose output format, default limits, time range handling, or behavior with empty results. This is insufficient for a tool with 10 parameters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the core concept. No redundant information or unnecessary elaboration—every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (10 parameters, nested objects, no output schema, no annotations), the description is too brief. It doesn't explain the response structure, how time ranges interact with intervals, or provide fallback guidance, leaving significant gaps for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are fully documented. The description adds context about the two-dimensional nature but does not provide additional parameter-specific details beyond what the schema already contains, keeping this at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's function as aggregating field values over time intervals, using 'two-dimensional' to convey the dual dimension. It distinguishes itself from one-dimensional aggregation tools like get_field_aggregation, though it doesn't name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as get_field_aggregation or get_log_histogram. The usage context is only implied by the description's wording, with no explicit exclusions or alternative recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_log_histogramC

Get a time-based histogram of log messages. Shows message counts over time intervals.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
queryNoQuery to filter messages
filtersNoField filters (e.g. {"env": "production", "level": 3})
metricsNoMetrics to calculate per time bucket. Default: ['count']. Use with valueField for numeric aggregations.
intervalNoTime interval for buckets (e.g., '1m', '5m', '1h', 'auto'). Default: 'auto'
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
exactMatchNoIf true (default), wraps the query in quotes for exact match.
valueFieldNoNumeric field for sum/avg/min/max calculations (e.g., 'latencies_request'). Required when metrics include non-count metrics.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the full behavioral burden. It only states that it shows message counts over time, without disclosing details like whether it returns only counts or can calculate sum/avg/min/max (which the schema hints at), how intervals are determined, or any limitations. The behavioral transparency is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using only two short sentences that focus on the core purpose. It is front-loaded and has no filler. However, it is perhaps too terse for a tool with 10 parameters, though the schema handles parameter details, so the brevity is acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, and the description is minimal. It lacks context about the returned histogram structure, query semantics, or when to use it among many similar sibling tools. For a complex tool with 10 optional params, the description is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no parameter-specific meaning beyond the schema's own property descriptions. It does not clarify relationships between parameters (e.g., when valueField is required) beyond what is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets a time-based histogram of log messages and shows counts over intervals. The verb 'get' and resource 'time-based histogram' are specific. It does not explicitly differentiate from similar sibling tools like get_field_time_aggregation, but the name and description convey the core purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as get_field_aggregation or debug_histogram_query. There are no explicit when-to-use instructions or exclusions, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_surrounding_messagesA

Get messages surrounding a specific message. Provide messageId (preferred) or messageTimestamp to identify the target message.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of messages to return. Default: 50
queryNoAdditional query filter to narrow context
fieldsNoComma-separated field names to return, or '*' for all fields. Default: returns key fields only (timestamp, gl2_message_id, source, env, level, message, logger_name, thread_name, PODNAME)
filtersNoField filters (e.g. {"env": "marketplace_loki", "level": 7})
messageIdNogl2_message_id of the target message (preferred). The timestamp will be looked up automatically.
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
exactMatchNoIf true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search.
messageTimestampNoISO timestamp of the target message (fallback if messageId is not available)
surroundingSecondsNoTime window in seconds (± around the timestamp). Default: 5

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the preferred identifier method but does not disclose side effects, return format, or behavior when the target is not found. This is insufficient for a tool that likely performs a read operation; the agent is left guessing about safety and edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose and followed by essential identifier guidance. Every word earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex tool with 9 parameters, nested objects, and no output schema or annotations. The description does not explain the semantics of 'surrounding' (how the time window works), the structure of the returned messages, or what happens if the target message is ambiguous. It is not complete enough for an agent to understand the full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all parameters with descriptions (100% coverage), so the baseline is 3. The description adds value by specifying that messageId is 'preferred' and messageTimestamp is a fallback, which is not immediately clear from the schema alone. This improves parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get messages surrounding a specific message.' This is a specific verb+resource combination that distinguishes it from sibling tools like search_events or fetch_graylog_messages, which focus on broader searches rather than contextual retrieval around a single message.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'Provide messageId (preferred) or messageTimestamp to identify the target message.' It tells the agent exactly how to invoke the tool. However, it does not explicitly mention when not to use it or name alternatives, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

import_log_templatesB

Import templates into the active connection's library.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNomerge keeps existing; replace wipes first. Default 'merge'.
templatesYesMap of templateId → template object

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the import action and target; it does not mention that 'replace' mode is destructive, that existing templates may be wiped, or any side effects. It also does not explicitly state the requirement for an active connection as a prerequisite.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately states the action and target. It contains no wasted words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the schema being complete, the description is too sparse for a mutation tool without annotations or an output schema. It omits return value information, behavioral side effects, and prerequisites, leaving the agent with insufficient context to invoke the tool safely and effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters are fully described in the input schema (coverage 100%), with mode explaining merge vs replace and templates describing the map. The description adds no additional parameter semantics beyond what the schema already provides, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'import' with resource 'templates' and a clear destination 'active connection's library.' This distinguishes it from sibling tools like export_log_templates, list_log_templates, and delete_log_template by action and target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites (e.g., establishing an active connection). It is a bare statement of action without context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_connectionsA

List all available Graylog connections configured in ~/.graylog-mcp/config.json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context by specifying the source (config.json), which implies the tool reads from a local configuration file. However, it does not disclose potential behaviors like handling of missing files, sensitive data exposure, or whether it validates connections. For a simple read-only list, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that states exactly what the tool does and where it reads from. There is no redundancy or filler, every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (zero parameters, simple listing operation) and lack of output schema, the description is sufficient. It identifies the source and the purpose. It does not spell out the return format, but for a list operation named 'list_connections', the expected result is implicitly the list of connections. Slight improvement could clarify whether connection names or full configurations are returned, but overall it is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is 100% (empty schema), so there are no parameter semantics to clarify. The description adds no parameter information, but none is needed. The baseline for 0 params is 4, and no deduction is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('List all available Graylog connections') on a specific resource (connections configured in ~/.graylog-mcp/config.json). It distinguishes from sibling tools like use_connection by focusing on listing rather than activating, and from other list tools like list_streams or list_saved_searches by targeting connection objects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool: when you want to see all configured Graylog connections. It implies a read-only listing operation. However, it does not explicitly mention exclusions or alternatives, such as noting that use_connection is the tool to select/activate a connection, though the distinction is reasonably inferable from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_field_valuesA

List distinct values of a field with message counts. Useful for discovering available sources, environments, logger names, etc. Results are sorted by count descending.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
fieldYesThe field to get distinct values for (e.g. 'source', 'env', 'logger_name', 'level')
limitNoMaximum number of distinct values to return. Default: 20
queryNoQuery to scope the results (e.g. search within specific messages)
filtersNoField filters to narrow scope (e.g. {"env": "marketplace_loki"})
streamIdsNoOptional stream IDs to scope the search. Use 'list_streams' to get available stream IDs.
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
exactMatchNoIf true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search.
timeRangeInSecondsNo[DEPRECATED] Use timeRange instead. Time range in seconds. Default: 3600 (1 hour)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses sorting by count descending and that results include message counts, but doesn't go deeper into time-range behavior, query scoping, or default limits beyond what the schema explains. This is minimal but non-tautological.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the main action, and no redundant wording. Every sentence contributes: the first states what it does, the second explains when to use it and the result ordering.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given rich schema descriptions for all 10 parameters and no output schema, the description adequately covers the tool's core purpose and use case. It doesn't reiterate optional scoping features (timeRange, query, filters), but these are well-documented in the schema, and the description provides the necessary context for an agent to decide to invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no parameter-specific meaning beyond the schema, which already documents fields like 'field', 'limit', and time range. It reinforces the purpose but does not compensate for any gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('distinct values of a field with message counts'), which clearly distinguishes it from siblings like list_streams or search_events. It also names concrete example fields, reinforcing the tool's scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Useful for discovering available sources, environments, logger names, etc.' gives explicit context for when to use this tool. It lacks mention of alternatives or exclusions, but the stated use cases effectively guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_log_templatesB

List learned log templates for the active connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax templates to return. Default 50.
sortByNoSort key. Default 'count'.
filterLabelNoOnly return templates with this label.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral properties. It merely says 'List learned log templates', which is a read operation, but doesn't disclose whether results are paginated, sorted by default, or if any side effects occur. The 'learned' qualifier hints at origins but doesn't clarify behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler, but it's perhaps too brief. It could include a bit more guidance without losing conciseness. Overall, it is efficiently phrased.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with comprehensive schema descriptions, the description is minimally viable. It provides the key scope (active connection) but lacks differentiation from sibling tools and doesn't describe return behavior, though the output schema absence is mitigated by the simplicity of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are fully described in the input schema with 100% coverage. The description adds no additional parameter semantics beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (list) and resource (learned log templates), and scopes it to the active connection. This distinguishes it from sibling tools like delete_log_template, rename_log_template, and list_connections.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like export_log_templates, nor does it mention prerequisites such as establishing a connection with use_connection. The phrase 'active connection' implies context but doesn't explain how to set it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_saved_searchesB

List all saved searches.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full behavioral disclosure burden. It only states the action ('list all') and does not disclose any additional behavioral traits such as response format, pagination, sorting, performance implications, or authorization requirements. This is a significant gap for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that is appropriately sized for a tool with no parameters and no complex behavior. It is front-loaded with the essential action and resource, containing zero filler words. However, some might argue it is slightly underspecified, but for this simple tool it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description should explain what the return value looks like (e.g., list of IDs, full objects, metadata). It simply says 'list all saved searches' without providing any context on what fields or structure the returned list will contain, making it incomplete for an agent that needs to process the results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is nothing for the schema to document or for the description to supplement. The baseline of 4 applies because the description is not required to explain parameter meanings when none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description has a specific verb and resource ('List all saved searches') clearly indicating a read operation that returns a collection of saved searches. It distinguishes from siblings like get_saved_search (single) and delete_saved_search (mutation) by explicitly stating 'all'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'List all saved searches' implies the tool is used to retrieve the full set of saved searches, and the sibling names clarify alternatives (e.g., get_saved_search for a specific one). However, it does not explicitly state when to use this tool versus alternatives or mention any exclusions, leaving the guidance implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_streamsA

List all available Graylog streams in the active connection.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. The verb 'List' implies a read-only operation, but the description does not explicitly state safety, side effects, or output format. It adds only the 'active connection' scope, which is useful but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It states the action, subject, and scope efficiently, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with no parameters and no output schema, the description covers the essential aspects: what is listed and the scope. It does not need to explain return values because 'list' implies a list of streams, and no additional complexity is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema covers everything. Per the baseline for 0-parameter tools, the description does not need to add parameter details; the score reflects that there is nothing to explain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a clear resource ('Graylog streams') with an explicit scope ('in the active connection'). It distinguishes itself from sibling tools like list_connections or get_event_notifications by naming the resource type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in the active connection' provides clear context that the tool operates on a currently selected connection, implying a prerequisite (calling use_connection first). It does not state exclusions or alternatives, but no direct sibling tool lists streams, so the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rename_log_templateB

Set or update a human-readable label for a template.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelYesHuman-readable label (e.g. 'AuthFailure')
templateIdYesTemplate ID

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only indicates mutation ('Set or update') without revealing side effects, idempotency, error behavior, or permission requirements, leaving significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the core action without redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple two-parameter tool with full schema coverage and no output schema, so the description is adequate for the basic operation. However, it lacks behavioral context (e.g., what happens if the template doesn't exist) and does not mention return values, which would make it more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides descriptions for both parameters (templateId and label), covering 100% of them. The tool description adds no additional meaning beyond what the schema provides, so it meets the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Set or update') and the resource ('a human-readable label for a template'), distinguishing it from sibling tools like delete_log_template or list_log_templates. However, it doesn't explicitly mention 'log template' or 'rename', which would align more directly with the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives, nor are there any prerequisites or exclusions. The description simply states what it does without contextualizing when it's appropriate to call.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_eventsA

Search Graylog events and alerts. Use 'use_connection' first to select a connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time for absolute range (ISO string or timestamp)
fromNoStart time for absolute range (ISO string or timestamp)
pageNoPage number (starts at 1). Default: 1
queryNoSearch query for events
alertsNoFilter by alert status. 'only' = only alerts, 'include' = alerts + events, 'exclude' = only non-alert events. Default: include
sortByNoField to sort by. Default: timestamp
perPageNoNumber of results per page. Default: 25
timeRangeNoTime range (e.g., '1h', '2d', '30m') or use from/to for absolute range
sortDirectionNoSort direction. Default: desc
eventDefinitionIdsNoFilter by specific event definition IDs

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the purpose and connection prerequisite, but doesn't disclose pagination behavior, return format, default ranges, or any side effects. This is a significant gap for a read-style search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the primary purpose, followed by a key usage prerequisite. It is two sentences with zero wasted words, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 10 parameters and no output schema, but the schema itself is rich with descriptions. The description covers the essential purpose and connection prerequisite, but lacks behavioral context like return format or pagination. It is adequate but not fully complete for a complex search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 10 parameters including defaults and enums. The description adds no additional parameter meaning beyond the schema, which aligns with the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches Graylog events and alerts, which is a specific verb+resource combination. It distinguishes from sibling tools like list_streams or get_event_definitions by focusing on searching, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to call 'use_connection' first, providing a clear prerequisite for using this tool. This is useful context for sequencing, though it doesn't explicitly compare with alternatives like fetch_graylog_messages.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

use_connectionA

Connect to a specific Graylog instance by name. Must be called before fetching messages.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesThe connection name as defined in ~/.graylog-mcp/config.json

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool is a prerequisite for fetching messages, implying statefulness, but doesn't detail side effects, error behavior, or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, with every word contributing essential information. It is front-loaded with the core action and follows with a critical usage note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (single parameter, high schema coverage), the description adequately covers purpose and prerequisite usage. It lacks detail on return values or error handling, but the low complexity keeps this from being a significant gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage for the 'name' parameter with a clear description referencing config.json. The tool description adds no additional parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Connect') and resource ('specific Graylog instance by name'), distinguishing it from sibling tools like list_connections and fetch_graylog_messages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context by stating 'Must be called before fetching messages,' establishing a clear prerequisite. It doesn't mention alternatives or exclusions, but the guidance is sufficient for typical use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 23 tool updatesv2.3.0
    • First observedcluster_log_messages
    • First observeddebug_histogram_query
    • First observeddelete_log_template
    • First observeddelete_saved_search
    • First observedexport_log_templates
    • First observedfetch_graylog_messages
    • First observedget_event_definitions
    • First observedget_event_notifications
    • First observedget_field_aggregation
    • First observedget_field_time_aggregation
    • First observedget_log_histogram
    • First observedget_saved_search
    • First observedget_surrounding_messages
    • First observedimport_log_templates
    • First observedlist_connections
    • First observedlist_field_values
    • First observedlist_log_templates
    • First observedlist_saved_searches
    • First observedlist_streams
    • First observedrename_log_template
    • First observedsave_search
    • First observedsearch_events
    • First observeduse_connection

TDQS

A3.7/5.0
Disambiguation5/5

Each tool targets a distinct resource or action, such as connections, streams, saved searches, event definitions, or log templates. Overlapping analysis tools like get_log_histogram and get_field_time_aggregation are clearly differentiated by their descriptions.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case, with verbs like list, get, fetch, save, delete, and rename. This makes the set predictable and easy to navigate.

Tool Count4/5

23 tools is a substantial set, but it covers a broad range of Graylog functionality including connections, searches, events, analysis, and template management. The count is slightly heavy but each tool contributes to a cohesive workflow.

Completeness4/5

The tool surface provides strong coverage for log searching, analysis, saved searches, and log template CRUD operations. While event and stream management are read-only (no create/update/delete), the core log analysis lifecycle is well represented.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that connects Claude (or any MCP compatible client) to your existing log infrastructure. Query, summarize, and trace logs in plain English across GCP Cloud Logging, AWS CloudWatch, Azure Log Analytics, Grafana Loki, and Elasticsearch without writing filter expressions or leaving your editor.
    17
    3
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    MCP server for log file analysis. Gives LLMs the ability to efficiently analyze large log files without loading them into context.
    7
    99
    MIT
  • F
    license
    Not graded
    quality
    F
    maintenance
    An MCP server that enables AI assistants to query and analyze logs from Grafana Loki using LogQL, supporting label discovery and keyword search.
    4
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jagadeesh52423/graylog-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server