Graylog MCP Server
Provides direct access to Graylog logs with tools for searching, aggregating, analyzing, clustering, and managing logs, events, saved searches, and connections across multiple Graylog instances.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Graylog MCP Servershow me error logs from the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
š Graylog MCP Server
An MCP server that gives AI assistants direct access to your Graylog logs -- search, aggregate, analyze, and cluster log data through natural language.
What It Does
This server exposes your Graylog instance(s) as MCP tools, so AI assistants like Claude, Cursor, and others can query logs on your behalf. Instead of context-switching to the Graylog UI, you describe what you're looking for and the assistant handles the rest.
25 tools covering:
Log search -- full-text and field-filtered queries with pagination, exact/fuzzy matching, and configurable field selection
Contextual analysis -- fetch surrounding messages around a specific log entry
Aggregations -- histograms, field statistics, and two-dimensional field-over-time breakdowns
Log clustering -- group similar messages into structural templates using Drain3, with persistent template libraries per connection
Events -- search Graylog events, list event definitions and notifications
Saved searches -- save, list, and reuse query configurations
Multi-connection -- switch between Graylog instances (e.g., nonprod vs prod) within one session
Stream & field discovery -- list streams, discover distinct field values
Related MCP server: log-mcp
Prerequisites
Node.js 18+
Graylog 6.x (tested on 6.2)
A Graylog API token (how to create one)
Installation
Via npx (recommended)
No installation needed. Configure your MCP client to run:
{
"mcpServers": {
"graylog": {
"command": "npx",
"args": ["graylog-mcp-server"]
}
}
}From source
git clone https://github.com/jagadeesh52423/graylog-mcp.git
cd graylog-mcp
npm installThen point your MCP client to the local entry point:
{
"mcpServers": {
"graylog": {
"command": "node",
"args": ["/absolute/path/to/graylog-mcp/src/index.js"]
}
}
}Configuration
Create ~/.graylog-mcp/config.json:
{
"connections": {
"nonprod": {
"baseUrl": "http://graylog-nonprod:9000",
"apiToken": "your_api_token"
},
"prod": {
"baseUrl": "http://graylog-prod:9000",
"apiToken": "your_prod_api_token",
"defaultFields": ["timestamp", "message", "level", "source", "PODNAME"]
}
},
"defaultFields": ["timestamp", "gl2_message_id", "source", "env", "level", "message", "logger_name"]
}Option | Scope | Description |
| Root | Named Graylog instances, each with |
| Root | Global default fields returned in search results |
| Connection | Per-connection override (takes priority over global) |
If no defaultFields are set, all fields (*) are returned.
Override the config path with the GRAYLOG_CONFIG_PATH environment variable:
{
"mcpServers": {
"graylog": {
"command": "npx",
"args": ["graylog-mcp-server"],
"env": {
"GRAYLOG_CONFIG_PATH": "/path/to/custom/config.json"
}
}
}
}MCP Client Config Locations
Client | Config file |
Claude Code |
|
Cursor |
|
Claude Desktop (macOS) |
|
Usage
Once connected, talk to your AI assistant naturally. Some examples:
Connect to nonprod and show me error logs from the last hourWhat are the top error sources in production over the past 6 hours?Show me a histogram of level 3 errors over the past day, broken down by hourCluster the last 1000 error messages and show me the top patternsShow me the messages surrounding log ID 01KH5PDR893AZJQBYJJ87AQTW5Time Ranges
Relative: 30m, 1h, 2d, 1w, 3M, 1y
Absolute: provide from/to as ISO timestamps (2024-01-15T09:00:00Z) or Unix millis.
Default is 15 minutes if unspecified.
Available Tools
Connection Management
Tool | Description |
| List configured Graylog connections |
| Switch to a named connection |
Log Search
Tool | Description |
| Search logs with query, filters, time range, pagination |
| Get messages around a specific log entry by ID or timestamp |
| List available Graylog streams |
| Discover distinct values for a field (top N by count) |
Aggregations
Tool | Description |
| Time-bucketed message counts |
| Group by field with metrics (count, sum, avg, min, max) |
| Two-dimensional: field values over time intervals |
| Debug helper for empty histogram results |
Log Clustering
Tool | Description |
| Group similar messages into structural templates (Drain3) |
| List learned templates for the active connection |
| Remove a template |
| Give a template a human-readable label |
| Export template library as JSON |
| Bulk import templates (merge or replace) |
Templates are persisted at ~/.graylog-mcp/templates/<connection>.json and improve over time as more messages are clustered.
Events
Tool | Description |
| Search Graylog events with filters |
| List event definitions |
| List event notifications |
Saved Searches
Tool | Description |
| Save a query configuration for reuse |
| List all saved searches |
| Retrieve a saved search by name |
| Delete a saved search |
Project Structure
src/
āāā index.js Server bootstrap and request routing
āāā config.js Connection config and field defaults
āāā query.js Query building and Graylog API client
āāā tools.js Tool schema definitions (25 tools)
āāā timerange.js Flexible time range parsing
āāā aggregations.js Histogram, field stats, time-series
āāā events.js Graylog events API
āāā saved-searches.js Persistent saved search store
āāā clustering/
ā āāā index.js Strategy registry
ā āāā preprocess.js Message normalization and tokenization
ā āāā formatter.js Cluster response formatting
ā āāā template-store.js Per-connection template persistence
ā āāā strategies/
ā āāā drain3.js Drain3 log clustering algorithm
āāā tools/
āāā cluster-errors.js cluster_log_messages handler
āāā template-mgmt.js Template CRUD handlersAdding a Clustering Algorithm
Create
src/clustering/strategies/<name>.jsimplementinghydrate,serialize, andcluster(seedrain3.js)Register it in
src/clustering/index.jsPass
algorithm: "<name>"tocluster_log_messages
License
Available Tools
23 toolscluster_log_messagesA
Cluster similar log messages into Drain3-style templates. Fetches messages with the same args as fetch_graylog_messages, then groups them by structural similarity. Templates are persisted per connection and reused across calls.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Absolute end time (ISO) | |
| from | No | Absolute start time (ISO) | |
| field | No | Field to cluster on. Default 'message'. | |
| query | No | Query string (same as fetch_graylog_messages) | |
| filters | No | Field filters | |
| readOnly | No | If true, do not update template library. Default false. | |
| algorithm | No | Clustering algorithm. Default 'drain3'. | |
| streamIds | No | Optional stream IDs | |
| timeRange | No | Time range (e.g. '1h', '30m') | |
| exactMatch | No | Wrap query in quotes (default true) | |
| sampleSize | No | Max messages to fetch & cluster. Default 1000, max 10000. | |
| maxChildren | No | Max templates per length bucket (LRU evict beyond this). Default 100. | |
| includeSamples | No | Sample messages per cluster (first/middle/last by time). Default 3. | |
| minClusterSize | No | Singletons collapsed under '_misc' cluster. Default 2. | |
| similarityThreshold | No | Drain3 similarity threshold 0-1. Default 0.6. Lower = more aggressive merging. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing side effects. It states 'Templates are persisted per connection and reused across calls,' revealing statefulness. It does not mention performance cost or partial updates, but the core side-effect is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose, and follows up with a useful behavior note. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 15 parameters and no output schema. The description omits the return format, performance implications, and relationship to sibling template-management tools (e.g., list_log_templates, delete_log_template). It only mentions persistence and reuse, which is insufficient for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description references fetch_graylog_messages to explain shared query parameters but adds no unique syntax or behavior beyond what the schema already provides. No compensation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Cluster' with a clear resource ('log messages') and specifies the output ('Drain3-style templates'). It also distinguishes itself from sibling fetch_graylog_messages by stating it fetches using the same args but groups them by structural similarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly references fetch_graylog_messages for the same query arguments, implying this tool is for clustering instead of raw retrieval. It also notes that templates are persisted and reused across calls, indicating when consistency matters. No explicit exclusions are given, but the context is sufficient for most decisions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
debug_histogram_queryA
Debug helper to test if the histogram query finds any messages at all. Use this if histogram returns empty buckets.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range | |
| from | No | Start time for absolute range | |
| query | No | Query to test | |
| filters | No | Field filters to test | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '30m', '2d') | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the tool's debug purpose but gives no details about side effects, permissions, or what the tool actually returns (e.g., count, boolean, raw messages). This is a significant gap for a tool that executes queries.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the main purpose, and contains no wasted words. It effectively communicates the core idea in minimal space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, so the description should clarify return values or behavior. It states the purpose but does not explain what 'finds messages' means (e.g., output structure, success criteria). This is adequate for a simple debug helper but leaves some ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 7 parameters have descriptions in the schema. The tool description adds no additional parameter semantics beyond what the schema already provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'Debug helper to test if the histogram query finds any messages at all,' which is a specific verb+resource combination. It distinguishes itself from sibling tools like get_log_histogram by focusing on debugging empty histogram buckets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this if histogram returns empty buckets,' providing a clear condition for when to use the tool. It doesn't mention alternatives or exclusions, but the use case is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_log_templateB
Delete a learned log template by ID.
| Name | Required | Description | Default |
|---|---|---|---|
| templateId | Yes | Template ID (e.g. tpl_a3f1b2) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral transparency. While 'Delete' implies a destructive action, it does not disclose whether deletion is permanent, requires special permissions, or has side effects on dependent resources.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that conveys the essential information without any filler or redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple ID-based delete operation with complete schema coverage, the description is minimally viable. However, it lacks context about irreversibility, failure behavior, or consequences when templates are in use, which would be valuable for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions already fully cover the single parameter with 100% coverage, including an example format. The description adds no additional parameter semantics beyond restating 'by ID', so the baseline of 3 for high schema coverage is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Delete'), the resource ('learned log template'), and the method ('by ID'). It is specific and distinguishes itself from sibling tools like rename_log_template and delete_saved_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as when to use delete_saved_search or when a template should be deleted. It does not mention prerequisites like listing templates to obtain a valid ID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_saved_searchB
Delete a saved search by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The name of the saved search to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description simply restates the action without disclosing behavioral traits such as whether deletion is permanent, what happens if the saved search does not exist, or any required permissions. With no annotations, the description carries the full responsibility and fails to add any context beyond the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely compact, using one sentence with no unnecessary words. It is front-loaded with the verb and resource. While it could be more informative, conciseness is excellent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple deletion with one parameter, but the description omits important details such as return values, error behavior, and permanence of deletion. There is no output schema and no annotations, so these details should have been included in the description. The description is not sufficient for an agent to understand the full impact of calling this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the 'name' parameter with its own description, so the description's 'by name' adds nothing new. Since schema description coverage is 100%, the baseline of 3 applies. No extra semantic value is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Delete' with the resource 'saved search' and identifies the parameter 'by name'. It clearly distinguishes from sibling tools like save_search and get_saved_search, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention any preconditions, such as the saved search needing to exist, nor does it describe what to do if the name is not found. There are no explicit when-to-use or when-not-to-use instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_log_templatesA
Export all learned templates for the active connection as JSON.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states the operation is an 'export' which implies read-only, and specifies the scope and format. However, it does not explicitly disclose whether this operation has side effects, requires special permissions, or what happens if no templates exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately states the action, the subject, the scope, and the output format. Every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, this description is quite complete: it specifies what is exported (all learned templates), from where (active connection), and in what format (JSON). Small gap: it is ambiguous whether the JSON is returned directly or written to a file, but that is not a major omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema describes 100% of them (none). Baseline for 0 parameters is 4, and the description adds no conflicting information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Export' and clearly identifies the resource as 'all learned templates for the active connection' with the output format 'JSON'. This clearly distinguishes it from sibling tools like list_log_templates (which lists them) and import_log_templates (which imports).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage in the context of the active connection, but it does not explicitly state when to use this tool versus alternatives like list_log_templates or import_log_templates. No exclusions or alternative suggestions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_graylog_messagesB
Fetch messages from the active Graylog connection. Use 'use_connection' first to select a connection.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| page | No | Page number (starts at 1). Default: 1 | |
| query | No | The query to search for, with the respective fields and values | |
| fields | No | Comma-separated field names to return, or '*' for all fields. Default: returns key fields only (timestamp, gl2_message_id, source, env, level, message, logger_name, thread_name, PODNAME) | |
| filters | No | Field filters (e.g. {"env": "marketplace_loki", "level": 7, "source": "prefr-management"}) | |
| pageSize | No | Number of messages per page. Default: 50 | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search. | |
| searchTimeRangeInSeconds | No | [DEPRECATED] Use timeRange instead. Time range in seconds |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only states the action and the prerequisite but fails to mention read-only nature, error handling when no connection is active, pagination behavior, or any side effects. This is insufficient for a tool that fetches data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely conciseātwo sentences totaling 21 wordsāwith no filler. It front-loads the primary action and includes a useful prerequisite. Every word contributes to clarity, making it an exemplary model of brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the tool's complexity (11 parameters, nested objects, no output schema, no annotations), the description offers no guidance on parameter usage, result format, or how it interacts with siblings like list_streams or get_surrounding_messages. The prerequisite mention helps slightly, but overall it leaves substantial gaps for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides complete descriptions for all 11 parameters, so the baseline is 3. The tool description does not add any additional parameter-level detail or context beyond what the schema already supplies, so the score remains at baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function as fetching messages from the active Graylog connection, specifying the verb (Fetch), resource (messages), and scope (active Graylog connection). It also references the prerequisite of using 'use_connection', which helps distinguish it from other list/get tools in the sibling set, though it doesn't explicitly contrast with similar message retrieval tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear prerequisite: 'Use use_connection first to select a connection.' This provides context for when to use the tool. However, it does not mention alternatives or when not to use it, such as comparing with get_surrounding_messages or search_events, leaving the usage guidance implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_event_definitionsB
Get Graylog event definitions. Use 'use_connection' first to select a connection.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (starts at 1). Default: 1 | |
| query | No | Search query to filter event definitions | |
| perPage | No | Number of results per page. Default: 25 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral disclosure. It mentions the connection prerequisite but does not state whether this is a read-only operation, what the response format is, how pagination behaves beyond the schema, or any potential side effects. This is insufficient for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first states the core function, the second gives a necessary usage hint. It is front-loaded and every word earns its place, making it appropriately concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with pagination and no output schema, the description is incomplete. It does not explain what the response contains, whether results are scoped to the selected connection, or anything about the data returned. The connection prerequisite is useful but does not compensate for the lack of return-value and behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters (page, query, perPage) have descriptions in the schema, giving 100% schema coverage. The tool description adds no extra parameter information, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves Graylog event definitions, using the verb 'Get' with a specific resource. It implicitly differentiates from the sibling tool 'get_event_notifications' by focusing on definitions rather than notifications, though it does not explicitly mention that distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear prerequisite: 'Use 'use_connection' first to select a connection.' However, it provides no guidance on when to use this tool versus alternatives like 'get_event_notifications' or 'search_events', and no exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_event_notificationsA
Get Graylog event notifications. Use 'use_connection' first to select a connection.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (starts at 1). Default: 1 | |
| perPage | No | Number of results per page. Default: 25 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the burden of behavioral disclosure. It does reveal that a connection must be selected first, which is useful. Yet it omits details like pagination behavior beyond the schema, what happens if no connection is selected, or the response format. As a read-only 'Get' operation, the risk is lower, but the description is still relatively thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loads the purpose, and includes a separate actionable prerequisite. No words are wasted, and the structure is clear and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool shape (2 optional params, no output schema), the description is mostly adequate but leaves some gaps. It doesn't explain what event notifications are, how they relate to event definitions or search_events, or what the return value looks like. The prerequisite about use_connection helps, but additional context about alternatives would make it more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage for both parameters (page, perPage) with clear descriptions. The tool description adds no additional parameter meaning beyond what the schema already states, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and the resource ('Graylog event notifications'), distinguishing it from other tools like get_event_definitions or search_events by name. However, it does not explicitly differentiate itself from sibling tools in the description text, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear prerequisite: 'Use use_connection first to select a connection.' This tells the agent when to use the tool relative to a specific sibling. However, it does not mention when not to use it or alternative tools, so it is not fully explicit but still strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_field_aggregationC
Aggregate log messages by field values with statistics. Get counts, sums, averages, etc. for field values.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| field | Yes | Field to aggregate on (e.g., 'source', 'env', 'logger_name', 'level') | |
| limit | No | Maximum number of field values to return. Default: 20 | |
| query | No | Query to filter messages | |
| filters | No | Field filters (e.g. {"env": "production"}) | |
| metrics | No | Metrics to calculate. Default: ['count'] | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. | |
| valueField | No | Numeric field for sum/avg/min/max calculations (required for non-count metrics) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions that counts, sums, averages, etc. are returned, but omits critical behaviors like default metrics (count), the need for valueField with non-count metrics, default limit of 20, time range handling, and exact match behavior. This is insufficient for a complex aggregation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the core action. It is two sentences with no fluff, though the phrase 'etc.' is vague and the second sentence somewhat restates the first. Still, it is efficiently sized for the clarity it provides.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 11 parameters, nested objects, no output schema, and no annotations, making it high complexity. The description does not explain return structure, required valueField for non-count metrics, default limit, or relationships among parameters. It is too minimal to fully prepare an agent for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds examples of aggregate types (counts, sums, averages) that correspond to the metrics parameter, but does not explain relationships between parameters (e.g., valueField required for sum/avg/min/max) or defaults beyond what the schema already states. It adds marginal value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool aggregates log messages by field values with statistics like counts, sums, and averages. It identifies the action (aggregate) and resource (log messages/field values), but does not explicitly differentiate from sibling tools like get_field_time_aggregation or list_field_values, so it misses the sibling differentiation point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives, such as get_field_time_aggregation for time-based aggregation or list_field_values for simple value listing. The description implies a use case but provides no explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_field_time_aggregationC
Two-dimensional aggregation: field values over time. Shows how field values change over time intervals.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| field | Yes | Field to aggregate on (e.g., 'source', 'env', 'level') | |
| limit | No | Maximum number of field values to return. Default: 10 | |
| query | No | Query to filter messages | |
| filters | No | Field filters (e.g. {"env": "production"}) | |
| interval | No | Time interval for buckets (e.g., '1m', '5m', '1h', 'auto'). Default: 'auto' | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It only states that field values change over time intervals, but does not disclose output format, default limits, time range handling, or behavior with empty results. This is insufficient for a tool with 10 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the core concept. No redundant information or unnecessary elaborationāevery word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (10 parameters, nested objects, no output schema, no annotations), the description is too brief. It doesn't explain the response structure, how time ranges interact with intervals, or provide fallback guidance, leaving significant gaps for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are fully documented. The description adds context about the two-dimensional nature but does not provide additional parameter-specific details beyond what the schema already contains, keeping this at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function as aggregating field values over time intervals, using 'two-dimensional' to convey the dual dimension. It distinguishes itself from one-dimensional aggregation tools like get_field_aggregation, though it doesn't name them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as get_field_aggregation or get_log_histogram. The usage context is only implied by the description's wording, with no explicit exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_log_histogramC
Get a time-based histogram of log messages. Shows message counts over time intervals.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| query | No | Query to filter messages | |
| filters | No | Field filters (e.g. {"env": "production", "level": 3}) | |
| metrics | No | Metrics to calculate per time bucket. Default: ['count']. Use with valueField for numeric aggregations. | |
| interval | No | Time interval for buckets (e.g., '1m', '5m', '1h', 'auto'). Default: 'auto' | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. | |
| valueField | No | Numeric field for sum/avg/min/max calculations (e.g., 'latencies_request'). Required when metrics include non-count metrics. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. It only states that it shows message counts over time, without disclosing details like whether it returns only counts or can calculate sum/avg/min/max (which the schema hints at), how intervals are determined, or any limitations. The behavioral transparency is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using only two short sentences that focus on the core purpose. It is front-loaded and has no filler. However, it is perhaps too terse for a tool with 10 parameters, though the schema handles parameter details, so the brevity is acceptable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, and the description is minimal. It lacks context about the returned histogram structure, query semantics, or when to use it among many similar sibling tools. For a complex tool with 10 optional params, the description is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no parameter-specific meaning beyond the schema's own property descriptions. It does not clarify relationships between parameters (e.g., when valueField is required) beyond what is already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets a time-based histogram of log messages and shows counts over intervals. The verb 'get' and resource 'time-based histogram' are specific. It does not explicitly differentiate from similar sibling tools like get_field_time_aggregation, but the name and description convey the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as get_field_aggregation or debug_histogram_query. There are no explicit when-to-use instructions or exclusions, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_saved_searchB
Load and execute a saved search by name. Optional overrides can be provided to adjust the search at execution time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Override the saved end time | |
| from | No | Override the saved start time | |
| name | Yes | The name of the saved search to execute | |
| page | No | Page number (starts at 1). Default: 1 | |
| pageSize | No | Override the saved page size | |
| timeRange | No | Override the saved time range (e.g., '1h', '2d') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that overrides can adjust the search at execution time, but does not explain whether the operation is read-only, what the return format is, whether it has side effects, or any permission/rate-limit considerations. This is a significant gap for a tool that executes a search.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the primary action ('Load and execute a saved search') and then mentions overrides. There is no wasted wording, and it is appropriately sized for a straightforward tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should at least indicate what the tool returns (e.g., matching results) and any execution nuances. It only says 'load and execute' and mentions overrides, leaving the agent to infer the output format, pagination behavior, and failure modes. This is incomplete for a tool with six parameters and no structured output definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all six parameters with 100% coverage, so the baseline is 3. The description adds that parameters are optional overrides that adjust the search at execution time, but it does not provide syntax or format details beyond what the schema already includes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool loads and executes a saved search by name, which is a specific verb-resource pair. It is distinguished from sibling tools like list_saved_searches, save_search, and delete_saved_search, which handle listing, saving, and deleting respectively.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is used when you have a saved search name and want to run it, but it does not explicitly mention when not to use it or suggest alternatives like search_events for ad-hoc queries. The guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_surrounding_messagesA
Get messages surrounding a specific message. Provide messageId (preferred) or messageTimestamp to identify the target message.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of messages to return. Default: 50 | |
| query | No | Additional query filter to narrow context | |
| fields | No | Comma-separated field names to return, or '*' for all fields. Default: returns key fields only (timestamp, gl2_message_id, source, env, level, message, logger_name, thread_name, PODNAME) | |
| filters | No | Field filters (e.g. {"env": "marketplace_loki", "level": 7}) | |
| messageId | No | gl2_message_id of the target message (preferred). The timestamp will be looked up automatically. | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search. | |
| messageTimestamp | No | ISO timestamp of the target message (fallback if messageId is not available) | |
| surroundingSeconds | No | Time window in seconds (± around the timestamp). Default: 5 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the preferred identifier method but does not disclose side effects, return format, or behavior when the target is not found. This is insufficient for a tool that likely performs a read operation; the agent is left guessing about safety and edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose and followed by essential identifier guidance. Every word earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 9 parameters, nested objects, and no output schema or annotations. The description does not explain the semantics of 'surrounding' (how the time window works), the structure of the returned messages, or what happens if the target message is ambiguous. It is not complete enough for an agent to understand the full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all parameters with descriptions (100% coverage), so the baseline is 3. The description adds value by specifying that messageId is 'preferred' and messageTimestamp is a fallback, which is not immediately clear from the schema alone. This improves parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Get messages surrounding a specific message.' This is a specific verb+resource combination that distinguishes it from sibling tools like search_events or fetch_graylog_messages, which focus on broader searches rather than contextual retrieval around a single message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: 'Provide messageId (preferred) or messageTimestamp to identify the target message.' It tells the agent exactly how to invoke the tool. However, it does not explicitly mention when not to use it or name alternatives, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
import_log_templatesB
Import templates into the active connection's library.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | merge keeps existing; replace wipes first. Default 'merge'. | |
| templates | Yes | Map of templateId ā template object |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the import action and target; it does not mention that 'replace' mode is destructive, that existing templates may be wiped, or any side effects. It also does not explicitly state the requirement for an active connection as a prerequisite.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately states the action and target. It contains no wasted words or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the schema being complete, the description is too sparse for a mutation tool without annotations or an output schema. It omits return value information, behavioral side effects, and prerequisites, leaving the agent with insufficient context to invoke the tool safely and effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters are fully described in the input schema (coverage 100%), with mode explaining merge vs replace and templates describing the map. The description adds no additional parameter semantics beyond what the schema already provides, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'import' with resource 'templates' and a clear destination 'active connection's library.' This distinguishes it from sibling tools like export_log_templates, list_log_templates, and delete_log_template by action and target.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites (e.g., establishing an active connection). It is a bare statement of action without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_connectionsA
List all available Graylog connections configured in ~/.graylog-mcp/config.json
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context by specifying the source (config.json), which implies the tool reads from a local configuration file. However, it does not disclose potential behaviors like handling of missing files, sensitive data exposure, or whether it validates connections. For a simple read-only list, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that states exactly what the tool does and where it reads from. There is no redundancy or filler, every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (zero parameters, simple listing operation) and lack of output schema, the description is sufficient. It identifies the source and the purpose. It does not spell out the return format, but for a list operation named 'list_connections', the expected result is implicitly the list of connections. Slight improvement could clarify whether connection names or full configurations are returned, but overall it is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100% (empty schema), so there are no parameter semantics to clarify. The description adds no parameter information, but none is needed. The baseline for 0 params is 4, and no deduction is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('List all available Graylog connections') on a specific resource (connections configured in ~/.graylog-mcp/config.json). It distinguishes from sibling tools like use_connection by focusing on listing rather than activating, and from other list tools like list_streams or list_saved_searches by targeting connection objects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when you want to see all configured Graylog connections. It implies a read-only listing operation. However, it does not explicitly mention exclusions or alternatives, such as noting that use_connection is the tool to select/activate a connection, though the distinction is reasonably inferable from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_field_valuesA
List distinct values of a field with message counts. Useful for discovering available sources, environments, logger names, etc. Results are sorted by count descending.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| field | Yes | The field to get distinct values for (e.g. 'source', 'env', 'logger_name', 'level') | |
| limit | No | Maximum number of distinct values to return. Default: 20 | |
| query | No | Query to scope the results (e.g. search within specific messages) | |
| filters | No | Field filters to narrow scope (e.g. {"env": "marketplace_loki"}) | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. Set to false for fuzzy/wildcard search. | |
| timeRangeInSeconds | No | [DEPRECATED] Use timeRange instead. Time range in seconds. Default: 3600 (1 hour) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses sorting by count descending and that results include message counts, but doesn't go deeper into time-range behavior, query scoping, or default limits beyond what the schema explains. This is minimal but non-tautological.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action, and no redundant wording. Every sentence contributes: the first states what it does, the second explains when to use it and the result ordering.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given rich schema descriptions for all 10 parameters and no output schema, the description adequately covers the tool's core purpose and use case. It doesn't reiterate optional scoping features (timeRange, query, filters), but these are well-documented in the schema, and the description provides the necessary context for an agent to decide to invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no parameter-specific meaning beyond the schema, which already documents fields like 'field', 'limit', and time range. It reinforces the purpose but does not compensate for any gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('distinct values of a field with message counts'), which clearly distinguishes it from siblings like list_streams or search_events. It also names concrete example fields, reinforcing the tool's scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Useful for discovering available sources, environments, logger names, etc.' gives explicit context for when to use this tool. It lacks mention of alternatives or exclusions, but the stated use cases effectively guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_log_templatesB
List learned log templates for the active connection.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max templates to return. Default 50. | |
| sortBy | No | Sort key. Default 'count'. | |
| filterLabel | No | Only return templates with this label. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral properties. It merely says 'List learned log templates', which is a read operation, but doesn't disclose whether results are paginated, sorted by default, or if any side effects occur. The 'learned' qualifier hints at origins but doesn't clarify behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, but it's perhaps too brief. It could include a bit more guidance without losing conciseness. Overall, it is efficiently phrased.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with comprehensive schema descriptions, the description is minimally viable. It provides the key scope (active connection) but lacks differentiation from sibling tools and doesn't describe return behavior, though the output schema absence is mitigated by the simplicity of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are fully described in the input schema with 100% coverage. The description adds no additional parameter semantics beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list) and resource (learned log templates), and scopes it to the active connection. This distinguishes it from sibling tools like delete_log_template, rename_log_template, and list_connections.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like export_log_templates, nor does it mention prerequisites such as establishing a connection with use_connection. The phrase 'active connection' implies context but doesn't explain how to set it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_saved_searchesB
List all saved searches.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral disclosure burden. It only states the action ('list all') and does not disclose any additional behavioral traits such as response format, pagination, sorting, performance implications, or authorization requirements. This is a significant gap for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is appropriately sized for a tool with no parameters and no complex behavior. It is front-loaded with the essential action and resource, containing zero filler words. However, some might argue it is slightly underspecified, but for this simple tool it remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain what the return value looks like (e.g., list of IDs, full objects, metadata). It simply says 'list all saved searches' without providing any context on what fields or structure the returned list will contain, making it incomplete for an agent that needs to process the results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the schema to document or for the description to supplement. The baseline of 4 applies because the description is not required to explain parameter meanings when none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description has a specific verb and resource ('List all saved searches') clearly indicating a read operation that returns a collection of saved searches. It distinguishes from siblings like get_saved_search (single) and delete_saved_search (mutation) by explicitly stating 'all'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'List all saved searches' implies the tool is used to retrieve the full set of saved searches, and the sibling names clarify alternatives (e.g., get_saved_search for a specific one). However, it does not explicitly state when to use this tool versus alternatives or mention any exclusions, leaving the guidance implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_streamsA
List all available Graylog streams in the active connection.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. The verb 'List' implies a read-only operation, but the description does not explicitly state safety, side effects, or output format. It adds only the 'active connection' scope, which is useful but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the action, subject, and scope efficiently, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with no parameters and no output schema, the description covers the essential aspects: what is listed and the scope. It does not need to explain return values because 'list' implies a list of streams, and no additional complexity is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema covers everything. Per the baseline for 0-parameter tools, the description does not need to add parameter details; the score reflects that there is nothing to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('Graylog streams') with an explicit scope ('in the active connection'). It distinguishes itself from sibling tools like list_connections or get_event_notifications by naming the resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'in the active connection' provides clear context that the tool operates on a currently selected connection, implying a prerequisite (calling use_connection first). It does not state exclusions or alternatives, but no direct sibling tool lists streams, so the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rename_log_templateB
Set or update a human-readable label for a template.
| Name | Required | Description | Default |
|---|---|---|---|
| label | Yes | Human-readable label (e.g. 'AuthFailure') | |
| templateId | Yes | Template ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only indicates mutation ('Set or update') without revealing side effects, idempotency, error behavior, or permission requirements, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core action without redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple two-parameter tool with full schema coverage and no output schema, so the description is adequate for the basic operation. However, it lacks behavioral context (e.g., what happens if the template doesn't exist) and does not mention return values, which would make it more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides descriptions for both parameters (templateId and label), covering 100% of them. The tool description adds no additional meaning beyond what the schema provides, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set or update') and the resource ('a human-readable label for a template'), distinguishing it from sibling tools like delete_log_template or list_log_templates. However, it doesn't explicitly mention 'log template' or 'rename', which would align more directly with the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives, nor are there any prerequisites or exclusions. The description simply states what it does without contextualizing when it's appropriate to call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_searchB
Save a named search query for later reuse. Saves query parameters so you don't have to re-type complex searches.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| name | Yes | A unique name for this saved search | |
| query | No | The query to save | |
| fields | No | Comma-separated field names to return, or '*' for all fields | |
| filters | No | Field filters (e.g. {"env": "production", "level": 3}) | |
| pageSize | No | Number of messages per page | |
| streamIds | No | Optional stream IDs to scope the search | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') | |
| exactMatch | No | If true, wraps the query in quotes for exact match |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It fails to mention whether saving overwrites existing searches, if it requires special permissions, or what happens on duplicate names. The benefit statement is motivational, not behavioral.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: the first states the purpose, the second explains the benefit. Every word earns its place with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete for a 10-parameter tool with no output schema and no annotations. It doesn't describe what the tool returns after saving, nor does it cover edge cases like duplicate names or overwrite behavior. The schema covers parameters well, but the overall context is lacking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds no extra parameter-level details. The baseline of 3 is appropriate since the schema already provides comprehensive descriptions for all 10 parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Save a named search query for later reuse.' This is a specific verb+resource combination and differentiates from sibling tools like get_saved_search, delete_saved_search, and list_saved_searches by focusing on the act of saving.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context ('for later reuse', 'so you don't have to re-type complex searches') but does not explicitly state when to use this over alternatives, nor does it provide exclusions or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_eventsA
Search Graylog events and alerts. Use 'use_connection' first to select a connection.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| page | No | Page number (starts at 1). Default: 1 | |
| query | No | Search query for events | |
| alerts | No | Filter by alert status. 'only' = only alerts, 'include' = alerts + events, 'exclude' = only non-alert events. Default: include | |
| sortBy | No | Field to sort by. Default: timestamp | |
| perPage | No | Number of results per page. Default: 25 | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| sortDirection | No | Sort direction. Default: desc | |
| eventDefinitionIds | No | Filter by specific event definition IDs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the purpose and connection prerequisite, but doesn't disclose pagination behavior, return format, default ranges, or any side effects. This is a significant gap for a read-style search tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the primary purpose, followed by a key usage prerequisite. It is two sentences with zero wasted words, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 10 parameters and no output schema, but the schema itself is rich with descriptions. The description covers the essential purpose and connection prerequisite, but lacks behavioral context like return format or pagination. It is adequate but not fully complete for a complex search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 10 parameters including defaults and enums. The description adds no additional parameter meaning beyond the schema, which aligns with the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches Graylog events and alerts, which is a specific verb+resource combination. It distinguishes from sibling tools like list_streams or get_event_definitions by focusing on searching, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs to call 'use_connection' first, providing a clear prerequisite for using this tool. This is useful context for sequencing, though it doesn't explicitly compare with alternatives like fetch_graylog_messages.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
use_connectionA
Connect to a specific Graylog instance by name. Must be called before fetching messages.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The connection name as defined in ~/.graylog-mcp/config.json |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool is a prerequisite for fetching messages, implying statefulness, but doesn't detail side effects, error behavior, or idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences, with every word contributing essential information. It is front-loaded with the core action and follows with a critical usage note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (single parameter, high schema coverage), the description adequately covers purpose and prerequisite usage. It lacks detail on return values or error handling, but the low complexity keeps this from being a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the 'name' parameter with a clear description referencing config.json. The tool description adds no additional parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Connect') and resource ('specific Graylog instance by name'), distinguishing it from sibling tools like list_connections and fetch_graylog_messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context by stating 'Must be called before fetching messages,' establishing a clear prerequisite. It doesn't mention alternatives or exclusions, but the guidance is sufficient for typical use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
23 tool updates
v2.3.0- First observed
cluster_log_messages - First observed
debug_histogram_query - First observed
delete_log_template - First observed
delete_saved_search - First observed
export_log_templates - First observed
fetch_graylog_messages - First observed
get_event_definitions - First observed
get_event_notifications - First observed
get_field_aggregation - First observed
get_field_time_aggregation - First observed
get_log_histogram - First observed
get_saved_search - First observed
get_surrounding_messages - First observed
import_log_templates - First observed
list_connections - First observed
list_field_values - First observed
list_log_templates - First observed
list_saved_searches - First observed
list_streams - First observed
rename_log_template - First observed
save_search - First observed
search_events - First observed
use_connection
TDQS
Each tool targets a distinct resource or action, such as connections, streams, saved searches, event definitions, or log templates. Overlapping analysis tools like get_log_histogram and get_field_time_aggregation are clearly differentiated by their descriptions.
All tool names follow a consistent verb_noun pattern in snake_case, with verbs like list, get, fetch, save, delete, and rename. This makes the set predictable and easy to navigate.
23 tools is a substantial set, but it covers a broad range of Graylog functionality including connections, searches, events, analysis, and template management. The count is slightly heavy but each tool contributes to a cohesive workflow.
The tool surface provides strong coverage for log searching, analysis, saved searches, and log template CRUD operations. While event and stream management are read-only (no create/update/delete), the core log analysis lifecycle is well represented.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for AI dialogue using various LLM models via AceDataCloud
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
An MCP server that gives your AI access to the source code and docs of all public github repos
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceAn MCP server that connects Claude (or any MCP compatible client) to your existing log infrastructure. Query, summarize, and trace logs in plain English across GCP Cloud Logging, AWS CloudWatch, Azure Log Analytics, Grafana Loki, and Elasticsearch without writing filter expressions or leaving your editor.173MIT
- AlicenseAqualityDmaintenanceMCP server for log file analysis. Gives LLMs the ability to efficiently analyze large log files without loading them into context.799MIT
- FlicenseNot gradedqualityFmaintenanceAn MCP server that enables AI assistants to query and analyze logs from Grafana Loki using LogQL, supporting label discovery and keyword search.4-
- AlicenseNot gradedqualityDmaintenanceA read-only MCP server that gives AI assistants natural language access to Elasticsearch/Kibana logs for querying and analysis.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/jagadeesh52423/graylog-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server