Provides tools for fetching messages from Graylog instances, allowing search queries, time ranges, field selection, and multi-instance support.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@graylog-mcp Search for recent errors in production Graylog instance."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A minimal MCP (Model Context Protocol) server in JavaScript that integrates with Graylog.
JavaScript MCP server
Tools: fetch_graylog_messages (query Graylog and return messages)
Multi-instance support — query multiple Graylog servers from a single MCP server
Related MCP server: Graylog MCP Server
Node.js 18+
Configure one or more Graylog instances using numbered env vars:
Variable | Required | Description |
| yes | Graylog base URL for instance N |
| yes | API token for instance N |
| no | Human-readable label (default: |
Replace N with 1, 2, 3, … to register as many instances as needed. Only instances with both BASE_URL and API_TOKEN set will be active.
No installation needed — npx downloads and runs the server automatically.
claude mcp add graylog-mcp npx @lcaliani/graylog-mcp-server@latest \
-e GRAYLOG_BASE_URL_INSTANCE_1=http://your-graylog-production.example.com:9000 \
-e GRAYLOG_API_TOKEN_INSTANCE_1=your_production_token \
-e GRAYLOG_LABEL_INSTANCE_1=production \
-e GRAYLOG_BASE_URL_INSTANCE_2=http://your-graylog-staging.example.com:9000 \
-e GRAYLOG_API_TOKEN_INSTANCE_2=your_staging_token \
-e GRAYLOG_LABEL_INSTANCE_2=stagingOr add it manually to ~/.claude.json:
{
"mcpServers": {
"graylog-mcp": {
"command": "npx",
"args": ["@lcaliani/graylog-mcp-server@latest"],
"env": {
"GRAYLOG_BASE_URL_INSTANCE_1": "http://your-graylog-production.example.com:9000",
"GRAYLOG_API_TOKEN_INSTANCE_1": "your_production_token",
"GRAYLOG_LABEL_INSTANCE_1": "production",
"GRAYLOG_BASE_URL_INSTANCE_2": "http://your-graylog-staging.example.com:9000",
"GRAYLOG_API_TOKEN_INSTANCE_2": "your_staging_token",
"GRAYLOG_LABEL_INSTANCE_2": "staging"
}
}
}
}Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"graylog-mcp": {
"command": "npx",
"args": ["@lcaliani/graylog-mcp-server@latest"],
"env": {
"GRAYLOG_BASE_URL_INSTANCE_1": "http://your-graylog-production.example.com:9000",
"GRAYLOG_API_TOKEN_INSTANCE_1": "your_production_token",
"GRAYLOG_LABEL_INSTANCE_1": "production",
"GRAYLOG_BASE_URL_INSTANCE_2": "http://your-graylog-staging.example.com:9000",
"GRAYLOG_API_TOKEN_INSTANCE_2": "your_staging_token",
"GRAYLOG_LABEL_INSTANCE_2": "staging"
}
}
}
}Config file locations:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Linux: ~/.config/claude-desktop/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Use the same JSON structure shown above for Cursor.
Once configured, the fetch_graylog_messages tool becomes available and will be automatically called when needed. Example prompts:
Search for the latest 20 error logs of the example application in the last 15 minutes.Search for the latest 20 error logs of the example application in the last 15 minutes.
Query the "staging" Graylog instance.Fetch messages from Graylog.
Parameters:
query (string, required): Search query. Example: level:ERROR AND service:api.
instance (string, optional): Label of the Graylog instance to query. Defaults to the first configured instance.
searchTimeRangeInSeconds (number, optional): Relative time range in seconds. Default: 900 (15 minutes).
searchCountLimit (number, optional): Max number of messages. Default: 50.
fields (string, optional): Comma-separated fields to include. Default: * (all fields).
Ensure at least GRAYLOG_BASE_URL_INSTANCE_1 and GRAYLOG_API_TOKEN_INSTANCE_1 are set.
Verify Node.js 18+ is installed.
Set DEBUG=true in the env to enable verbose logging to stderr.
MIT
Fetch messages from a Graylog instance.
Active instances: "instance_1". Default instance: "instance_1".
Use the "instance" parameter to target a specific Graylog server. Each instance is identified by its label (set via GRAYLOG_LABEL_INSTANCE_N env var). If no label is configured, instances are identified as "instance_1", "instance_2", etc.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Which Graylog instance to query. Active: "instance_1". Default: "instance_1". | |
| query | Yes | The search query, using Graylog query syntax (e.g. "level:ERROR AND service:api"). | |
| searchTimeRangeInSeconds | No | Relative time range in seconds. Default: 900 (15 minutes). | |
| searchCountLimit | No | Max number of messages to return. Default: 50. | |
| fields | No | Comma-separated list of fields to return. Default: '*' (all fields). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only states 'fetch messages' without mentioning side effects, permissions, rate limits, error handling, or response format. This is insufficient for a tool with no annotation backup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively short but contains repetition about instances (e.g., 'Active instances: instance_1' and 'Default instance: instance_1'). It could be more terse without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 5 parameters with full schema coverage, but no output schema or sibling tools. The description covers instance selection and parameter defaults, but lacks information on return format, pagination, or how to handle large result sets.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, but the description adds value beyond the schema by explaining instance label configuration, providing a query syntax example, and stating defaults for time range, count limit, and fields. This helps agents use parameters correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'fetch' and the resource 'messages from a Graylog instance'. It specifies the active and default instance, leaving no ambiguity about the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how to target a specific instance using the 'instance' parameter and how instances are identified. It provides clear context for instance selection, though it does not include explicit exclusions or when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.4fetch_graylog_messagesWith only one tool, there is no possibility of confusion between tools. The tool's purpose is clearly stated.
The single tool name 'fetch_graylog_messages' follows a consistent verb_noun pattern, which is clear and predictable.
The server has only one tool for a domain (Graylog) that typically requires multiple operations. One tool feels insufficient for the apparent scope, leading to a score of 2.
The server provides only a single fetch tool, lacking any other operations such as search, create, update, or delete for messages, nor any management of streams or dashboards. This is severely incomplete for a Graylog integration.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Search and analyze global news coverage and US TV transcripts via the GDELT Project APIs.
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Query and audit AppSheet apps in natural language via Knotrik's pre-scanned definitions.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/lcaliani/graylog-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server