Ask your logs anything. Query, search, and analyze logs across Logtail, Grafana Loki, Datadog, AWS CloudWatch, New Relic, and Elasticsearch — directly from Claude, Cursor, or any MCP-compatible AI agent.

Quick Start · Tools · Pro Features · Providers

graph LR
    A["AI Agent"] -->|MCP Protocol| B["LogLens MCP"]
    B --> C["Logtail / Better Stack"]
    B --> D["Grafana Loki"]
    B --> E["Datadog"]
    B --> F["AWS CloudWatch"]
    B --> G["New Relic"]
    B --> H["Elasticsearch"]
    style B fill:#0d1117,stroke:#22c55e,stroke-width:2px,color:#22c55e
    style A fill:#1f2937,stroke:#22c55e,color:#f0f6fc

Quick Start

npx loglens-mcp

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "loglens": {
      "command": "npx",
      "args": ["-y", "loglens-mcp"],
      "env": {
        "LOGTAIL_TOKEN": "your-source-token"
      }
    }
  }
}

Cursor / Windsurf

Same JSON format in your MCP settings.

Tools

Free (7 tools)

| Tool | Description | |:-----|:------------| | query_logs | Search logs by service, level, time range, and free-text pattern. Paginated results with metadata | | error_summary | Group and rank unique errors — deduplicated by pattern, with count, affected services, and sample trace | | log_stats | Aggregate statistics: count by level, top 10 errors, volume by hour, busiest services | | tail_logs | Most recent N log lines for a service, with optional level filter | | search_patterns | Regex pattern search across logs — find request IDs, user IDs, transaction refs | | log_context | Surrounding context for a specific log entry — N lines before and after, across services | | service_map | All services with log volume, error rate, last activity, and health status |

Pro (6 tools)

| Tool | Description | |:-----|:------------| | anomaly_detection | Statistical anomaly detection — volume spikes, error spikes, new error types, service silence | | trace_correlation | Follow a request across services via trace ID — reconstruct path with timing per hop | | log_diff | Compare log patterns between two time windows — new errors, disappeared warnings, volume changes | | alert_rules | List and validate alert rules from your provider — dry-run against a time range | | retention_report | Storage volume, estimated cost, retention policies, oldest logs per index | | export_report | Structured incident report combining queries, errors, and anomalies — JSON or markdown |

Free vs Pro

| Feature | Free | Pro | |:--------|:----:|:---:| | Log querying & tailing | ✓ | ✓ | | Error grouping & ranking | ✓ | ✓ | | Aggregate statistics | ✓ | ✓ | | Regex pattern search | ✓ | ✓ | | Log context (before/after) | ✓ | ✓ | | Service map | ✓ | ✓ | | Anomaly detection | | ✓ | | Trace correlation | | ✓ | | Log diff (pre/post deploy) | | ✓ | | Alert rule validation | | ✓ | | Retention & cost report | | ✓ | | Incident export | | ✓ |

Get Pro: Set PRO_LICENSE to unlock premium tools. → craftpipe.dev/pricing

Supported Providers

Note: CloudWatch Logs Insights costs $0.005/GB scanned. LogLens includes this warning in responses.

Credentials

# Logtail / Better Stack
export LOGTAIL_TOKEN=...           # Source token from betterstack.com

# Grafana Loki
export LOKI_URL=http://loki:3100   # Or Grafana Cloud URL
export LOKI_TOKEN=...              # Optional for Grafana Cloud

# Datadog
export DD_API_KEY=...
export DD_APP_KEY=...
export DD_SITE=datadoghq.com       # Optional, default: datadoghq.com

# AWS CloudWatch
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_REGION=us-east-1

# New Relic
export NEWRELIC_API_KEY=...
export NEWRELIC_ACCOUNT_ID=...

# Elasticsearch
export ELASTICSEARCH_URL=http://localhost:9200
export ELASTICSEARCH_API_KEY=...       # Or use basic auth:
export ELASTICSEARCH_USER=...
export ELASTICSEARCH_PASSWORD=...
export ELASTICSEARCH_INDEX=logs-*      # Optional, default: logs-*

# Pro license
export PRO_LICENSE=CPK-...         # From craftpipe.dev/pricing

Security

• Read-only — LogLens only queries logs, never writes or deletes
• Credentials — read from environment variables, never stored
• Audit trail — every tool call logged to ~/.loglens/audit.db (SQLite, 90-day retention)

License

MIT — see LICENSE

Built with AI by Craftpipe