Logs MCP Tools

Krafter exposes 5 read-only MCP tools for the Logs service. They run over the same JSON-RPC 2.0 transport, scope filtering, rate limiting, and origin validation as every other MCP module — see the global MCP reference for transport, error codes, and authentication details.

Required scope: every tool below requires logs:read (or the wildcard * scope). Calls from a key without this scope are filtered out of tools/list and rejected by tools/call with JSON-RPC error -32002.

Tool reference

logs_list_projects

List every log project for the authenticated team. Returns one entry per project with retention and daily-limit settings.

Parameters: none.

Returns: array of objects with id, name, description, retention_days, daily_limit_mb, inserted_at.

logs_search

Search log entries within a single project. The result set is capped at the configured limit (default 100, max 1000) and sorted by ClickHouse insertion order.

Parameters:

Name	Type	Required	Description
project_id	string	Yes	UUID of the log project. Must belong to the caller's team.
level	string	No	Filter by log level. Allowed values: debug, info, warn, error. Note: fatal is not accepted by the MCP enum even though it is a valid ingest level — to filter on fatal entries via MCP, omit level and post-filter.
stream	string	No	Filter by stream name (exact match).
query	string	No	Full-text search query against the message field.
from	string	No	Lower bound on timestamp (ISO 8601). Defaults to now - 1 hour when omitted.
to	string	No	Upper bound on timestamp (ISO 8601). Defaults to now when omitted.
limit	integer	No	Max entries to return. Default 100; capped at 1000.

Returns: array of log entry objects.

logs_list_streams

List every stream that has been auto-discovered for a project. Streams are created lazily during ingest from the stream field of incoming log entries.

Parameters:

Name	Type	Required	Description
project_id	string	Yes	UUID of the log project. Must belong to the caller's team.

Returns: array of objects with id, name.

logs_list_alerts

List every alert configured for a project, including thresholds, channels, and last-trigger time.

Parameters:

Name	Type	Required	Description
project_id	string	Yes	UUID of the log project. Must belong to the caller's team.

Returns: array of objects with id, name, level, threshold, window_minutes, enabled, notify_email, notify_webhook, last_triggered_at.

logs_get_usage

Return the calling team's log ingestion usage for today (UTC date).

Parameters: none.

Returns: object with date, entry_count, bytes_in. If the team has no usage record for today yet, returns zeros.

Coverage gaps

The MCP surface for Logs is read-only and project-scoped. The following operations have no MCP equivalent and must go through the REST API:

• Creating, updating, or deleting projects, alerts, or ingest tokens.
• Ingesting log entries (POST /logs/ingest and /logs/ingest/batch).
• Rotating ingest tokens.
• Filtering search results on fatal level (see the logs_search note above).