Logs are the ground truth of every production system — error traces, access records, audit trails, performance data. Log management MCP servers let AI agents search, correlate, and analyze logs across enterprise platforms without developers manually copy-pasting stack traces into chat windows or writing ad hoc queries.

The headline finding: this is one of the strongest MCP categories. Nearly every major log management platform has at least one MCP server — many have official ones. Grafana’s mcp-grafana dominates at 2,907 stars with Loki, Elasticsearch, and CloudWatch log querying built in. Splunk has both an official Splunkbase app and active community servers. Datadog ships a managed remote MCP endpoint. The gap isn’t coverage — it’s fragmentation, with some platforms having 5+ competing community servers.

April 2026 update: Several important developments since our initial review. AWS’s MCP monorepo nearly doubled to 8,864 stars with CloudWatch expanding to 11 tools. Dynatrace hit v1.8.3 with 21 tools and rapid release cadence. Axiom launched an official hosted MCP server at mcp.axiom.co. The first Fluent Bit/Fluentd MCP server appeared via OpAMP integration. Sumo Logic entered limited beta with their official MCP as part of the Dojo AI platform. Meanwhile, the AI-enthusiasts/mcp-graylog server appears to have been removed.

The Landscape

Grafana + Loki

Server Stars Language Tools Transport
grafana/mcp-grafana ~2,907 Go 60+ (5 Loki) stdio
grafana/loki-mcp ~128 Go 1 stdio, SSE

Grafana’s official mcp-grafana is the most comprehensive observability MCP server available. 2,907 stars, 343 forks, 76 open issues/PRs — heavily active development with multiple daily commits. v0.12.0 (April 23, 2026) added InfluxDB datasource support (Flux + InfluxQL), Graphite datasource support, legacy d-solo render mode, security fixes (reject embedded credentials, reject malformed headers), and schema token cost reduction. Covers dashboards, datasources, Prometheus, Loki, InfluxDB, Graphite, ClickHouse, CloudWatch, Elasticsearch, incidents, alerting, OnCall, annotations, and rendering.

The 5 Loki-specific tools:

Tool What it does
query_loki_logs Execute LogQL queries for log and metric retrieval
list_loki_label_names Enumerate available log labels
list_loki_label_values Retrieve values for specific log labels
query_loki_stats Obtain log stream statistics
query_loki_patterns Identify detected log patterns and anomalies

Install: uvx mcp-grafana with GRAFANA_URL and GRAFANA_SERVICE_ACCOUNT_TOKEN environment variables.

The dedicated grafana/loki-mcp (128 stars, MIT, Go) provides a single loki_query tool for querying Loki directly. Supports multi-tenant org IDs, SSE transport, and Docker deployment. Simpler if you only need Loki without the full Grafana stack. However, this repo has been dormant since July 2025 (10 months) — given that mcp-grafana already includes 5 Loki tools with richer functionality, the standalone server may be effectively superseded.

Community alternatives include tumf/grafana-loki-mcp (FastMCP/Python), mo-silent/loki-mcp-server, and lexfrei/mcp-loki — all provide basic LogQL querying.

Elasticsearch / ELK Stack

Server Stars Language Tools Status
elastic/mcp-server-elasticsearch ~648 Rust 5 Deprecated
cr7258/elasticsearch-mcp-server Python Active
awesimon/elasticsearch-mcp Active

Elastic’s official MCP server is deprecated — superseded by the Elastic Agent Builder MCP endpoint available in Elastic 9.2.0+ and Elasticsearch Serverless. The existing server (648 stars, Rust, Apache-2.0, v0.4.6) still works via Docker (docker.elastic.co/mcp/elasticsearch) with stdio and streamable-HTTP protocols. Last commit was October 2025; the repo will only receive critical security updates going forward.

5 tools before deprecation:

Tool What it does
list_indices Display all available Elasticsearch indices
get_mappings Retrieve field mappings for specific indices
search Execute queries using Query DSL
esql Run ES|QL queries
get_shards Access shard information

Several community alternatives fill the gap: cr7258/elasticsearch-mcp-server (Python, OpenSearch compatible), awesimon/elasticsearch-mcp (natural language to Elasticsearch queries), and sonirico/mcp-elasticsearch (Go, multiple auth methods).

The Logstash MCP Server also exists for ELK stack log pipeline management, though details are limited.

Splunk

Server Stars Language Tools Auth
CiscoDevNet/Splunk-MCP-Server-official ~3 7+ Splunk mgmt port
livehybrid/splunk-mcp ~98 Python 14 API token
splunk/splunk-mcp-server2 ~31 Python/TS 7 API token
deslicer/mcp-for-splunk ~22 Python 20+ API token

Splunk has the most fragmented MCP ecosystem — four+ servers, each with a different approach.

The official Splunkbase app (CiscoDevNet, v1.0.1, Feb 2026, beta) runs inside your Splunk instance on the management port (8089). Tools include generate_spl (natural language to SPL), run_splunk_query, get_splunk_info, get_indexes, get_index_info, and get_saved_searches. 5,029+ Splunkbase downloads with a 5-star rating. Supports Splunk 8.0-10.2. Minimal GitHub presence (3 stars) since it’s distributed via Splunkbase.

The community leader is livehybrid/splunk-mcp (98 stars, Python, Apache-2.0). 14 tools across search, index management, KV store operations (including KVStore collections), health checks, and user management. Supports SSE transport and Docker deployment.

splunk/splunk-mcp-server2 (31 stars, MIT) adds SPL risk scoring (0-100 scale), automatic sensitive data masking, and multiple output formats (JSON, CSV, Markdown). 7 tools with a security-first approach. Low activity — single contributor, no releases published.

deslicer/mcp-for-splunk (22 stars, Apache-2.0, 374 commits) is the most actively developed Splunk MCP server. 20+ tools with 16 resources including CIM data models, 174 passing tests, AI-powered troubleshooting workflows, and natural language to SPL conversion.

Datadog

Server Stars Language Tools Transport
datadog-labs/mcp-server ~33 16+ Remote HTTP
winor30/mcp-server-datadog ~142 TypeScript 20 stdio

Datadog offers both an official managed remote MCP server and a popular community server.

The official server (datadog-labs, MIT, Preview, 33 stars — up from 10, +230%) is a managed remote endpoint at mcp.datadoghq.com — no self-hosting needed. Regional endpoint guidance added in April 2026. Core toolset covers logs, metrics, traces, dashboards, monitors, incidents, hosts, services, events, and notebooks. Additional opt-in toolsets for alerting, APM, Database Monitoring, Error Tracking, feature flags, LLM Observability, networking, security, software delivery, and Synthetic tests. Paginates by token budget with cursor-based continuation.

Install for Claude Code: claude mcp add --transport http datadog https://mcp.datadoghq.com/api/unstable/mcp-server/mcp

The community leader winor30/mcp-server-datadog (142 stars, TypeScript, Apache-2.0) provides 20 named tools. Development has slowed in 2026 — last feature release was v1.7.0 (October 2025), with mostly dependency bumps since then:

Tool What it does
get_logs Search and retrieve Datadog logs
query_metrics Query metric data
list_traces Search distributed traces
list_incidents / get_incident Incident management
get_monitors Monitor status and configuration
list_dashboards / get_dashboard Dashboard access
list_hosts / get_active_hosts_count Host inventory
mute_host / unmute_host Host maintenance
list_downtimes / schedule_downtime / cancel_downtime Downtime management
get_rum_applications / get_rum_events / get_rum_grouped_event_count / get_rum_page_performance / get_rum_page_waterfall Real User Monitoring

8 open issues, 14 open PRs, npm/Smithery install.

AWS CloudWatch

Server Stars Language Tools Source
CloudWatch MCP Server (awslabs/mcp) ~8,864 Python 11 Official monorepo
awslabs/Log-Analyzer-with-MCP ~157 Python 5 Official standalone

AWS provides two official CloudWatch log analysis servers.

The CloudWatch MCP Server inside the awslabs/mcp monorepo (8,864 stars — nearly doubled from 4,700 in March) now provides 11 tools across three categories:

  • Metrics (4 tools): get_metric_data, get_metric_metadata, get_recommended_metric_alarms, analyze_metric
  • Alarms (2 tools): get_active_alarms, get_alarm_history
  • Logs (5 tools): describe_log_groups, analyze_log_group, execute_log_insights_query, get_logs_insight_query_results, cancel_logs_insight_query

Multi-profile support added for all tools in 2026. A separate cloudwatch-appsignals-mcp-server also exists in the monorepo. An RFC is in progress to add Performance Insights (Database Insights) tools. PyPI: awslabs.cloudwatch-mcp-server. Note: the older cloudwatch-logs-mcp-server package is deprecated in favor of the unified CloudWatch server.

The standalone Log-Analyzer-with-MCP (157 stars, Python, Apache-2.0) focuses specifically on CloudWatch Logs analysis — log group discovery, CloudWatch Logs Insights query execution, log summaries, error pattern identification, and multi-service log correlation. Now in maintenance-only mode with only dependency bumps in 2026.

Dynatrace

Server Stars Language Tools Transport
dynatrace-oss/dynatrace-mcp ~111 TypeScript 21 stdio, HTTP

Dynatrace’s official open-source MCP server bridges AI assistants to the Dynatrace observability platform. 111 stars (up from 92), MIT license, 18 open issues. Rapid release cadence — v1.8.3 (April 24, 2026), with v1.8.2 (April 21) and v1.8.1 (April 15). Requires Node.js v22.10+.

Install: npx -y @dynatrace-oss/dynatrace-mcp-server (stdio) or --http for server mode.

Key tools (~21):

Tool What it does
execute_dql / verify_dql Run and validate Dynatrace Query Language statements
generate_dql_from_natural_language / explain_dql_in_natural_language Natural language ↔ DQL conversion
list_problems Problem investigation
list_vulnerabilities Security vulnerability data
list_exceptions Exception tracking
get_kubernetes_events Kubernetes event monitoring
find_entity_by_name Entity discovery
chat_with_davis_copilot Davis CoPilot AI interaction
list_davis_analyzers / execute_davis_analyzer Davis AI analysis
list_documents / read_document / create_document Notebooks and dashboards
create_dynatrace_notebook Notebook creation
send_event Transmit event data
send_slack_message / send_email Notification integration
create_workflow_for_notification Configure automation workflows

New Relic

Server Stars Language Tools Status
newrelic/mcp-server ~5 Public Preview

New Relic’s official MCP server launched in November 2025 as a Public Preview. Still no GA announcement as of April 2026. Connects AI agents to New Relic’s observability data for natural language querying of telemetry data, alert investigation, and performance analysis.

Tool categories include entity/account management, alerting/monitoring, incident response, performance analytics (golden metrics, logs, thread analysis), NRQL queries, and deployment impact assessment. Very low GitHub presence (5 stars, 1 contributor, 2 commits on main, no releases published) — the real product lives behind the New Relic platform.

Community alternatives: cloudbring/newrelic-mcp (NerdGraph API integration), ulucaydin/mcp-server-newrelic (unofficial NerdGraph MCP).

Graylog

Server Stars Language Tools Transport
lcaliani/graylog-mcp JavaScript 1 stdio
mothlike/mcp_graylog Python stdio
Pranavj17/mcp-server-graylog stdio

Graylog has built-in MCP support — the platform itself can act as an MCP endpoint with API token authentication. But the standalone community servers provide different integration approaches.

Note: The previously most-complete standalone server, AI-enthusiasts/mcp-graylog (11 tools), appears to have been removed (404 as of April 2026). The remaining community servers are more limited: lcaliani/graylog-mcp (JavaScript, single tool), mothlike/mcp_graylog (Elasticsearch query syntax, statistics), and Pranavj17/mcp-server-graylog (focused on production debugging). Graylog’s built-in MCP support is now the recommended path.

Sumo Logic

Server Stars Language Tools
samwang0723/mcp-sumologic ~10 TypeScript 1
vinit-devops/sumologic_mcp ~4 Python 37
Sumo Logic Official (Dojo AI)

Sumo Logic now has an official MCP server in limited beta, part of the “Dojo AI” platform expansion announced in early 2026. It extends Dojo AI into the agentic ecosystem, connecting customer-owned copilots, proprietary models, and third-party AI systems. Includes SOC Analyst Agent, Knowledge Agent, and Query Agent capabilities. GA planned for 2026 but no confirmed date yet.

For community options, vinit-devops/sumologic_mcp (4 stars, Python, PyPI: sumologic-mcp-python) stands out with 37 tools across six categories (Search & Analytics, Dashboard Management, Metrics & Monitoring, Collector & Source Management, Monitor Management, utilities). samwang0723/mcp-sumologic (10 stars, TypeScript) provides a single search tool but has been stale since February 2025.

OpenTrace (Self-Hosted)

Server Stars Language Tools Storage
adham90/opentrace ~15 Go 13 tools (90+ actions) SQLite

OpenTrace is the only self-hosted, vendor-neutral observability MCP server. 15 stars, MIT, Go 1.25+, 407 commits (up from 308) — substantial and growing codebase despite low adoption.

13 tools with 90+ actions across 8 categories: overview/triage, log intelligence (full-text search, distributed traces, performance analysis, period comparisons), database introspection (Postgres read-only — query stats, table metrics, lock analysis, index optimization), errors (grouping, investigation, user impact), analytics/journeys, uptime/watches, agent memory (persistent notes across sessions), and settings/admin. New features include PII scrubbing, SQL validation for read-only Postgres access, automatic deploy detection via git commit hashing, and per-user auth tokens. Targets 200-500K entries/sec write throughput with ~260KB runtime memory.

Single binary deployment with SQLite storage. Docker: docker run ghcr.io/adham90/opentrace:latest. One-click deploy on DigitalOcean, Railway, and Render. Includes a web UI with live log streaming. Designed for small-to-medium teams that want observability without vendor lock-in.

Axiom

Server Stars Language Tools Transport
axiomhq/mcp ~11 TypeScript multiple Remote HTTP

Axiom now has an official hosted MCP server at mcp.axiom.co, replacing the deprecated axiomhq/mcp-server-axiom (61 stars, archived March 2, 2026). The new server runs on Cloudflare Workers with 151 commits and active development (9 forks, 9 open PRs). Features CSV formatting, auto time-series binning, and smart field prioritization.

The deprecated server had 6 tools (queryApl, listDatasets, getDatasetSchema, getSavedQueries, getMonitors, getMonitorsHistory) in Go. The replacement is fully hosted — no self-hosting needed.

Fluent Bit / Fluentd

Server Stars Language Tools Transport
mp3monster/fluent-opamp ~1 Python MCP+OpAMP stdio

The first MCP server for Fluent Bit and Fluentd — arrived via OpAMP (OpenTelemetry Agent Management Protocol) integration rather than direct log access. Implements the OpAMP specification for managing and monitoring Fluent Bit/Fluentd agents, with an MCP server layer exposing the OpAMP control plane to AI assistants. Release 0.4 (April 11, 2026). Minimal adoption so far but fills a previously complete gap.

Logstash

Server Stars Language Tools Status
mashhurs/logstash-mcp-server ~1 Python 12 Prototype

The first Logstash-specific MCP server — covers connectivity verification, node stats, pipeline performance, hot thread analysis, health assessments, and JVM diagnostics. 12 tools total. However, the author explicitly describes it as “vibe coded, AI generated and not tested properly” — treat as prototype quality only. Last commit June 2025.

Standalone Log Analyzers

Several MCP servers focus on local log file analysis rather than connecting to a platform:

Server Stars Focus
Fato07/log-analyzer-mcp Parse 9+ log formats (Syslog, Apache, Nginx, JSON, Docker, Python, Java/Log4j, K8s)
djm81/log_analyzer_mcp ~8 CLI + MCP server for test log summarization and unit test execution
klara-research/MCP-Analyzer Read and debug MCP protocol logs
Alcyone-Labs/simple-mcp-logger Drop-in replacement logger that suppresses output in MCP mode

Fato07/log-analyzer-mcp handles the widest range of formats for local debugging. klara-research/MCP-Analyzer is a meta-tool — it analyzes MCP logs themselves to debug MCP server integrations.

Papertrail

vovka/papertrail-mcp-server provides basic log search capabilities for Papertrail with rate limiting and Docker support. Community-only, minimal adoption.

What’s Missing

  • Logstash pipeline management is prototype-only — mashhurs/logstash-mcp-server exists but is self-described as untested; no production-quality Logstash CRUD MCP server yet
  • Fluent Bit/Fluentd MCP is indirect — mp3monster/fluent-opamp manages agents via OpAMP but doesn’t provide direct log access tools
  • Sumo Logic official MCP still in limited beta — no GA date confirmed
  • Elasticsearch deprecation — Elastic is pushing toward Agent Builder, leaving a gap for self-hosted Elasticsearch users
  • No cross-platform log correlation — no MCP server queries multiple log backends simultaneously (OpenTrace comes closest but requires log ingestion)
  • No log alerting via MCP — you can query logs but can’t create log-based alerts through most servers
  • Graylog community coverage weakened — AI-enthusiasts/mcp-graylog (the most complete standalone server) was removed; Graylog’s built-in MCP is the main path now
  • No Papertrail/Logtail official servers — Papertrail has a minimal community server (1 tool, dormant); no Logtail standalone MCP exists (use Better Stack official instead)

The Bottom Line

Rating: 4.0 / 5 — Strong official support from major vendors (Grafana, Splunk, Datadog, Dynatrace, AWS, Elastic, New Relic, Axiom). Grafana’s mcp-grafana is the clear ecosystem leader at 2,907 stars with v0.12.0 adding InfluxDB and Graphite support. AWS CloudWatch nearly doubled its monorepo presence (8,864 stars) and expanded to 11 tools. Dynatrace’s rapid release cadence (v1.8.3) shows strong investment. Axiom launching an official hosted MCP fills a previous gap. The category still loses points for fragmentation (Splunk has 4+ competing servers), Elasticsearch’s deprecation creating uncertainty, and log pipeline management tools remaining at prototype quality.

Best for enterprise teams: Grafana mcp-grafana (if you use Grafana) or Datadog’s managed endpoint (if you use Datadog) — both provide the smoothest experience with official backing.

Best for self-hosted/vendor-neutral: OpenTrace offers a unique single-binary approach with 13 tools (90+ actions) and SQLite storage, though it requires log ingestion rather than querying existing platforms.

Best for Splunk shops: livehybrid/splunk-mcp (98 stars, 14 tools) or the official Splunkbase app (5,029+ downloads) depending on your deployment model.


This review covers publicly available information as of March 2026. ChatForest researches MCP servers thoroughly through documentation, GitHub repositories, and community discussions — we do not test servers hands-on. Star counts are approximate and change over time. Always check the linked repositories for the latest status.

Category: Observability & Monitoring

This review was last edited on 2026-04-25 using Claude Opus 4.6 (Anthropic).