Syslog MCP
A syslog receiver built in Rust that ingests UDP and TCP logs into SQLite with FTS5 full-text indexing, then exposes 40+ MCP actions for homelab observability. The `cortex` tool surfaces search, filter, tail, errors, hosts, timeline, patterns, anomalies, and correlation queries, plus specialized actions for AI transcript abuse detection, Docker Compose diagnostics, and incident triage. Supports both streamable HTTP and stdio transports. Designed for Claude-driven log analysis in homelab environments where you want structured intelligence over raw syslog streams without standing up a full ELK stack. Ships with six infrastructure prompts for incident triage, host health checks, and security review workflows.
- GitHub stars
- 1
- tool
- 1
- auth
- Secret needed
- transport
- STDIO, HTTP
- env vars
- 3
- last updated
- May 21, 2026
Tools
1 toolsPublic tool metadata for what this MCP can expose to an agent.
cortexSingle MCP tool whose required `action` field selects one of the server's actions from a single authoritative registry.
Single MCP tool whose required `action` field selects one of the server's actions from a single authoritative registry.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
SYSLOG_HOST*Hostname or IP of the syslog listener.
SYSLOG_MCP_TOKENsecretBearer token for MCP endpoint authentication.
SYSLOG_PORTSyslog listener port (UDP + TCP). Default: 1514.
Readme
Cortex
Self-hosted homelab log intelligence over MCP, CLI, and REST with SQLite/FTS.
It collects logs and operational evidence, stores them in SQLite with FTS5 search, and exposes one shared intelligence layer through CLI, REST, MCP, and a bundled browser workspace.
Details
- Repository
- github.com/jmagar/syslog-mcp
- Category
- Monitoring & Observability
- Package
ghcr.io/jmagar/syslog-mcp:0.27.2- Transport
- STDIO, HTTP
- Auth
- Required
- Registry
- MCP registry, active
More from jmagar
Related Monitoring & Observability MCP servers
View all
SpeedOf.Mespeedofme/speedofme-mcpOfficial SpeedOf.Me server - Accurate speed tests via over 200 global edge servers with analytics.1stars
Nanostores MCPvalyay/nanostores-mcpDebug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.1stars
Youfiliate Smart Linksandrewmpierce/youfiliate-mcpCreate geo-targeted affiliate smart links, pull analytics, and rewrite YouTube descriptions.0stars
Blocklens Mcp Serverblocklens/blocklens-mcp-serverBitcoin on-chain analytics — 109 metrics: MVRV, SOPR, NUPL, HODL Waves, CDD, cycles & more0stars
Sregymgate Mcpclauxel/sregym-incident-replay-gate-mcpA paid remote MCP for SREGym, built to return verdicts, receipts, usage logs, and audit-ready JSON.0stars