Ndjson Local Log Triage Mcp
Streams through massive NDJSON log files without loading them into memory, which matters when your service crashes and the log is 2GB. Exposes query_log_pattern for field filtering, detect_error_anomalies for Z-score spike detection, and summarize_log_timeline for chronological severity bucketing. Also includes correlate_request for distributed trace reconstruction across multiple files, discover_log_schema for format inference, and group_semantic_patterns using the Drain algorithm for clustering message templates. The start_live_triage tool tails logs with real-time anomaly alerts, and query_external_logs bridges to Datadog, Splunk, and Elasticsearch with OpenTelemetry output mapping. Reach for this when you need to triage production incidents without waiting for your editor to choke on gigabyte files.
- tools
- 8
- transport
- STDIO
- last updated
- May 20, 2026
Tools
8 toolsPublic tool metadata for what this MCP can expose to an agent.
query_log_patternFilter log entries by a field/value match. Returns up to N matching entries, streaming the file without loading it entirely.
Filter log entries by a field/value match. Returns up to N matching entries, streaming the file without loading it entirely.
No parameter schema in public metadata yet.
detect_error_anomaliesZ-score frequency analysis. Buckets errors by time window, computes mean + stddev, flags windows where the error rate is anomalously high.
Z-score frequency analysis. Buckets errors by time window, computes mean + stddev, flags windows where the error rate is anomalously high.
No parameter schema in public metadata yet.
summarize_log_timelineChronological aggregation of errors, warnings, and info counts per time window.
Chronological aggregation of errors, warnings, and info counts per time window.
No parameter schema in public metadata yet.
correlate_requestReconstructs a distributed trace from multiple NDJSON log files. Given a trace_id, collects all correlated events in chronological order across all files and surfaces the services involved and total duration.
Reconstructs a distributed trace from multiple NDJSON log files. Given a trace_id, collects all correlated events in chronological order across all files and surfaces the services involved and total duration.
No parameter schema in public metadata yet.
discover_log_schemaAnalyze a log file to infer its wrapper format (NDJSON, Syslog, Kubernetes container logs) and extract type schemas, identifying polymorphic keys, timestamp patterns, and severity fields.
Analyze a log file to infer its wrapper format (NDJSON, Syslog, Kubernetes container logs) and extract type schemas, identifying polymorphic keys, timestamp patterns, and severity fields.
No parameter schema in public metadata yet.
group_semantic_patternsCluster log messages dynamically using the fixed-depth tree-based Drain parsing algorithm to isolate distinct log templates and analyze their parameter distributions (wildcard variations).
Cluster log messages dynamically using the fixed-depth tree-based Drain parsing algorithm to isolate distinct log templates and analyze their parameter distributions (wildcard variations).
No parameter schema in public metadata yet.
start_live_triageStart background log tailing with real-time Z-score anomaly alerting on error frequency spikes and heap memory protection limits.
Start background log tailing with real-time Z-score anomaly alerting on error frequency spikes and heap memory protection limits.
No parameter schema in public metadata yet.
query_external_logsA unified gateway to query central log providers (Datadog, Splunk, Elasticsearch), converting search patterns to vendor-specific dialects and mapping the output into the standardized OpenTelemetry Log Data Model structure.
A unified gateway to query central log providers (Datadog, Splunk, Elasticsearch), converting search patterns to vendor-specific dialects and mapping the output into the standardized OpenTelemetry Log Data Model structure.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
🪵 ndjson-local-log-triage-mcp
Your service just crashed. The log file is 2GB. Your AI agent can't help.
MCP server that stream-parses NDJSON log files without loading them into memory — filter by pattern, detect error spikes via Z-score analysis, summarize severity timelines by time window.
🤔 The problem
A service crashes at 3am. The log file is app.log.ndjson and it's 2GB. You ask your agent to find what caused the spike in errors around 03:17. The agent can't read 2GB. It can't even try.
ndjson-local-log-triage-mcp streams the file line by line — never loading it into memory — and gives the agent exactly the slice it needs.
🛠️ Tools
query_log_pattern
Details
- Repository
- github.com/vola-trebla/ndjson-local-log-triage-mcp
- Category
- Monitoring & Observability
- Package
ndjson-local-log-triage-mcp- Transport
- STDIO
- Registry
- MCP registry, active
More from vola-trebla
- Playwright Network Chaos Mcp
- Playwright Spatial Layout Mcp
- Sourcemap Retrace Mcp
- Tailwind Context Resolver Mcp
- Tsconfig Inheritance Flattener Mcp
- V8 Cpu Profile Decoder Mcp
- Release Readiness Triage Mcp
- React Render Profile Mcp2
- Playwright Trace Decoder Mcp1
- Ast Impact Mapper Mcp
- Env Secret Exposure Analyzer Mcp
- Flakiness Knowledge Graph Mcp
Related Monitoring & Observability MCP servers
View all
MCP Server for Uptime Kumadavidfuchs/mcp-uptime-kumaManage your Uptime Kuma 2 instance from an LLM: monitors, status pages, notifications, maintenance70stars
Mcp Server Health Monitordbsectrainer/mcp-server-health-monitorHealth monitoring for all your MCP servers0stars
Llm Output Quality Monitorlazymac2x/llm-output-quality-monitor-apiCloudflare Workers MCP server: llm-output-quality-monitor0stars
Agentic Observability MCPmdfifty50-boop/agent-observability-mcpAgent tracing, cost tracking, anomaly detection for LLM agents0stars
Google Analytics 4stucchi/mcp-google-analyticsManage GA4 properties, data streams, conversions, and run reports via Admin & Data APIs.0stars
Mcp Prometheusjeanlopezxyz/mcp-prometheusA Model Context Protocol (MCP) server for Prometheus monitoring0stars