Log Insight MCP Server

A Model Context Protocol (MCP) server that connects AI assistants like Claude to VMware Log Insight, enabling natural-language log querying and analysis.

Overview

This server acts as a bridge between MCP-compatible clients (such as Claude Code or Claude Desktop) and a VMware Log Insight instance. It exposes two tools that allow an AI assistant to query and analyze logs on your behalf:

• query_logs — Query logs between a start and end time, with an optional keyword filter.
• search_logs_for_errors — Search for error patterns (e.g. error, critical, exception, fatal, fail) within a time range.

The server manages authentication with Log Insight automatically, including session renewal and retry on expiry.

Architecture

MCP Client (Claude)  ──HTTP POST──▶  MCP Server (:3000)  ──HTTPS──▶  Log Insight API (:9543)
                                       │
                                       ├─ /mcp      (MCP protocol endpoint)
                                       └─ /health   (health check)

Key components:

| File | Role | |------|------| | src/index.ts | HTTP server, MCP session management | | src/loginsight-client.ts | Log Insight REST API client with auth handling | | src/tools/query-logs.ts | MCP tool definitions and handlers |

Prerequisites

• Node.js v18 or later
• npm
• A running VMware Log Insight instance accessible over the network

Local Setup

1. Clone the repository

git clone <repo-url>
cd log-insight-mcp-server

2. Install dependencies

npm install

3. Configure environment variables

Create a .env file in the project root (or copy and edit the existing one):

LOGINSIGHT_URL=https://your-loginsight-host
LOGINSIGHT_USERNAME=admin
LOGINSIGHT_PASSWORD=your-password

| Variable | Required | Description | |----------|----------|-------------| | LOGINSIGHT_URL | Yes | Base URL of your Log Insight instance (e.g. https://10.10.10.119) | | LOGINSIGHT_USERNAME | Yes | Log Insight user with API access | | LOGINSIGHT_PASSWORD | Yes | Password for the above user | | PORT | No | Server port (defaults to 3000) |

The server will exit with an error if any required variable is missing.

4. Build

npm run build

This compiles TypeScript from src/ into dist/.

5. Run

Production:

npm start

Development (watch mode):

npm run dev

The server starts on http://localhost:3000. Verify it is running:

curl http://localhost:3000/health

Connecting an MCP Client

Claude Code

Add the server to your Claude Code MCP configuration:

{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}

Once connected, you can ask Claude questions like:

• "Show me all logs from the last hour"
• "Search for errors between 2025-01-01T00:00:00Z and 2025-01-01T12:00:00Z"
• "Find any fatal or critical log entries from yesterday"

Available Tools

query_logs

Query logs within a time range.

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | startTime | string (ISO 8601) | Yes | Start of the time range | | endTime | string (ISO 8601) | Yes | End of the time range | | keyword | string | No | Text to search for in log messages | | limit | number (1–20000) | No | Max results to return (default: 200) |

search_logs_for_errors

Search for error-pattern logs within a time range.

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | startTime | string (ISO 8601) | Yes | Start of the time range | | endTime | string (ISO 8601) | Yes | End of the time range | | errorPattern | string | No | Error keyword to match (default: "error") | | limit | number (1–20000) | No | Max results to return (default: 500) |

Cloud Foundry Deployment

Prerequisites

• CF CLI installed and logged in (cf login)
• Your Log Insight instance must be reachable from the CF environment

Push with inline variables

The Node.js buildpack automatically runs npm run build during staging, so no local pre-build is needed. Supply credentials at deploy time so they never appear in committed files:

cf push \
  --var loginsight-url=https://your-loginsight-host \
  --var loginsight-username=admin \
  --var loginsight-password=your-password

Push with a vars file

Alternatively, create a vars.yml file (already gitignored):

loginsight-url: https://your-loginsight-host
loginsight-username: admin
loginsight-password: your-password

Then deploy:

cf push --vars-file vars.yml

Verify

cf app log-insight-mcp
curl https://<your-app-route>/health

Scripts

| Command | Description | |---------|-------------| | npm start | Run the server | | npm run dev | Run in watch mode (auto-restart on changes) | | npm run build | Compile TypeScript to dist/ |

License

ISC