cx-cli
The official Coralogix CLI with 19 skills: an agent reads production logs, traces and metrics and triages incidents
- 241 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The CLI manages the Coralogix account: it edits alerts, SLOs and dashboards as well as users, roles and API keys unless `--read-only` is set
- The sign-in token and profiles live on the machine, and query results, including logs with user data, enter the agent's model context
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/cx-cliDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The CLI manages the Coralogix account: it edits alerts, SLOs and dashboards as well as users, roles and API keys unless `--read-only` is set
- The sign-in token and profiles live on the machine, and query results, including logs with user data, enter the agent's model context
This is third-party code. Review the repository files before installing.
What it does
The single `cx` binary gives an agent access to observability in Coralogix. It queries logs, metrics, traces and RUM data in DataPrime and PromQL and shows the result as a table, raw JSON or in the token-saving `toon` format. If a response exceeds 100 KiB, `toon` writes it to a temporary file and returns the path so the agent context does not bloat. Behind it are 33 commands across 11 domains: alerts, cases, notifications, access management, SLOs, dashboards, data pipeline rules and TCO policies. `cx schema` dumps the whole command tree as JSON, so the agent discovers what the CLI can do on its own. `cx docs` searches the official documentation, and the Olly assistant answers observability questions right from the terminal. `cx init` sets up a profile through browser sign-in and installs skills for Claude Code, Cursor, Codex and more than 40 other agents. The bundle holds 19 skills, from telemetry queries (`cx-telemetry-querying`) to alerts, SLOs, dashboards, cost optimization and RUM setup. One run can fan out across several profiles and regions at once.
Who it is for. SRE engineers and on-call teams whose services send telemetry to Coralogix and who want an agent to work through logs and traces during an incident.
Good fit when
- An alert fired at night and the agent must find the first error in the logs and the traces tied to it
- The error rate grew after a release and you need to find what changed in metrics and spans
- A dashboard for a service is built from a description: the agent picks fields, checks PromQL queries and outputs JSON
- The data bill grew and you must sort out usage, TCO policies and retention
- The same query must run across several regions or accounts in a single call
Not a fit when
- Telemetry lives outside Coralogix: the CLI works only with this platform
- A one-off look at logs in the web console is enough, and setting up a profile and CLI sign-in would not pay off
- Query results must not be passed to the agent's model: logs with user data would enter its context
Example request
Find the first 5xx errors in the checkout service logs over the last hour and show the related traces, then compare the rate with the previous hourLimitations
- Work happens against a real Coralogix account: you need your URL or region and sign-in through OAuth or an API key.
- The skills installer runs through `npx`, so Node.js is required.
- Write commands (`iam`, `archive` and others) are available from the first run. You can turn them off with `allow_risky_commands = false` in `~/.cx/config.toml`.
- The README carries a warning: after the compromise of eMudhra intermediate certificate authority keys on October 20, 2026, update the CLI to version 0.1.28 or newer.
How to disable. Remove the binary (`brew uninstall cx` or delete `cx` from `PATH`) and the `~/.cx` directory with profiles. Remove the skills by deleting the `cx-*` and `coralogix-docs` folders from the agent's skills directory. Revoke API keys issued to the CLI in the Coralogix console.
FAQ
How do I install cx and connect an agent?
Install the CLI with `brew install cx` or the script `curl -fsSL https://get.coralogix.dev/cli | sh`, then run `cx init`. It signs in through the browser and installs skills for the agents it finds.
How do I ask an agent a question about logs?
A query looks like `cx logs 'source logs | limit 10'`. The agent builds DataPrime queries itself with the `cx-telemetry-querying` skill, and a field can also be found by a natural-language description.
How do I install only the skills without setting up again?
Run `cx skills install`: the command needs no credentials and serves both first installs and updates. For CI and containers, `cx init` has the flags `--url`, `--api-key` and `--global-skills`.
What does the toon format do?
It is compact JSON for agents. When a response exceeds 100 KiB, the CLI saves it to a temporary file and returns the path.
Can I stop an agent from changing configuration?
Yes. The global `--read-only` option leaves reading only, and in `~/.cx/config.toml` you can set `allow_risky_commands = false` to turn off writes in `iam` and `archive`.
Discussion
No questions or reviews yet.
Related
CLI toolsThe RootCX CLI and skill: an app written by an agent gets a database, SSO, roles, audit and deployment on one server.
Native macOS terminal with an MCP server and CLI: agents see panes, commands and output, and you grant permissions in one window
CircleCI CLI
circleci-cli
The official CircleCI CLI shows runs and failing-test logs, while skills and MCP connect it to Claude Code, Codex and Cursor.
A CLI and Kubernetes operator that runs Claude Code, Codex, Gemini, OpenCode and Cursor as tasks and sessions inside a cluster
Official Dynatrace skills for agents: DQL, traces, logs, Kubernetes, cloud and security work inside Claude Code and Cursor.
A transparent wrapper for Claude Code and Codex: a local gateway records run events and trajectories without changing the agent.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| cx-cli (this card) | yes | 241 | ||
| Grafana MCP Server | yes | API key | 3,644 | Grafana's official MCP server for dashboards, Prometheus and Loki; cx-cli works with the Coralogix platform through a CLI and 19 skills |
| Sentry MCP | no | API key | 957 | Sentry's official MCP server for application errors, events and traces; cx-cli reads Coralogix logs, metrics and RUM and manages alerts |
README in short
The front page gives a definition, a list of capabilities and links to detailed sections: quick setup, advanced configuration, skills, multi-profile fan-out and the toon format. At the bottom come contribution terms and the Apache-2.0 license with a reference to Coralogix terms.