Last9 MCP Server
Observability MCP server: production logs, metrics, traces, exceptions, alerts and deployments readable by the agent.
- 63 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Reads production data and can change alert rules and channels unless read-only mode is on.
Install
- Works in
Manual install
claude mcp add --transport http last9 https://app.last9.io/api/v4/organizations/<org_slug>/mcpThe hosted option from the README: OAuth sign-in after `/mcp`. Locally install with `brew install last9/tap/last9-mcp` or `npm install -g @last9/mcp-server@latest`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads production data and can change alert rules and channels unless read-only mode is on.
This is third-party code. Review the repository files before installing.
What it does
Last9 MCP Server connects Claude, Cursor, Windsurf and other MCP clients to Last9 observability data. Instead of guessing the agent reads real signals: logs, metrics and PromQL, traces, exceptions, database queries, alerts, change and deployment events, profiling and Grafana dashboards. The server offers service summaries, window-versus-baseline comparison, service dependencies, change impact on neighbors and alert hygiene. Every answer carries a `deep_link` to the same query in the Last9 dashboard. Connect the hosted version through a URL with OAuth sign-in or run your own over `stdio` with a refresh token. There is a read-only mode and toolset selection.
Who it is for. SREs and on-call developers who investigate an incident in Last9 and want the agent to read signals rather than guess from a description.
Good fit when
- Errors rise after a deploy and you must find which change caused them.
- An agent must find slow operations and service dependencies with numbers.
- An overview of noisy and stale alert rules over 30 days is needed.
- Investigation runs from automation with only the `investigate` toolset.
- A team checks what alerts do not cover: signals without rules and disabled groups.
Not a fit when
- Observability data does not live in Last9.
- The agent must not get rights to change alerts and channels, so enable read-only mode.
- The client supports neither HTTP nor running a local process.
Example request
Show which deployments and changes coincided with the error rise in the payments service over the last two hours, with dashboard links.MCP
- Transport
- http, stdio
- Authentication
- OAuth
Environment variables
LAST9_REFRESH_TOKENrequired, secret- Refresh token from the API Access page, needed for local runs.
LAST9_MCP_READ_ONLY- The value `true` serves only read-only tools.
LAST9_TOOLSETS- Comma-separated toolsets to expose, for example `investigate`.
Limitations
A Last9 account is required. The local variant needs a refresh token, which only administrators can create, and Claude on the web needs organization admin rights. Some tools write: creating and deleting alert rules and notification channels, acknowledging and reassigning alerts. To hide them set `LAST9_MCP_READ_ONLY=true`. Installing through npm requires recent Node.js 22, 24 or 26 because of certificate checks when downloading the binary.
How to disable. Remove the server entry from the MCP client settings, for example with `claude mcp remove last9`. Revoke the refresh token on the Last9 API Access page.
FAQ
How to enable read-only?
Set `LAST9_MCP_READ_ONLY=true` or the `--read-only` flag. Keep chosen write tools through `--allow-write-tools`, for example `acknowledge_alert`.
How to shrink the tool list?
Set `LAST9_TOOLSETS`, for example `investigate` for logs, traces, metrics and profiles. `alerts`, `dashboards`, `grafana` and `all` also exist.
How to install locally?
With `brew install last9/tap/last9-mcp` or `npm install -g @last9/mcp-server@latest`, then set `LAST9_REFRESH_TOKEN` in the client configuration.
What is deep_link?
A field in every answer with a link to the Last9 dashboard for the same query and time window: the agent hands over the link and you see the same thing.
What about large log results?
`get_logs` and `get_traces` chunk requests instead of truncating. The default limit is 5000 entries, adjustable through `LAST9_MAX_GET_LOGS_ENTRIES`.
Discussion
No questions or reviews yet.
Related
MCP serversDatadog's official managed MCP server: logs, metrics, traces and incidents right in your agent
Datadog MCP Server (winor30)
Datadog MCP Server
Independent Datadog MCP server: an agent reads incidents, monitors, logs, metrics, traces and RUM and schedules downtimes.
The built-in OneUptime MCP: an agent works incidents, reads logs and traces, acknowledges alerts and sets up monitors.
The Superlog MCP server: an agent searches incidents, queries logs, traces and metrics and manages alerts and dashboards.
The official Nightingale MCP server: an agent reads alerts and metrics and manages alert rules and dashboards of the monitoring system
Grafana MCP Server
Grafana MCP server
Grafana's official MCP server: dashboards, Prometheus and Loki queries, alerts and incidents straight from the agent
README in short
Hosted and local versions share one toolset. Reference manuals for logs, traces and metrics are served as MCP resources and answers link back to the dashboard.