Log Analyzer with MCP
An agent searches AWS CloudWatch logs, summarizes activity and correlates events across services.
- 171 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The server reads AWS logs under your profile, and logs can contain tokens and personal data.
Install
- Works in
Manual install
{"mcpServers": {"cw-mcp-server": {"command": "uvx", "args": ["--from", "git+https://github.com/awslabs/Log-Analyzer-with-MCP", "cw-mcp-server"]}}}The block goes into `claude_desktop_config.json`. For Amazon Q CLI it goes into `mcp.json`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads AWS logs under your profile, and logs can contain tokens and personal data.
This is third-party code. Review the repository files before installing.
What it does
This Amazon MCP server exposes CloudWatch Logs to an AI assistant. It lists log groups with a prefix filter, searches events with CloudWatch Logs Insights query syntax and limits results by time range. Separate tools build an activity summary, find recurring errors and correlate entries from several AWS services to trace a request. Access goes through your AWS profile and region.
Who it is for. AWS engineers who debug incidents from CloudWatch logs and want to do it in a conversation with Claude or Amazon Q CLI.
Good fit when
- A service went down overnight and you need the first error in a log group.
- You want an activity and error-frequency summary for a period.
- A request crosses several services and events must be linked across groups.
- You want to understand the structure of an unfamiliar log before writing a query.
Not a fit when
- Logs live outside CloudWatch, for example in Loki or Elasticsearch.
- AWS credentials cannot be given to an assistant even read-only.
- You need to write to or change AWS resources.
Example request
List log groups with the `/aws/lambda/orders` prefix, find errors from the last two hours and group them by type.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
AWS_PROFILE- AWS profile from local credentials when the default is not wanted. It can also be passed as the `--profile` argument.
Limitations
It needs Python 3.12 or newer, `uv` and configured AWS credentials. The server reads logs under your profile, so the IAM permissions of that profile define access. CloudWatch Logs Insights queries are billed by scanned data volume. The README gives connection examples for Claude Desktop and Amazon Q CLI; for other clients you adapt the format yourself. The last commit in the repository is from August 2026.
How to disable. Remove the `cw-mcp-server` entry from `claude_desktop_config.json` or from `mcp.json` in the Amazon Q directory and restart the client.
FAQ
How do I connect the server to Claude Desktop?
Add an `mcpServers` block to `claude_desktop_config.json` with the `uvx` command and the arguments `--from`, the repository address and `cw-mcp-server`. Then restart the app.
Where does the server get AWS access?
From your standard AWS credentials. The `--profile` and `--region` arguments select a specific profile and region.
What does the server do beyond search?
Activity summaries, error pattern detection, log structure analysis and event correlation across log groups.
Does it work with Amazon Q CLI?
Yes. Put the same `mcpServers` block into `mcp.json` in the `~/.aws/amazonq` directory.
Which IAM permissions are needed?
Read access to CloudWatch Logs for the needed log groups. The README does not list the exact actions, so start with minimal read-only access.
Discussion
No questions or reviews yet.
Related
MCP serversAWS's official MCP server suite: docs, IaC, containers, serverless, databases, cost and monitoring
Datadog's official managed MCP server: logs, metrics, traces and incidents right in your agent
AWS's official set of MCP servers, skills and plugins so an agent can build, deploy and operate on AWS
Datadog MCP Server (winor30)
Datadog MCP Server
Independent Datadog MCP server: an agent reads incidents, monitors, logs, metrics, traces and RUM and schedules downtimes.
A self-hosted gateway routes internal MCP tools, authenticates users and records requests for later review.
Zabbix MCP Server (mpeirone)
Zabbix MCP Server
The MCP server exposes Zabbix API calls, documentation and method discovery with read-only and method-filter controls.
README in short
The repository holds an MCP server and a sample client. Installation runs through `uvx` from GitHub; details sit in docs on AWS configuration, features and troubleshooting.