LogDeck MCP
Logs, alerts and container management for Docker and Podman: an MCP server and CLI, with agent rights set by token scope
- 140 ★ on the repository
- Last commit
Broad access
Why this level
- An admin token allows removing containers, running commands and editing environment variables.
- The LogDeck container mounts the Docker socket, and without authentication enabled the interface is open to anyone who can reach it.
Install
- Works in
Manual install
docker run -d --name logdeck -p 8123:8080 -v /var/run/docker.sock:/var/run/docker.sock -v /proc:/host/proc:ro -v logdeck-data:/data --restart unless-stopped amoabakelvin/logdeck:latestStarts the LogDeck server on port 8123. The `logdeck-data` volume holds config, logs and alert history.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- An admin token allows removing containers, running commands and editing environment variables.
- The LogDeck container mounts the Docker socket, and without authentication enabled the interface is open to anyone who can reach it.
This is third-party code. Review the repository files before installing.
What it does
LogDeck is a self-hosted service for logs, alerts and container management on Docker and Podman, packed into one Go binary. The `logdeck mcp` command starts an MCP server over stdio: the agent reads containers, logs, events and CPU and memory load, and with granted rights it restarts a container or runs a command. Logs are stored on disk, so history survives rebuilds and container removal. The `history_search`, `history_status` and `history_containers` tools read that store, while `search_logs` runs a regular expression across several running containers at once.
Who it is for. Administrators and developers who run services in containers and want an agent to read logs without logging in to the host over SSH.
Good fit when
- A containerized service crashed and the agent searches the logs for `connection refused`.
- A container was removed during a Compose rebuild and its log history has to be read.
- Several Docker hosts are combined in one interface and the agent is asked about all of them at once.
- The agent is allowed only to look: a read token is issued and the server itself rejects actions.
Not a fit when
- LogDeck is not deployed: the MCP server needs a running LogDeck server and a token.
- The LogDeck server is reachable from the network with authentication turned off.
- The agent needs an interactive terminal: `run_command` runs one non-interactive command.
Example request
Search the logs of all running containers for `connection refused` over the last hour and show which service failed first.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
LOGDECK_URLrequired- Address of the LogDeck server.
LOGDECK_TOKENrequired, secret- API token with the `ldk_` prefix: read or admin.
Limitations
LogDeck starts without a login: turn authentication on in Settings before exposing it beyond your machine. The container mounts the Docker socket, which gives wide access to the host. The token fully defines MCP rights: an admin token opens container removal, commands, environment edits and settings changes, including turning authentication off. Client confirmations are a convenience; the token scope is the barrier.
How to disable. Remove the logdeck entry from the MCP client configuration and revoke the token in LogDeck Settings under API Access. The service itself stops with `docker rm -f logdeck`.
FAQ
How does a read token differ from admin?
Read can read logs, stats, events and container details, and every action returns a permission error. Admin can do whatever an administrator can in the web UI and CLI.
How do I read logs of removed containers?
`history_search` reads the persisted store, including containers that no longer exist. Pass a container, a Compose project or nothing to search all; results are cursor-paginated.
Where does LogDeck send alerts?
To Slack, Discord, ntfy, Gotify, Telegram or any webhook. Rules fire on container death, OOM kills and log patterns.
Is Docker needed on the agent machine?
No. The agent needs the `logdeck` CLI installed and network access to the LogDeck server; the server reads the containers itself.
How do I turn on authentication?
In LogDeck Settings. The service starts without a login, so enable it before exposing the service beyond your machine. API tokens are created in Settings under API Access.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server for managing Docker in natural language: containers, images, networks and volumes, including remote hosts over SSH
The docker mcp CLI plugin and gateway: MCP servers from Docker's catalog in isolated containers behind one connection point
Docker MCP by QuantGeekDev
docker-mcp
Docker MCP: an agent creates containers, deploys Docker Compose stacks from YAML, reads logs and lists containers. Runs through uvx for Claude Desktop
Hookdeck CLI forwards webhooks to a local server, manages Event Gateway and runs an MCP server through which an agent investigates delivery failures
A secure MCP runtime through which an agent operates local machines, servers and containers
An agent searches AWS CloudWatch logs, summarizes activity and correlates events across services.
README in short
The service starts with a single `docker run` command that mounts the Docker socket and a data volume. The separate `logdeck` CLI installs from a script and includes `logdeck grep` for searching the logs of all running containers.