mcp-victorialogs
Official VictoriaLogs MCP server: an agent runs LogsQL queries, browses streams and fields, and searches the embedded docs.
- 110 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Log content, including secrets and personal data inside it, reaches the model context.
- The VictoriaLogs access token sits in the client configuration.
Install
- Works in
Manual install
go install github.com/VictoriaMetrics/mcp-victorialogs/cmd/mcp-victorialogs@latestThe first README option. Binary releases, a Docker image and a Helm chart also exist.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Log content, including secrets and personal data inside it, reaches the model context.
- The VictoriaLogs access token sits in the client configuration.
This is third-party code. Review the repository files before installing.
What it does
The MCP server connects an agent to a running VictoriaLogs, single-node or cluster. The agent runs LogsQL `query` calls, counts hits per interval (`hits`), reads statistics, and lists streams, fields and field values. Almost every read-only API from the web UI is available. Up-to-date VictoriaLogs documentation is embedded, so `documentation` searches it without network access. Modes: `stdio` by default, `sse` and streamable `http`. In HTTP mode the root page shows setup instructions and the tool list, and unneeded tools are switched off with `MCP_DISABLED_TOOLS`.
Who it is for. SREs and developers who keep logs in VictoriaLogs and investigate incidents together with an agent.
Good fit when
- An alert fires at night and the agent searches the service for errors from the last hour.
- A developer does not remember LogsQL syntax and asks the agent to compose a query.
- You need to learn which streams and fields an unfamiliar application writes.
- A team runs a shared MCP over HTTP for several clients.
Not a fit when
- Logs live in another system such as Loki or Elasticsearch.
- The agent has to change VictoriaLogs data or settings.
- Logs hold personal data that must not be shown to a model.
Example request
Find errors in the checkout service logs from the last hour, group them by message and show the three most frequent.MCP
- Transport
- stdio, sse, http
- Authentication
- key is optional
Environment variables
VL_INSTANCE_ENTRYPOINTrequired- VictoriaLogs instance URL
VL_INSTANCE_BEARER_TOKENsecret- VictoriaLogs API access token, if required
Limitations
The server only reads and works with an already deployed VictoriaLogs: `VL_INSTANCE_ENTRYPOINT` sets the address and `VL_INSTANCE_BEARER_TOKEN` the access token. Found log content reaches the model context together with any secrets and personal data inside it. Answer quality depends on the client and model, not only on the server. Building from source needs Go 1.26 or newer. The public playground from the README suits a trial; do not connect production logs to it.
How to disable. Remove the server entry from the client configuration and stop the container or process if you started one. Revoke the VictoriaLogs access token separately.
FAQ
Which tools does the server expose?
It exposes `query`, `hits`, `stats_query`, `stats_query_range`, `field_names`, `field_values`, `streams`, `stream_ids`, `facets`, `flags` and `documentation`. There are no write tools.
Can I try it without installing?
Yes, the README gives a public endpoint, `https://play-vmlogs-mcp.victoriametrics.com/mcp`, wired to a test playground. Add it to an MCP client; it does not open in a browser.
How do I disable extra tools?
List them comma-separated in `MCP_DISABLED_TOOLS`, for example `hits,facets`, and restart the server.
Is a token required?
Only when VictoriaLogs sits behind authentication. `VL_INSTANCE_BEARER_TOKEN` sets the token and `VL_INSTANCE_HEADERS` sets arbitrary headers.
Does the cluster version work?
Yes, the server works with both single-node and cluster VictoriaLogs. `VL_DEFAULT_TENANT_ID` sets the default tenant in the `AccountID:ProjectID` format.
Discussion
No questions or reviews yet.
Related
MCP serversOfficial VictoriaMetrics MCP server: metric queries, rules and alerts, cardinality and built-in documentation for an agent
An agent searches AWS CloudWatch logs, summarizes activity and correlates events across services.
VictoriaMetrics skills: metrics, logs and traces
VictoriaMetrics skills
Fourteen VictoriaMetrics skills: PromQL and LogsQL, traces, cardinality, anomalies and flag lookup in the documentation
Datadog MCP Server (winor30)
Datadog MCP Server
Independent Datadog MCP server: an agent reads incidents, monitors, logs, metrics, traces and RUM and schedules downtimes.
Datadog's official managed MCP server: logs, metrics, traces and incidents right in your agent
The built-in OneUptime MCP: an agent works incidents, reads logs and traces, acknowledges alerts and sets up monitors.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| mcp-victorialogs (this card) | yes | key is optional | 110 | |
| Grafana MCP Server | yes | API key | 3,663 | works with Grafana dashboards and data sources; this server reads VictoriaLogs logs with LogsQL queries |
| VictoriaMetrics skills: metrics, logs and traces | yes | 63 | a skill set about VictoriaMetrics metrics; this one is an MCP server for logs |
README in short
Three modes: `stdio`, `sse` and streamable `http`. HTTP mode adds Prometheus metrics at `/metrics` and health checks at `/health/liveness` and `/health/readiness`.