Log Insight MCP Server

A Model Context Protocol (MCP) server that connects AI assistants like Claude to VMware Log Insight, enabling natural-language log querying and analysis.

Overview

This server acts as a bridge between MCP-compatible clients (such as Claude Code or Claude Desktop) and a VMware Log Insight instance. It exposes two tools that allow an AI assistant to query and analyze logs on your behalf:

• query_logs — Query logs between a start and end time, with an optional keyword filter.
• search_logs_for_errors — Search for error patterns (e.g. error, critical, exception, fatal, fail) within a time range.

The server manages authentication with Log Insight automatically, including session renewal and retry on expiry.

Architecture

MCP Client (Claude)  ──HTTP POST──▶  MCP Server (:3000)  ──HTTPS──▶  Log Insight API (:9543)
                                       │
                                       ├─ /mcp      (MCP protocol endpoint)
                                       └─ /health   (health check)

Key components:

File	Role
src/index.ts	HTTP server, MCP session management
src/loginsight-client.ts	Log Insight REST API client with auth handling
src/tools/query-logs.ts	MCP tool definitions and handlers

Prerequisites

• Node.js v18 or later
• npm
• A running VMware Log Insight instance accessible over the network

Local Setup

1. Clone the repository

git clone <repo-url>
cd log-insight-mcp-server

2. Install dependencies

npm install

3. Configure environment variables

Create a .env file in the project root (or copy and edit the existing one):

LOGINSIGHT_URL=https://your-loginsight-host
LOGINSIGHT_USERNAME=admin
LOGINSIGHT_PASSWORD=your-password

Variable	Required	Description
LOGINSIGHT_URL	Yes	Base URL of your Log Insight instance (e.g. https://10.10.10.119)
LOGINSIGHT_USERNAME	Yes	Log Insight user with API access
LOGINSIGHT_PASSWORD	Yes	Password for the above user
PORT	No	Server port (defaults to 3000)

The server will exit with an error if any required variable is missing.

4. Build

npm run build

This compiles TypeScript from src/ into dist/.

5. Run

Production:

npm start

Development (watch mode):

npm run dev

The server starts on http://localhost:3000. Verify it is running:

curl http://localhost:3000/health

Connecting an MCP Client

Claude Code

Add the server to your Claude Code MCP configuration:

{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "log-insight": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}

Once connected, you can ask Claude questions like:

• "Show me all logs from the last hour"
• "Search for errors between 2025-01-01T00:00:00Z and 2025-01-01T12:00:00Z"
• "Find any fatal or critical log entries from yesterday"

Available Tools

query_logs

Query logs within a time range.

Parameter	Type	Required	Description
startTime	string (ISO 8601)	Yes	Start of the time range
endTime	string (ISO 8601)	Yes	End of the time range
keyword	string	No	Text to search for in log messages
limit	number (1–20000)	No	Max results to return (default: 200)

search_logs_for_errors

Search for error-pattern logs within a time range.

Parameter	Type	Required	Description
startTime	string (ISO 8601)	Yes	Start of the time range
endTime	string (ISO 8601)	Yes	End of the time range
errorPattern	string	No	Error keyword to match (default: "error")
limit	number (1–20000)	No	Max results to return (default: 500)

Cloud Foundry Deployment

Prerequisites

• CF CLI installed and logged in (cf login)
• Your Log Insight instance must be reachable from the CF environment

Push with inline variables

The Node.js buildpack automatically runs npm run build during staging, so no local pre-build is needed. Supply credentials at deploy time so they never appear in committed files:

cf push \
  --var loginsight-url=https://your-loginsight-host \
  --var loginsight-username=admin \
  --var loginsight-password=your-password

Push with a vars file

Alternatively, create a vars.yml file (already gitignored):

loginsight-url: https://your-loginsight-host
loginsight-username: admin
loginsight-password: your-password

Then deploy:

cf push --vars-file vars.yml

Verify

cf app log-insight-mcp
curl https://<your-app-route>/health

Scripts

Command	Description
npm start	Run the server
npm run dev	Run in watch mode (auto-restart on changes)
npm run build	Compile TypeScript to dist/

License

ISC