MCP Server

Let your coding agent search traces, check and create detections, and read or update incident fixes over MCP.

Neatlogs exposes a Model Context Protocol (MCP) server so your coding agent can read observability data directly: search traces, pull the full context of a failing run, check and create detections, and work on the fixes behind incidents, without copying context out of the dashboard.

Connect

The easiest way is the wizard, which offers to wire the MCP server into Claude Code or Cursor at the end of its run, or on its own:

npx @neatlogs/wizard@latest mcp

It prompts for your project API key (copy it from Settings → Project → API keys). For an EU project, add --region eu.

To connect manually, add a neatlogs entry to your client's MCP config. The server speaks Streamable HTTP and authenticates with your project API key as a bearer token:

{
  "mcpServers": {
    "neatlogs": {
      "type": "http",
      "url": "https://ingest.neatlogs.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_PROJECT_KEY"
      }
    }
  }
}

The config file depends on your client, for example .mcp.json for Claude Code or .cursor/mcp.json for Cursor. The MCP server lives at /mcp on the same host as your SDK endpoint: https://ingest.neatlogs.com/mcp in the US region, https://eu.ingest.neatlogs.com/mcp in the EU region. A dedicated deployment uses its own ingest host's /mcp.

Note

The wizard merges this entry into your existing config without clobbering other MCP servers you've already set up.

What your agent can do

Once connected, the agent can read and act on the project the key belongs to. The default catalog includes these tools; call tools/list in the authenticated session to check availability:

Tool	What it does
`search_traces`	Search traces by free-text query (BM25 keyword by default, or semantic vector search), with filters for workflow, model, framework, detection, duration, tokens, errors, and cost
`get_trace_context`	Pull a trace's metrics, span list with inputs/outputs and code locations, the detections that fired, and its evaluations
`get_trace_evaluations`	Page through a trace's evaluation answers and judge runs
`log_trace`	Push a trace from your coding agent into Neatlogs
`get_project_analytics`	Read dashboard aggregates (KPIs, cost, errors, latency, tools, detections, workflows) for a time window
`list_detections`	List the detections configured on the project
`get_detection_trend`	Get hourly / daily / weekly occurrence counts for a single detection
`get_detection_status` / `get_detection_capabilities`	Read a detection's activation and backfill state, or the supported detection engines
`list_detection_groups` / `create_detection_group` / `preview_detection` / `create_detection`	Dry-run a regex or conditional rule, then create a detection, which starts a 14-day backfill
`triage_list` / `triage_get`	List the project's fixes, or get one fix's root cause, evidence, and recommended action
`triage_get_investigation` / `triage_list_steps`	Read the investigation that produced a fix
`triage_list_versions` / `triage_get_version` / `triage_restore_version`	Browse and restore saved versions of a fix
`triage_accept` / `triage_dismiss` / `triage_update_status` / `triage_update`	Accept, dismiss, move, or edit a fix
`ping` / `whoami`	Health check and identify the project this MCP session is bound to

A fix is the investigation record (root cause, evidence, recommended action) behind an incident on the Incidents page. The triage_* tool names, their triage_id parameters, and the word "fix" in their descriptions are legacy names for this workflow. Write tools ask for the acting team member's email.

This turns a debugging loop into a conversation: ask your agent "what's failing in production?", have it search traces and inspect the worst one, then let it read the matching fix and work on it in the editor. See the MCP Tools Reference for every parameter.

Find and read a run - the same trace data, viewed in the dashboard
Create a detection - the rules list_detections reports on and create_detection adds
Review and hand off a fix - the incident workflow these legacy-named triage_* tools read and update

Connect

What your agent can do

Related

On this page