Log10x MCP Server

Ask your AI assistant about log costs, log patterns, and incidents in plain English, and get structured answers backed by real per-pattern metrics. "Why did our log costs spike this week?", "what's driving payments-svc volume?", "pull the payment_retry events for acme-corp from Jan 15 to Apr 15." The server exposes the 10x platform to Claude and any MCP-compatible assistant as a set of tools.

10x groups your logs by message type. The same lines repeat over and over with only the timestamp or request ID changing, so 10x collapses each flood of near-identical lines into one message type and ranks them by volume and cost. That is how the answers stay exact instead of best-effort clustering, no regex required.

This server is open source under MIT. A Log10x product license (API key) unlocks the account-scoped tools; without one, the server boots read-only against a public demo dataset so the tools can be explored immediately.

What you can ask

Install

Claude Code

claude mcp add --transport stdio --env LOG10X_API_KEY=your-api-key log10x -- npx -y log10x-mcp

Verify with /mcp. Omit the --env flag to run read-only against the public demo dataset.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "log10x": {
      "command": "npx",
      "args": ["-y", "log10x-mcp"],
      "env": {
        "LOG10X_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor, Windsurf, and other MCP clients

Add an mcpServers entry of the same shape: "command": "npx", "args": ["-y", "log10x-mcp"], and LOG10X_API_KEY in env. Omit the key to run read-only demo mode.

Full setup walkthrough: https://doc.log10x.com/apps/mcp/

Credentials

Account-scoped tools need a Log10x API key. Two ways to get one:

• GitHub sign-in: run log10x_signin_start, complete the flow, then log10x_signin_complete. The key is stored for you. log10x_login_status shows who you're connected as.
• Environment variable: set LOG10X_API_KEY directly.

No key? The server boots read-only against the public 10x demo dataset (the same sample data the website console shows), so analysis, discovery, and the install advisors all work out of the box. Mutating tools are disabled in this mode so shared demo state stays untouched. Set LOG10X_DEMO_FALLBACK=off to boot into pure POC mode (savings estimates on your own files, no account). The mode is fixed at startup; restart the server to re-detect.

Environment variables

All optional. The common path is just LOG10X_API_KEY (or no key at all).

Connect your own data (optional)

10x keeps logs queryable without paying to index everything. The Receiver ships budget-overflow noise to your own S3, and the Retriever fetches those exact events back on demand when you need them. log10x_offload_add and log10x_retriever_register wire up the offload-and-fetch path; log10x_backfill_metric pushes per-pattern volume and cost series into your existing Datadog or Prometheus so the cost views light up alongside the rest of your dashboards.

Security

The server runs locally as a subprocess of your AI client. Only pre-aggregated metric queries (per-pattern volume and cost) leave the machine, never raw log content. Local triage with log10x_resolve_batch runs entirely on your machine over stdin and stdout. Connections to your own log platform use read-only credentials. Set LOG10X_MCP_READ_ONLY=true to refuse every mutating tool regardless of mode.

The fenced POC — provably offline

For an evaluation that has to be checkable rather than promised: MCP server and log engine in one container started with --network none, over a log sample you exported yourself with your own credentials.

docker run -i --rm --pull=never --network none --hostname localhost \
  --cap-drop ALL --security-opt no-new-privileges \
  -v "$PWD/poc/logs:/data:ro" -v "$PWD/poc/out:/out" \
  -e TENX_LICENSE_KEY -e TENX_AIRGAPPED=true log10x/poc:local

There is no npx variant of this line, and that is not an oversight. npx resolves and executes a package at run time, and a package's postinstall script is unconfined code running with whatever network the host has — the exact thing the fence exists to rule out. Everything in the image is baked at build time; nothing is installed when the container starts.

The licence is minted by you, with one visible curl, before any log data is in scope — in this profile the server never mints, and a missing licence fails with those instructions rather than with a fetch. The log sample is exported by you: log10x_emit_sample_plan renders a read-only shell script per analyzer that you read once and run outside the container.

Verify it with one docker inspect line, then settle it by turning Wi-Fi off and running the analysis again.

Full walkthrough, including what to check in the export script and the residuals we do not paper over: docs/fenced-poc.md.

Open source and license

MIT. Published on npm as log10x-mcp (Node 20+). The source is public so the behavior behind every tool can be read directly. Account-scoped tools require a Log10x product license (API key); the public demo dataset needs none.

MCP clients run the server as a long-lived child process. After upgrading the package, restart the client so the new version takes effect.

Reporting a run

Optional, and there is nothing to sign up for. If you point this at your own logs, open an issue with the platform it read, what the run showed or where it stopped, and whether you want a reply. Say if you do not, and you will not get one.

Documentation

https://doc.log10x.com/apps/mcp/