Connect AI coding tools to LogClaw incidents, logs, and anomaly detections.
io.github.RobelDev/logclaw-mcp-server MCP Server
The io.github.RobelDev/logclaw-mcp-server connects AI coding tools to LogClaw incidents, logs, and anomaly detections. Its README excerpt describes real-time anomaly detection, trace-correlated incident tickets, and AI root cause analysis, with logs kept within an infrastructure boundary.
🛠️ Key Features
Incidents integration
Logs integration
Anomaly detection integration
Trace-correlated incident tickets
AI root cause analysis
🚀 Use Cases
Correlate traces with incident tickets using LogClaw
Use anomaly detections to support incident response workflows
Perform AI-assisted root cause analysis from within infrastructure
⚡ Developer Benefits
Connects AI coding tools to LogClaw incident, log, and anomaly data
Workflow stays tied to infrastructure context per the README excerpt
⚠️ Limitations
Provided data does not list specific MCP tools, capabilities, or configuration details beyond the integration description and README excerpt.
AI SRE that deploys in your VPC. Real-time anomaly detection, trace-correlated incident tickets, and AI root cause analysis — your logs never leave your infrastructure.
LogClaw Dashboard — real-time log monitoring with AI anomaly detection
TL;DR — Try It
Option A: Managed Cloud (no install — fastest)
Try the full experience instantly at console.logclaw.ai — includes AI root cause analysis, API key management, multi-tenant isolation, and the complete incident pipeline. No Docker required.
Option B: Docker Compose (self-hosted, no Kubernetes)
bash
curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/otel-collector-config.yaml
docker compose up -d
All images are pulled from ghcr.io/logclaw/ — no registry auth required.
Note: The local stack runs in single-tenant mode with LLM-powered root cause analysis disabled. For AI RCA, API key management, and multi-tenant isolation, use the managed cloud or deploy to Kubernetes with LLM_PROVIDER=claude|openai|ollama.
Option C: Kind Cluster (full Kubernetes stack)
bash
git clone https://github.com/logclaw/logclaw.git && cd logclaw
./scripts/setup-dev.sh
This creates a Kind cluster, installs all operators and services, builds the dashboard, and runs a smoke test. Takes ~20 minutes on a 16 GB laptop.
Container Images
All LogClaw images are published to GHCR as public packages:
Builds a causal chain showing error propagation across services
Computes blast radius (% of services affected)
Creates a deduplicated incident ticket with full trace context
Multi-Platform Ticketing
The logclaw-ticketing-agent supports 6 independently-toggleable platforms simultaneously:
Platform
Type
Egress
PagerDuty
SaaS
External HTTPS
Jira
SaaS
External HTTPS
ServiceNow
SaaS
External HTTPS
OpsGenie
SaaS
External HTTPS
Slack
SaaS
External HTTPS
Zammad
In-cluster
Zero external egress
Per-severity routing (critical → PagerDuty, medium → Jira, etc.) is configurable via config.routing.*.
Air-Gapped Mode
When paired with Zammad (external ITSM chart) and Ollama for local LLM inference, the needsExternalHttps helper sets the NetworkPolicy to zero external egress — fully air-gapped. No logs, tickets, or model calls leave the cluster.
LLM Provider Abstraction
yaml
global:llm:provider:ollama# claude | openai | ollama | vllm | disabledmodel:llama3.2:8b
Dashboard
The Dashboard provides:
Dark mode — system-aware with manual toggle (Light/Dark/System), persisted in localStorage
Drag-and-drop upload supporting JSON, NDJSON, CSV, and plain text files
Bulk incident actions — select multiple incidents and acknowledge/resolve/escalate in batch
CSV export — download incidents as a CSV file
Loading skeletons — smooth animated placeholders during data fetches
Error boundaries — graceful crash recovery with retry UI
LLM fallback badge — indicates when AI RCA is unavailable and rule-based fallback was used
Incident auto-deduplication — prevents duplicate incidents for the same anomaly
Log Ingestion — OTLP Native
LogClaw uses OTLP (OpenTelemetry Protocol) as its sole ingestion protocol — the CNCF industry standard supported by every major observability vendor (Datadog, Splunk, Grafana, AWS, GCP, Azure).
Supported transports:
gRPC — <collector>:4317 (recommended for high-throughput)
HTTP/JSON — <collector>:4318/v1/logs
Any OpenTelemetry SDK, agent, or collector can send logs directly to LogClaw without custom integrations. The OTel Collector enriches each log with tenant_id, batches them, and writes to Kafka using otlp_json encoding.
json
{"resourceLogs":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"my-service"}},{"key":"host.name","value":{"stringValue":"my-service-pod-abc12"}}]},"scopeLogs":[{"logRecords":[{"timeUnixNano":"1709510400000000000","severityText":"ERROR","body":{"stringValue":"Something went wrong"},"traceId":"abcdef1234567890abcdef1234567890","spanId":"abcdef12345678","attributes":[{"key":"environment","value":{"stringValue":"production"}}]}]}]}]}
The logclaw-mcp-server connects AI coding tools to LogClaw incidents, logs, and anomalies via the Model Context Protocol. Published as an npm package with 8 tools.
bash
npx logclaw-mcp-server
Works with Claude Code, Cursor, Windsurf, and any MCP-compatible client. Also available as a hosted server at https://mcp.logclaw.ai (OAuth 2.1, no install needed).
The logclaw-slack-bot delivers real-time incident notifications to Slack with rich Block Kit formatting, DM support, and OAuth. Runs on Cloudflare Workers.
The logclaw-auth-proxy sits between ingress and the OTel Collector. It validates API keys against PostgreSQL, injects tenant_id into OTLP payloads, and enforces rate limits (200 req/min unauthenticated, 6000 req/min per tenant). Stateless and horizontally scalable.
Component Versions
Component
Version
Apache Kafka (Strimzi)
3.7.0
Apache Flink
1.19.0
OpenSearch
2.14.0
External Secrets Operator
0.10.3
cert-manager
v1.16.1
Apache Airflow
1.14.0
Zammad
12.4.1
OpenTelemetry Collector Contrib
0.114.0
KServe
0.13.0
Feast
0.40.0
Next.js (Dashboard)
16.1.6
Development
Dashboard (Next.js)
bash
cd apps/dashboard
npm install
npm run dev
# → http://localhost:3000
Bridge (Python)
bash
cd apps/bridge
pip install -r requirements.txt
export KAFKA_BROKERS="localhost:9092"export OPENSEARCH_ENDPOINT="http://localhost:9200"
python main.py
# → HTTP API on :8080 (/health, /metrics, /config)
cd apps/ticketing-agent
pip install -r requirements.txt
export KAFKA_BROKERS="localhost:9092"export OPENSEARCH_ENDPOINT="http://localhost:9200"
python main.py
# → HTTP API on :8080
Agent (Go)
bash
cd apps/agent
go run main.go
# → HTTP API on :8080 (/health, /ready, /metrics)
Auth Proxy (TypeScript)
bash
cd apps/logclaw-auth-proxy
npm install
npm run dev
# → HTTP API on :4318
Requires a PostgreSQL database with API keys. See API Keys docs.
MCP Server (TypeScript)
bash
cd apps/logclaw-mcp-server
npm install && npm run build
LOGCLAW_API_KEY=lc_proj_test npx .
Helm Charts
bash
# Lint all charts
make lint
# Render templates (dry-run, no cluster needed)
make template TENANT_ID=ci-test
# Diff current vs new
make template-diff TENANT_ID=dev-local
# Package charts as .tgz
make package
# Push to OCI registry
make push HELM_REGISTRY=oci://ghcr.io/logclaw/charts
