Connect AI coding tools to LogClaw incidents, logs, and anomaly detections.
The MCP server connects AI coding tools to LogClaw incidents, logs, and anomaly detections, enabling automated workflows and analysis within a cohesive tooling layer.
🛠️ Key Features
Integrates AI-assisted coding tools with LogClaw incident management, logs, and anomaly detection.
Facilitates real-time correlation between traces, incidents, and root causes.
Operates in your VPC with on-prem/infrastructure-contained deployment principles.
Reads from and exposes workflow-ready interfaces for incident and log data.
🚀 Use Cases
AI-assisted remediation of log-claw incidents through automated code actions.
Real-time anomaly detection alignment with incident tickets.
Root-cause analysis workflows leveraging AI tooling integrated with LogClaw data.
⚡ Developer Benefits
Grounded deployment model compatible with Kubernetes, Helm, and Docker Compose.
Clear, actionable readme excerpt highlights deployment and licensing details.
Facilitates secure data handling by keeping processing within your infrastructure.
⚠️ Limitations
Details in the source are limited; the readme excerpt emphasizes deployment environments and tooling compatibility rather than extensive API specs.
AI SRE that deploys in your VPC. Real-time anomaly detection, trace-correlated incident tickets, and AI root cause analysis — your logs never leave your infrastructure.
LogClaw Dashboard — real-time log monitoring with AI anomaly detection
TL;DR — Try It
Option A: Managed Cloud (no install — fastest)
Try the full experience instantly at console.logclaw.ai — includes AI root cause analysis, API key management, multi-tenant isolation, and the complete incident pipeline. No Docker required.
Option B: Docker Compose (self-hosted, no Kubernetes)
bash
curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/otel-collector-config.yaml
docker compose up -d
All images are pulled from ghcr.io/logclaw/ — no registry auth required.
Note: The local stack runs in single-tenant mode with LLM-powered root cause analysis disabled. For AI RCA, API key management, and multi-tenant isolation, use the managed cloud or deploy to Kubernetes with LLM_PROVIDER=claude|openai|ollama.
Option C: Kind Cluster (full Kubernetes stack)
bash
git clone https://github.com/logclaw/logclaw.git && cd logclaw
./scripts/setup-dev.sh
This creates a Kind cluster, installs all operators and services, builds the dashboard, and runs a smoke test. Takes ~20 minutes on a 16 GB laptop.
Container Images
All LogClaw images are published to GHCR as public packages:
Builds a causal chain showing error propagation across services
Computes blast radius (% of services affected)
Creates a deduplicated incident ticket with full trace context
Multi-Platform Ticketing
The logclaw-ticketing-agent supports 6 independently-toggleable platforms simultaneously:
Platform
Type
Egress
PagerDuty
SaaS
External HTTPS
Jira
SaaS
External HTTPS
ServiceNow
SaaS
External HTTPS
OpsGenie
SaaS
External HTTPS
Slack
SaaS
External HTTPS
Zammad
In-cluster
Zero external egress
Per-severity routing (critical → PagerDuty, medium → Jira, etc.) is configurable via config.routing.*.
Air-Gapped Mode
When paired with Zammad (external ITSM chart) and Ollama for local LLM inference, the needsExternalHttps helper sets the NetworkPolicy to zero external egress — fully air-gapped. No logs, tickets, or model calls leave the cluster.
LLM Provider Abstraction
yaml
global:llm:provider:ollama# claude | openai | ollama | vllm | disabledmodel:llama3.2:8b
Dashboard
The Dashboard provides:
Dark mode — system-aware with manual toggle (Light/Dark/System), persisted in localStorage
Drag-and-drop upload supporting JSON, NDJSON, CSV, and plain text files
Bulk incident actions — select multiple incidents and acknowledge/resolve/escalate in batch
CSV export — download incidents as a CSV file
Loading skeletons — smooth animated placeholders during data fetches
Error boundaries — graceful crash recovery with retry UI
LLM fallback badge — indicates when AI RCA is unavailable and rule-based fallback was used
Incident auto-deduplication — prevents duplicate incidents for the same anomaly
Log Ingestion — OTLP Native
LogClaw uses OTLP (OpenTelemetry Protocol) as its sole ingestion protocol — the CNCF industry standard supported by every major observability vendor (Datadog, Splunk, Grafana, AWS, GCP, Azure).
Supported transports:
gRPC — <collector>:4317 (recommended for high-throughput)
HTTP/JSON — <collector>:4318/v1/logs
Any OpenTelemetry SDK, agent, or collector can send logs directly to LogClaw without custom integrations. The OTel Collector enriches each log with tenant_id, batches them, and writes to Kafka using otlp_json encoding.
json
{"resourceLogs":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"my-service"}},{"key":"host.name","value":{"stringValue":"my-service-pod-abc12"}}]},"scopeLogs":[{"logRecords":[{"timeUnixNano":"1709510400000000000","severityText":"ERROR","body":{"stringValue":"Something went wrong"},"traceId":"abcdef1234567890abcdef1234567890","spanId":"abcdef12345678","attributes":[{"key":"environment","value":{"stringValue":"production"}}]}]}]}]}
The logclaw-mcp-server connects AI coding tools to LogClaw incidents, logs, and anomalies via the Model Context Protocol. Published as an npm package with 8 tools.
bash
npx logclaw-mcp-server
Works with Claude Code, Cursor, Windsurf, and any MCP-compatible client. Also available as a hosted server at https://mcp.logclaw.ai (OAuth 2.1, no install needed).
The logclaw-slack-bot delivers real-time incident notifications to Slack with rich Block Kit formatting, DM support, and OAuth. Runs on Cloudflare Workers.
The logclaw-auth-proxy sits between ingress and the OTel Collector. It validates API keys against PostgreSQL, injects tenant_id into OTLP payloads, and enforces rate limits (200 req/min unauthenticated, 6000 req/min per tenant). Stateless and horizontally scalable.
Component Versions
Component
Version
Apache Kafka (Strimzi)
3.7.0
Apache Flink
1.19.0
OpenSearch
2.14.0
External Secrets Operator
0.10.3
cert-manager
v1.16.1
Apache Airflow
1.14.0
Zammad
12.4.1
OpenTelemetry Collector Contrib
0.114.0
KServe
0.13.0
Feast
0.40.0
Next.js (Dashboard)
16.1.6
Development
Dashboard (Next.js)
bash
cd apps/dashboard
npm install
npm run dev
# → http://localhost:3000
Bridge (Python)
bash
cd apps/bridge
pip install -r requirements.txt
export KAFKA_BROKERS="localhost:9092"export OPENSEARCH_ENDPOINT="http://localhost:9200"
python main.py
# → HTTP API on :8080 (/health, /metrics, /config)
cd apps/ticketing-agent
pip install -r requirements.txt
export KAFKA_BROKERS="localhost:9092"export OPENSEARCH_ENDPOINT="http://localhost:9200"
python main.py
# → HTTP API on :8080
Agent (Go)
bash
cd apps/agent
go run main.go
# → HTTP API on :8080 (/health, /ready, /metrics)
Auth Proxy (TypeScript)
bash
cd apps/logclaw-auth-proxy
npm install
npm run dev
# → HTTP API on :4318
Requires a PostgreSQL database with API keys. See API Keys docs.
MCP Server (TypeScript)
bash
cd apps/logclaw-mcp-server
npm install && npm run build
LOGCLAW_API_KEY=lc_proj_test npx .
Helm Charts
bash
# Lint all charts
make lint
# Render templates (dry-run, no cluster needed)
make template TENANT_ID=ci-test
# Diff current vs new
make template-diff TENANT_ID=dev-local
# Package charts as .tgz
make package
# Push to OCI registry
make push HELM_REGISTRY=oci://ghcr.io/logclaw/charts
