Loggly MCP server

Loggly MCP

Read-only Model Context Protocol (MCP) server for Loggly /apiv2/* APIs, plus IP intelligence (RDAP, GreyNoise, AbuseIPDB). Exposes Loggly search/analytics/field tools, aggregation-first traffic tools, and IP-context tools, while blocking write endpoints.

Skill Usage

For efficient log retrieval (less token use) and summarization, pair this server with a skill.

Quickstart

Install from npm

LOGGLY_SUBDOMAIN=your-subdomain LOGGLY_TOKEN=your-token npx -y @andrewbabu/loggly-mcp

MCP client configuration:

{
  "mcpServers": {
    "loggly": {
      "command": "npx",
      "args": ["-y", "@andrewbabu/loggly-mcp"],
      "env": {
        "LOGGLY_SUBDOMAIN": "your-subdomain",
        "LOGGLY_TOKEN": "your-token"
      }
    }
  }
}

Run from source

git clone https://github.com/andrewbabu/loggly-mcp.git
cd loggly-mcp
npm install
cp .env.example .env

Edit .env with your Loggly credentials, then run:

npm start

Once the repo is trusted in Codex, the MCP server can also be started automatically via .codex/config.toml.

Configuration

The server loads .env from its working directory on startup.

Required

Loggly account subdomain or full Loggly URL (e.g. your-subdomain or https://your-subdomain.loggly.com)

• LOGGLY_SUBDOMAIN

Loggly API token

• LOGGLY_TOKEN

Optional

bearer (default) or basic

• LOGGLYAUTHMODE

Default: 2

• LOGGLYMAXRETRIES

Default: 15000

• LOGGLYREQUESTTIMEOUT_MS

error, warn, info (default), or debug

• LOGGLYLOGLEVEL

Remote (HTTP) Server

For a stdio server anyone on the team can reach from Claude Code without a local checkout, run the HTTP variant instead and host it on an internal server/VM.

cp .env.example .env

Edit .env with your Loggly credentials plus MCPBEARERTOKEN (generate one with node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"), then:

npm run start:http

This starts a stateless Streamable HTTP MCP server on MCPHTTPPORT (default 8787):

other request to /mcp gets 401.

• GET /healthz — unauthenticated liveness check.
• POST /mcp — the MCP endpoint. Requires Authorization: Bearer ; every

The Loggly credentials stay server-side — everyone connecting shares the same Loggly account access. MCPBEARERTOKEN only gates access to the MCP server itself, so treat it as a secret and rotate it if it leaks (e.g. re-generate and redistribute).

Only run this behind your internal network/VPN, not exposed directly to the public internet — there's a single shared token, not per-user auth.

Connecting from Claude Code

Each org member adds the remote server once:

claude mcp add --transport http loggly https://your-internal-host:8787/mcp \
  --header "Authorization: Bearer <MCP_BEARER_TOKEN>"

Swap in the internal hostname/port you deployed to and the token you were given.

Running with Docker

docker build -t loggly-mcp .
docker run -d --name loggly-mcp -p 8787:8787 --env-file .env loggly-mcp

Multiple Accounts / Domains

The server can hold credentials for several Loggly accounts (different subdomains, different tokens) at once and target them per tool call.

Set LOGGLY_ACCOUNTS to a JSON object mapping an account name to its credentials:

LOGGLY_ACCOUNTS={"acme":{"subdomain":"acme","token":"acme_token","authMode":"bearer"},"beta":{"subdomain":"beta","token":"beta_token"}}

Shortened. The full README is on GitHub.