Logmcp

What kascada/logmcp MCP server does

kascada/logmcp MCP server exposes selected Linux log files to MCP-compatible AI clients while keeping the underlying machine outside the agent’s control. Access is read-only: the available log operations do not provide shell execution, file modification, deletion, or unrestricted filesystem access.

Administrators define which paths are available with whitelist and blacklist glob patterns. The server can also expose systemd journal data through a journald:// virtual source. Requests are authenticated with bearer tokens, and access events are recorded through syslog without including log contents in the audit trail.

The design fits remote troubleshooting where an AI assistant needs evidence from logs but should not receive SSH credentials or general server access.

How it works

The server accepts MCP requests over HTTPS. TLS can use a self-signed certificate, a custom certificate, or a deployment behind Caddy. Clients may connect directly or, for Claude Code setups using an SSH key, through an SSH tunnel instead of publishing an HTTPS endpoint.

Each request is associated with a bearer token. Multiple tokens can be configured for separate clients, and individual tokens can be revoked or renewed. An external authenticator can also be used to delegate token verification to a command-line program.

The built-in MCP surface includes log discovery, line retrieval, regular-expression search, file metadata, configuration inspection, environment checks, and runtime status. Optional extensions can register additional tools from external CLI programs or Redis-backed workers. Macros can define composite tools in YAML.

Setup and configuration

For a temporary test, logmcp quickstart checks relevant group memberships, creates an ephemeral bearer token and self-signed certificate, starts the service, and prints a Claude configuration command. Optional flags include the port and token. A permanent installation can be made with go install github.com/kascada/logmcp@latest, followed by sudo logmcp setup.

The setup wizard covers deployment mode, TLS, bearer-token configuration, and systemd service installation. It also prints configuration snippets for Claude Code, VS Code, and Claude Desktop. Whitelist, blacklist, and journald settings are edited in /etc/logmcp/config.yaml after setup.

Configuration values support ${VAR} and $VAR environment-variable substitution, including tokens, paths, and database connection strings. The command-line interface also provides commands for checking configuration, managing tokens, inspecting logs, installing or removing the systemd service, and generating client settings.

Tools and capabilities

• list_logs shows configured log sources.
• read_log reads by head, tail, offset, or time window.
• search_log applies a regular expression with optional context and time filtering.
• log_info reports size, line count, and modification time.
• check_environment checks configuration, TLS, whitelist, syslog, and databases.
• check_config reports active configuration and defaulted optional settings.
• server_status reports MCP runtime state and registered extensions.

Limitations and notes

kascada/logmcp MCP server only exposes sources explicitly configured by the operator; it is not a general filesystem browser. Quickstart credentials and certificates are temporary and change on each start, so a permanent deployment requires the setup flow and persistent configuration.

The material identifies Claude Code, VS Code, and Claude Desktop as supported client configuration targets. Extensions may add tools beyond the built-in set, so their behavior depends on the external program or Redis worker that is configured. Environment-variable substitution is optional; no required environment variable is specified.