{
  "mcp": {
    "servers": {
      "last9": {
        "type": "stdio",
        "command": "/opt/homebrew/bin/last9-mcp",
        "env": {
          "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
        }
      }
    }
  }
}

For NPM: use "command": "npx" and add "args": ["-y", "@last9/mcp-server@latest"].

After downloading from GitHub Releases, extract and point to the full path:

{
  "mcpServers": {
    "last9": {
      "command": "C:\\Users\\<user>\\AppData\\Local\\Programs\\last9-mcp-server.exe",
      "env": {
        "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
      }
    }
  }
}

The NPM route is easier on Windows — no path management.

Run in HTTP Mode

export LAST9_REFRESH_TOKEN="your_refresh_token"
export LAST9_HTTP=true
export LAST9_PORT=8080
./last9-mcp-server

Server starts at http://localhost:8080/mcp.

Test with curl

The Streamable HTTP handler runs in stateless mode, so any request is served independently. An initialize handshake and an Mcp-Session-Id header are optional — clients that send them still work (the header is accepted and ignored), and clients can also skip straight to tools/list / tools/call. Every tool is an independent request/response query; the server issues no server→client notifications, so GET /mcp (the SSE stream) returns 405.

# List tools — a session handshake is optional in stateless mode
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}'

# Call a tool
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{
      "jsonrpc": "2.0",
      "id": 2,
      "method": "tools/call",
      "params": {
        "name": "get_service_logs",
        "arguments": {
          "service_name": "your-service-name",
          "lookback_minutes": 30,
          "limit": 10
        }
      }
    }'

Build from Source

git clone https://github.com/last9/last9-mcp-server.git
cd last9-mcp-server
go build -o last9-mcp-server
LAST9_HTTP=true ./last9-mcp-server

LAST9_HTTP=true is for local development. For actual usage, the hosted HTTP endpoint is easier.

Time Input

• Absolute times (start_time_iso/end_time_iso, or time_iso) take precedence over lookback_minutes.
• For relative windows: use lookback_minutes.
• For absolute windows: use RFC3339/ISO8601 — 2026-02-09T15:04:05Z.
• Legacy YYYY-MM-DD HH:MM:SS is accepted for compatibility only.

get_exceptions

• limit (integer, optional): Max exceptions. Default: 20.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional): Absolute time range.
• service_name (string, optional): Filter by service.
• span_name (string, optional): Filter by span name.
• env (string, optional): Filter by environment.

get_service_summary

• start_time_iso / end_time_iso (string, optional)
• env (string, optional): PromQL regex. Defaults to .*. Exact match needs anchors (e.g. ^prod$).
• sort_by (string, optional): request_count (default), throughput_rpm, http_4xx_count, http_5xx_count, or grpc_error_count.
• limit (integer, optional): Max ranked rows. Omit or 0 means 10; values above 100 clamp to 100.

get_service_environments

• start_time_iso / end_time_iso (string, optional)

All other APM tools require an env value. Use "" if this returns empty.

get_service_performance_details

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

get_service_operations_summary

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

get_service_dependency_graph

• service_name (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

get_apm_service_deviations

• service_name (string, optional): Omit for fleet scope; provide for one service and its operation correlations.
• lookback_minutes (integer, optional): Current window. Default: 60.
• start_time_iso / end_time_iso (string, optional): Explicit current window.
• baseline_start_time_iso / baseline_end_time_iso (string, optional): Explicit baseline. Defaults to the immediately preceding equal-duration window.
• datasource (string, optional): Restrict the comparison to one datasource.
• env (string, optional): Defaults to prod.
• max_services / max_operations (integer, optional): Default 10, max 10 each.

get_databases

• env (string, optional): Filter by environment. Default: all.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)

get_database_slow_queries

• db_system (string, optional): e.g. postgresql, mysql, mongodb, redis.
• host (string, optional): Database host (net_peer_name).
• service_name (string, optional): Calling service name.
• env (string, optional)
• min_duration_ms (float, optional): Minimum query duration in ms.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

get_database_queries

• db_system (string, optional)
• host (string, optional)
• service_name (string, optional)
• env (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

get_database_server_metrics

• db_system (string, required): e.g. postgresql, mysql, mongodb, redis, aerospike.
• host (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)

prometheus_range_query

• query (string, required): The PromQL query.
• start_time_iso / end_time_iso (string, optional): Defaults to last 60 min.
• lookback_minutes (float, optional): Default: 60.

prometheus_instant_query

• query (string, required)
• time_iso (string, optional): Defaults to now.
• lookback_minutes (float, optional)

prometheus_label_values

• match_query (string, optional): PromQL filter.
• label (string, required): Label name.
• start_time_iso / end_time_iso (string, optional)

prometheus_labels

• match_query (string, optional): PromQL filter.
• start_time_iso / end_time_iso (string, optional)

get_logs

• logjson_query (array, required): JSON pipeline query.
• lookback_minutes (integer, optional): Default: 5.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Server default: 5000.
• index (string, optional): physical_index:<name> or rehydration_index:<block_name>.

For log-based service inventory, query physical_index_service_count first:

sum by (name, service_name, env) (physical_index_service_count{destination="logs"})

Use service_name as ServiceName, env as the environment when present, and name as the physical index name. If name="default", omit index; for a non-default physical index selected by the user, pass index: "physical_index:<name>". If the backend rejects explicit physical index filtering, retry without index and report that explicit physical index filtering is unavailable for that backend.

get_service_logs

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 20.
• env (string, optional)
• severity_filters (array, optional): e.g. ["error", "warn"]. OR logic.
• body_filters (array, optional): e.g. ["timeout", "failed"]. OR logic.
• start_time_iso / end_time_iso (string, optional)
• index (string, optional)

Multiple filter types combine with AND. Each array uses OR internally. Use get_logs for broad aggregate counts first; use get_service_logs only after narrowing to a service/env/index and a small sample set.

get_log_attributes

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)
• index (string, optional)

get_log_attributes_for_pipeline

• pipeline (array, required): Prior filter stages to scope discovery, e.g. [{"type":"filter","query":{"$eq":["ServiceName","<service>"]}}].
• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)
• index (string, optional)

get_drop_rules

No parameters. Lists drop rules via GET /otel_settings/drop?region=....

add_drop_rule

• name (string, required)
• filters (array, required): Each filter: key, value, operator (equals/not_equals), conjunction (and).
• Filter keys must use attributes["key_name"] or resource.attributes["key_name"] (required by the Last9 API).
• Creates the rule via POST /otel_settings/drop?region=...&cluster_id=....

get_traces

Use for broad searches and aggregations. For exact trace ID lookup, use get_service_traces.

• tracejson_query (array, required)
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 5000.

get_service_traces

Exactly one of trace_id or service_name is required.

• trace_id (string, optional): Default lookback: 72 hours.
• service_name (string, optional): Default lookback: 60 min.
• lookback_minutes (integer, optional)
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 10.
• env (string, optional)

get_trace_attributes

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)

get_trace_attributes_for_pipeline

• pipeline (array, required): Prior filter stages to scope discovery, e.g. [{"type":"filter","query":{"$eq":["ServiceName","<service>"]}}].
• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)

get_trace_attribute_values

• tag_name (string, required): Attribute name from get_trace_attributes (e.g. resource_department or attributes['http.method']).
• pipeline (array, optional): Prior filter stages to scope the values; omit for global values.
• region (string, optional)

get_trace_attribute_deviations

• comparison_mode (string, required): latency, errors, or time.
• service_name (string, required)
• environment (string, required): Exact deployment.environment value.
• operation (string, optional)
• filters (array, optional): Trace JSON filter conditions.
• candidate_attributes (array, optional): Maximum 8; omit for bounded discovery.
• latency_threshold_ms (number, optional): Required for latency mode; rejected for other modes.
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 15. Maximum: 15.
• baseline_start_time_iso / baseline_end_time_iso (string, optional): Required for time mode; non-overlapping and equal in duration to the target window.
• minimum_cohort_size (integer, optional): Default: 100. Minimum: 20.
• minimum_value_support (integer, optional): Default: 20. Minimum: 10.
• limit (integer, optional): Default: 10. Maximum: 10.

Requires the companion backend capability to be enabled.

get_trace_waterfall

• trace_id (string, required)
• environment (string, optional)
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 4320 (72 hours).
• selected_span_id (string, optional): Returns attributes, events, and links for that span only.
• max_spans (integer, optional): Default: 500. Maximum: 1000.

Returns an investigation-evidence/v1 envelope; the waterfall is under data.

get_change_events

• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• service_name (string, optional)
• env (string, optional)
• event_name (string, optional): Call without this first to get available_event_names.

get_alert_groups

Configured Compass alert-group inventory for changeboard / label-coverage audits. Includes groups with zero rules and groups that are not firing. Does not return PromQL.

• alert_group_name / alert_group_type / data_source_name (string, optional): Case-insensitive substring match.
• team / tier (string, optional): Exact case-insensitive match on configured metadata.
• label_key + label_value (string, optional): Must be set together. Exact case-insensitive match on one metadata.labels pair — both key and value.

Returns compact JSON {"count":N,"groups":[...]} with id, name, type, entity_class, team, tier, metadata.labels, and rule counts. Empty team / labels means unset.

get_alert_config

• search_term (string, optional): Free-text search across name, group, data source, tags.
• rule_name (string, optional)
• severity (string, optional)
• rule_type (string, optional): static or anomaly.
• alert_group_name / alert_group_type / data_source_name (string, optional)
• tags (array, optional): All must match (AND logic).

get_alerts

• time_iso (string, optional): Evaluation time in RFC3339.
• window (integer, optional): Lookback in seconds. Default: 900. Range: 60–86400.
• lookback_minutes (integer, optional): Range: 1–1440.

get_alert_rule_state

• start_time (integer, required): Unix epoch start of the range (inclusive).
• end_time (integer, required): Unix epoch end of the range (inclusive).
• step (integer, required): Resolution in seconds between samples. The number of samples ((end_time - start_time) / step + 1) is capped at 100.
• alert_group_id (string, optional): Filter by alert group ID.
• rule_name (string, optional): Regex filter on rule name.
• alert_group_name (string, optional): Regex filter on alert group name.
• label_filters (string, optional): Comma-separated key=value label filters.
• state (string, optional): Filter by state (e.g. firing).

Returns a JSON map of rule_id -> [{timestamp, is_firing}]. A timestamp at which a rule is absent from the upstream response is reported as is_firing=0 — this means "not observed as firing", not a confirmed normal state.

get_notification_channels

No parameters. Returns all configured notification channels (Slack, PagerDuty, email, webhooks, etc.).

did_you_mean

• query (string, required): The name to search for — partial, misspelled, or abbreviated.
• type (string, optional): Restrict to entity type: service, environment, host, database, k8s_deployment, k8s_namespace, job.

Returns up to 3 closest matches with similarity scores. Use this before any tool call where the entity name is uncertain. If a previous call returned empty results, try this before retrying.

get_service_profile

• service_name (string, required): Service to derive a telemetry profile for.
• datasource (string, optional): Datasource name. Omit for the default.

Returns a short investigation brief followed by the full profile as raw JSON: signal presence (logs/traces/metrics as present, absent, or unknown), language and runtime, deployment environments, log signal_shape (log_format, severity_set, level_field), and a recommended ingest fix where one applies. Derived upstream and cached with a ~15 minute TTL.

Call it before any service-scoped investigation so tool selection matches the service's actual telemetry — skip trace tools when traces is absent, and when severity_set is none or partial parse severity from level_field in the log body rather than using severity_filters. metrics is always unknown and dependencies is unpopulated in v1. When logs and traces are both absent, confirm the name with did_you_mean before concluding the service is unmonitored.

list_dashboards

No parameters. Returns all custom dashboards in the org as a JSON array with id, name, and metadata.

get_dashboard

• id (string, required): Dashboard UUID.
• region (string, optional): Region for panel query population. Defaults to configured datasource region.

create_dashboard

Net-new only. After this call returns dashboard.id, refine with update_dashboard — do not create again to add, trim, or fix panels.

• dashboard (object, required): Dashboard definition with name and panels[]. Each panel requires name, version, layout (x, y, w, h), visualization.type, and queries[].
• metadata (object, optional): Dashboard metadata — _category and _type fields (e.g. {"_category":"custom","_type":"metrics"}).

update_dashboard

Prefer this after create. Full replacement by id (same body as create).

• id (string, required): Dashboard UUID to update.
• dashboard (object, required): Full replacement dashboard body (same shape as create).
• metadata (object, optional): Replacement metadata. Readonly system dashboards return a 403 error.

delete_dashboard

• id (string, required): Dashboard UUID to delete. Readonly system dashboards cannot be deleted.

list_dashboard_snapshots

• dashboard_id (string, required): Dashboard UUID whose snapshots to list.

Returns metadata only (id, name, expires_at, etc.). Use get_dashboard_snapshot for frozen panel data.

get_dashboard_snapshot

• id (string, required): Snapshot UUID.

Returns the full frozen snapshot including dashboard_definition, panel_data, time_range, and variables.

delete_dashboard_snapshot

• id (string, required): Snapshot UUID to delete.