mulewatch

Read-only observability for MuleSoft Anypoint Platform, over MCP.
Application logs, historical archive search, Runtime Manager, API Manager and Exchange — for any Anypoint customer, using their own credentials.

What it does

mulewatch bridges an MCP client — Claude Desktop, Claude Code, Cursor, OpenClaw — to MuleSoft Anypoint Platform, so you can ask about a Mule estate in plain language and get real answers from the platform APIs. It is aimed at the person holding the pager, not the person writing the flow: no local Mule project is required, and every tool is read-only.

• Application logs from Runtime Manager, normalized across CloudHub 2.0, Runtime Fabric and legacy CloudHub.
• Historical log search through the Anypoint Monitoring Archive API, reaching incidents long past the live tail's rolling buffer.
• Analysis-ready log payloads — normalized lines plus counts by priority, logger and replica.
• Runtime Manager inventory across Application Manager, CloudHub and hybrid on-prem targets.
• API Manager instances and Exchange assets, so a single server answers "what is deployed, what is it fronted by, and what broke".

Nothing is hardcoded to one customer: business groups, environments and credentials all come from your own connected app.

How this relates to the official MuleSoft MCP server

MuleSoft publishes its own MCP server (mulesoft-mcp-server, docs). It is a development tool — it scaffolds Mule projects, generates flows and API specs, and deploys applications, largely from a local project in an IDE.

mulewatch is an operations tool. It never writes to your estate, it assumes no local project, and it covers the one area the official server does not address at all: retrieving and searching application logs, including historical logs from the Monitoring Archive. The two run happily side by side, and if you want deployment or scaffolding tools, use the official one.

Requirements

• Node.js 20+
• An Anypoint Platform account with access to the business group you want to read
• A connected app (recommended) with "acts on its own behalf" enabled, or platform credentials
• For historical log search only: Anypoint Monitoring enabled for the organization

Connected-app scopes

Grant the scopes for the surfaces you intend to use, on the business groups and environments you care about. Anypoint returns a bare 403 Forbidden when a scope is missing; mulewatch catches that and names the scope you probably need.

Setup

Create a connected app in Anypoint Platform → Access Management → Connected Apps, choose "App acts on its own behalf (client credentials)", grant the scopes above, and copy the client id and secret.

Configuration is environment variables only — there is no config file and no organization default.

ANYPOINT_CLIENT_ID=your_connected_app_client_id
ANYPOINT_CLIENT_SECRET=your_connected_app_client_secret

Business groups

Environments live on business groups, not on the root organization. If anypoint_list_environments comes back empty, your credentials resolved to the root org — call anypoint_list_business_groups to list the ids, then pass one as orgId or pin it with ANYPOINT_ORG_ID.

Keeping production out of reach

ANYPOINT_ALLOWED_ENVIRONMENTS scopes the whole server, not one tool. With

ANYPOINT_ALLOWED_ENVIRONMENTS=Dev,Sandbox

every tool refuses an environment outside the list and says why, whichever business group is targeted. Combine it with a connected app that only has access to those environments for defence in depth.

Run

Nothing to install — point your MCP client at npx:

{
  "mcpServers": {
    "mulewatch": {
      "command": "npx",
      "args": ["-y", "mulewatch"],
      "env": {
        "ANYPOINT_CLIENT_ID": "your_connected_app_client_id",
        "ANYPOINT_CLIENT_SECRET": "your_connected_app_client_secret"
      }
    }
  }
}

That block works as-is in Claude Desktop (claude_desktop_config.json), Cursor (.cursor/mcp.json) and OpenClaw. For Claude Code:

claude mcp add mulewatch --env ANYPOINT_CLIENT_ID=... --env ANYPOINT_CLIENT_SECRET=... -- npx -y mulewatch

From a clone instead:

npm install
npm run build
npm start

The server speaks stdio, which is what MCP clients expect. Start with anypoint_whoami to confirm credentials, business group and scope before anything else.

Tools

Every tool is read-only. All of them accept orgId to override the configured business group.

anypoint_whoami

Confirms which credentials, business group, hosts and environment allowlist the server is running with. No arguments. Call this first when anything fails.

anypoint_list_business_groups

Lists the business groups beneath the credentials' organization, with ids and nesting depth.

{ "rootOrgId": "optional-root-organization-id" }

anypoint_list_environments

Lists environments for a business group, filtered by ANYPOINT_ALLOWED_ENVIRONMENTS when set.

{ "orgId": "your-business-group-id" }

anypoint_list_deployed_apps

Lists deployed Mule applications for an environment, by environmentId or environmentName.

{ "environmentName": "Dev", "target": "all" }

application_manager covers CloudHub 2.0 and Runtime Fabric deployments, cloudhub legacy CloudHub, hybrid on-prem Runtime Manager. all queries every target and reports per-target failures instead of aborting.

anypoint_list_app_logs

Lists the latest Runtime Manager logs for an application.

{ "environmentName": "Dev", "appName": "my-mule-app" }

For CloudHub 2.0 and Runtime Fabric the tool resolves appName to a deployment, resolves the current spec, then reads that spec's logs. For legacy CloudHub it calls the CloudHub logs endpoint directly.

anypoint_get_app_logs_for_analysis

Same sources as above, but returns an analysis-ready payload rather than a raw list. Prefer it when diagnosing something.

{ "environmentName": "Dev", "appName": "my-mule-app", "limit": 200, "errorOnly": true }

Takes every option of anypoint_list_app_logs, plus: