Loki MCP Server
Query Grafana Loki logs directly from AI agents using the Model Context Protocol (MCP).
Built in Go. Enables AI-powered log analysis using LogQL.
Supports integration with:
- Claude Desktop
- AI agent frameworks
- automation tools
- DevOps workflows
Motivation
The official grafana/loki-mcp exposes a single loki_query tool, which means the LLM must already know valid label names and values before it can build a query. This project takes a different approach by providing 5 granular tools — labels, label_values, and series let the LLM discover what's available in Loki first, then construct precise query_range or query calls. The result is more accurate log retrieval with fewer wasted round-trips.
Additionally, this server enforces strict input validation (limit caps, direction validation, label name format checks, mutually exclusive auth) to surface errors early instead of forwarding bad requests to Loki.
Features
- query_range — Execute LogQL range queries to fetch logs over a time window
- query — Execute LogQL instant queries for point-in-time evaluation
- labels — List all available label names
- label_values — List values for a specific label
- series — Find active log stream series matching a selector
Installation
Homebrew
brew install incu6us/tap/loki-mcp-server
Go install
go install github.com/incu6us/loki-mcp-server/cmd/loki-mcp-server@latest
Or build from source:
git clone https://github.com/incu6us/loki-mcp-server.git
cd loki-mcp
go build -o loki-mcp-server ./cmd/loki-mcp-server
Configuration
The server is configured entirely via environment variables, injected by the MCP client.
| Variable | Required | Default | Description |
|---|---|---|---|
LOKI_URL |
yes | — | Base URL of the Loki instance |
LOKI_USERNAME |
no | — | Basic auth username |
LOKI_PASSWORD |
no | — | Basic auth password |
LOKI_BEARER_TOKEN |
no | — | Bearer token authentication |
LOKI_TLS_SKIP_VERIFY |
no | false |
Skip TLS certificate verification |
LOKI_TENANT_ID |
no | — | X-Scope-OrgID header for multi-tenant deployments |
LOKI_HTTP_TIMEOUT |
no | 30s |
HTTP request timeout (Go duration, e.g. 10s, 1m) |
Note: Basic auth (
LOKI_USERNAME/LOKI_PASSWORD) and bearer token (LOKI_BEARER_TOKEN) are mutually exclusive.
Usage with Claude Code
Add to your Claude Code MCP configuration (~/.claude.json):
{
"mcpServers": {
"loki-mcp-server": {
"type": "stdio",
"command": "/path/to/loki-mcp-server",
"args": [],
"env": {
"LOKI_URL": "http://loki:3100",
"LOKI_USERNAME": "admin",
"LOKI_PASSWORD": "secret"
}
}
}
}
Usage with Claude Desktop
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"loki-mcp-server": {
"type": "stdio",
"command": "/path/to/loki-mcp-server",
"args": [],
"env": {
"LOKI_URL": "http://loki:3100",
"LOKI_USERNAME": "admin",
"LOKI_PASSWORD": "secret"
}
}
}
}
Tools
query_range
Execute a LogQL range query against Loki to fetch logs over a time window.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
query |
string | yes | — | LogQL query expression |
start |
string | no | 1 hour ago | Start of time range (RFC3339 or Unix nano) |
end |
string | no | now | End of time range |
limit |
number | no | 100 | Max entries (max 5000) |
direction |
string | no | backward | forward or backward |
query
Execute a LogQL instant query for point-in-time evaluation.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
query |
string | yes | — | LogQL query expression |
limit |
number | no | 100 | Max entries (max 5000) |
time |
string | no | now | Evaluation timestamp |
direction |
string | no | backward | forward or backward |
labels
List all available label names in Loki.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
start |
string | no | 6 hours ago | Start of time range |
end |
string | no | now | End of time range |
label_values
List values for a specific label.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
label |
string | yes | — | Label name |
start |
string | no | 6 hours ago | Start of time range |
end |
string | no | now | End of time range |
series
Find active log stream series matching a selector.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
match |
string | yes | — | Stream selector (e.g. {app="nginx"}) |
start |
string | no | 6 hours ago | Start of time range |
end |
string | no | now | End of time range |
Local Development Stack
A Docker Compose setup is included under deploy/ to spin up a full Loki environment for testing:
- Loki — log storage at
http://localhost:3100 - Grafana — UI at
http://localhost:3000(anonymous admin, Loki pre-configured as datasource) - Promtail — collects container logs and ships them to Loki
- Log generator — emits structured JSON logs with randomized apps (
nginx,api,gateway,auth,payments), levels, and messages
# Start the stack
docker compose -f deploy/docker-compose.yml up -d
# Use loki-mcp-server against local Loki
LOKI_URL=http://localhost:3100 loki-mcp-server
# Stop the stack
docker compose -f deploy/docker-compose.yml down
Development
# Run tests
go test ./...
# Build
go build -o loki-mcp-server ./cmd/loki-mcp-server
# Vet
go vet ./...
⭐ If this project is useful for you, please star the repository.