MCP server

Give an AI agent scoped access to your datasets, schema and query language.

Logstreem ships a Model Context Protocol server. Point an MCP-capable agent at it and it can list datasets, read their fields and run LSQL — inside the scopes of the token you give it, and no further.

claude mcp add logstreem \
  --env LOGSTREEM_TOKEN=lstrm_live_9f2c… \
  -- npx -y @logstreem/mcp

Tools it exposes

Tool	Does
`list_datasets`	Names, event counts, retention
`describe_dataset`	Every field and its type — so the agent writes valid LSQL
`run_query`	Executes LSQL and returns rows, subject to a cost limit
`tail`	A bounded live tail, capped at 200 events
`list_monitors`	Alerting rules and their current state
`get_lsql_reference`	The language reference, so the agent does not guess syntax

Scoping it

Issue a dedicated token with query only. Never give an agent ingest or admin.
Set LOGSTREEM_DATASETS to an explicit allowlist. The server refuses anything outside it.
Set LOGSTREEM_MCP_COST_LIMIT to cap rows scanned per query. Default 500 million.
Scope to a view when the dataset contains anything you would not paste into a chat.

Query access is read access to your logs

An agent with query can read everything in the datasets you allow — including anything that was logged by accident. Scope to a redacted view rather than trusting that nothing sensitive was ever logged.

Why it works well here

describe_dataset returns real field names and types, so the agent writes queries against what exists rather than what it guessed. Combined with a cost limit, that makes "why did checkout get slow at 09:40" a question an agent can actually work on.

PreviousResidency and redaction