# logmcp

Hands an AI assistant read-only access to logs on a remote Linux box. Useful when you want help diagnosing a problem but not a shell.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 5
- Author: kascada
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/kascada/logmcp
- Updated: 2026-08-25
- HTML: https://affpapa.org/en/nevibecode/mcp/logmcp

## What it does

logmcp runs an MCP server on the machine and serves log files to the assistant over HTTPS. Only paths on the whitelist are visible, and nothing can be edited, deleted or executed. Every access lands in syslog; log contents do not.

For a quick look there is `logmcp quickstart`. It checks your `adm` and `systemd-journal` group memberships, creates a bearer token and a self-signed certificate, starts the server and prints a `claude mcp add` line you can paste. Both the token and the certificate are throwaway, and the token is regenerated on each start. A lasting setup goes through `go install github.com/kascada/logmcp@latest` or the `.deb` package, then `sudo logmcp setup` walks you through TLS mode, the token and a systemd unit. Settings live in `/etc/logmcp/config.yaml`, where values accept `${VAR}` environment substitution; an unset variable expands to an empty string.

Beyond plain files, systemd journal is exposed as the virtual source `journald://`. You can keep several bearer tokens and revoke them, hand token verification to an external program, or sit behind Caddy. Extensions publish CLI tools or Redis-RPC workers as extra MCP tools, and macros define composite tools in YAML without writing code. If your client runs locally with an SSH key, an SSH tunnel replaces the public HTTPS endpoint.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- trace a production crash from the log files
- read journald without granting shell access
- grep a log by regexp with surrounding context
- give a contractor read-only log access
- check server config and environment before digging into an incident

## Example prompts
- Show the last 200 lines of `/var/log/nginx/error.log` and explain what is failing
- Search `journald://` for entries about the crashed service in the past hour
- Run the environment check and tell me whether the server is configured correctly

## Similar
- [SentinelX MCP](https://affpapa.org/en/nevibecode/mcp/sentinelx-mcp.md) — MCP server · ★ 15
- [anonymize-logs](https://affpapa.org/en/nevibecode/skills/anonymize-logs.md) — skill · 510 installs
- [systemd-services](https://affpapa.org/en/nevibecode/skills/systemd-services.md) — skill · 504 installs
- [ssh-configuration](https://affpapa.org/en/nevibecode/skills/ssh-configuration.md) — skill · 451 installs
- [emisar](https://affpapa.org/en/nevibecode/mcp/emisar.md) — MCP server · ★ 330
- [troubleshooting-astro-deployments](https://affpapa.org/en/nevibecode/skills/troubleshooting-astro-deployments.md) — skill · 622 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md