Remote (Cloud)
Connect via URL — no installation needed
Local (npm)
Install locally via
npx logclaw-mcp-serverRemote (Cloud)
Connect directly via URL — no installation required. LogClaw’s remote MCP server uses OAuth 2.1 and Streamable HTTP transport.When you connect, you’ll be prompted to enter your LogClaw API key. The key is encrypted and never exposed to the MCP client.
Claude Desktop / Claude.ai
Add LogClaw as a remote MCP server:- Open Settings → MCP Servers → Add Server
- Enter the URL:
https://mcp.logclaw.ai - Complete the OAuth flow by entering your API key
Any MCP Client (URL-based)
For any MCP client that supports remote servers, use:| Setting | Value |
|---|---|
| Server URL | https://mcp.logclaw.ai |
| Transport | Streamable HTTP |
| Auth | OAuth 2.1 (automatic) |
Local (npm)
Install and run the MCP server locally via stdio transport:Setup
Environment Variables
| Variable | Required | Description |
|---|---|---|
LOGCLAW_API_KEY | Yes | Your LogClaw project API key (starts with lc_proj_) |
LOGCLAW_ENDPOINT | No | Auth proxy endpoint (default: https://ticket.logclaw.ai) |
Available Tools
The MCP server exposes 8 tools that your AI assistant can call:| Tool | Description |
|---|---|
logclaw_list_incidents | List and filter incidents by severity, state, service, or search query |
logclaw_get_incident | Full incident details — root cause, causal chain, evidence logs, traces, timeline, blast radius |
logclaw_update_incident | Transition incident state (acknowledge, investigate, mitigate, resolve) or add a note |
logclaw_search_logs | Search raw logs by service, level, time range, and query |
logclaw_get_anomalies | Get recent anomaly detections (Z-score analysis on error rates) |
logclaw_service_health | Check LogClaw pipeline health status and latency |
logclaw_bulk_update | Update multiple incidents at once (acknowledge, investigate, mitigate, or resolve) |
logclaw_export_incidents | Export incidents in CSV, markdown table, or JSON format |
Example Prompts
Once connected, try asking your AI assistant:Triage incidents
“What incidents are open right now?”
Root cause analysis
“Show me the root cause for TICK-0037”
Search logs
“Search for ERROR logs from auth-service in the last 30 minutes”
Query anomalies
“Are there any critical anomalies?”
Update incidents
“Acknowledge TICK-0042 and add a note that I’m looking into it”
Health check
“Is the LogClaw pipeline healthy?”
Bulk update
“Acknowledge TICK-0037, TICK-0038, and TICK-0039”
Export incidents
“Export all critical incidents as a markdown table”
Self-Hosted
Running LogClaw on your own infrastructure? PointLOGCLAW_ENDPOINT to your auth proxy: