{"id":26806346,"url":"https://github.com/last9/last9-mcp-server","last_synced_at":"2026-08-27T15:56:34.932Z","repository":{"id":284877253,"uuid":"956279002","full_name":"last9/last9-mcp-server","owner":"last9","description":"Last9 MCP Server","archived":false,"fork":false,"pushed_at":"2026-08-27T12:47:06.000Z","size":10369,"stargazers_count":59,"open_issues_count":13,"forks_count":12,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-08-27T14:10:01.011Z","etag":null,"topics":["ai","ai-agents","claude","cursor","mcp","monitoring","observability","vibe-coding"],"latest_commit_sha":null,"homepage":"https://last9.io/mcp","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/last9.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2025-03-28T01:46:45.000Z","updated_at":"2026-08-27T12:51:38.000Z","dependencies_parsed_at":"2026-08-27T14:14:45.508Z","dependency_job_id":null,"html_url":"https://github.com/last9/last9-mcp-server","commit_stats":null,"previous_names":["last9/last9-mcp-server"],"tags_count":40,"template":false,"template_full_name":null,"purl":"pkg:github/last9/last9-mcp-server","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last9%2Flast9-mcp-server","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last9%2Flast9-mcp-server/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last9%2Flast9-mcp-server/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last9%2Flast9-mcp-server/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/last9","download_url":"https://codeload.github.com/last9/last9-mcp-server/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last9%2Flast9-mcp-server/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36944063,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-27T02:00:07.166Z","response_time":96,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","ai-agents","claude","cursor","mcp","monitoring","observability","vibe-coding"],"created_at":"2025-03-29T23:31:09.790Z","updated_at":"2026-08-27T15:56:34.922Z","avatar_url":"https://github.com/last9.png","language":"Go","funding_links":[],"categories":["Monitoring \u0026 Observability","Monitoring","📊 Monitoring","サーバー実装","Official Servers","Monitoring and Logging","📊 Monitoring \u0026 Observability","Table of Contents","Security \u0026 Auth","Server Implementations"],"sub_categories":["Video","🔍 Application Performance Monitoring","📊 \u003ca name=\"monitoring\"\u003e\u003c/a\u003e監視","How to Submit","Developer Tools","📊 \u003ca name=\"monitoring\"\u003e\u003c/a\u003eMonitoring"],"readme":"# Last9 MCP Server\n\n![last9 mcp demo](mcp-demo.gif)\n\nYour AI agent doesn't know what's broken in production. This fixes that.\n\n[Last9 MCP Server](https://last9.io/mcp/) connects Claude, Cursor, Windsurf, and any other MCP-capable AI assistant directly to your production observability data — logs, metrics, traces, exceptions, database queries, alerts, and deployments. The agent stops guessing and starts reading the actual signal.\n\n- [Watch the demo](https://www.youtube.com/watch?v=AQH5xq6qzjI)\n- [Announcement post](https://last9.io/blog/launching-last9-mcp-server/)\n\n---\n\n## Start in 30 seconds (Hosted)\n\nNo binary to install. No tokens to manage. One URL, OAuth in your browser, done.\n\nFind your org slug in your Last9 URL: `app.last9.io/\u003corg_slug\u003e/...`\n\n### Claude Code\n\n```bash\nclaude mcp add --transport http last9 https://app.last9.io/api/v4/organizations/\u003corg_slug\u003e/mcp\n```\n\nType `/mcp`, select last9, authenticate. That's it.\n\n### Cursor\n\n**Settings \u003e MCP \u003e Add New MCP Server:**\n\n```json\n{\n  \"mcpServers\": {\n    \"last9\": {\n      \"type\": \"http\",\n      \"url\": \"https://app.last9.io/api/v4/organizations/\u003corg_slug\u003e/mcp\"\n    }\n  }\n}\n```\n\nClick **Connect**, complete OAuth.\n\n### VS Code\n\nRequires v1.99+. Open Command Palette → **MCP: Add Server**, paste the URL, authenticate.\n\nOr directly in `settings.json`:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"last9\": {\n        \"type\": \"http\",\n        \"url\": \"https://app.last9.io/api/v4/organizations/\u003corg_slug\u003e/mcp\"\n      }\n    }\n  }\n}\n```\n\n### Windsurf\n\n**Settings \u003e Cascade \u003e Open MCP Marketplace \u003e gear icon (`mcp_config.json`):**\n\n```json\n{\n  \"mcpServers\": {\n    \"last9\": {\n      \"serverUrl\": \"https://app.last9.io/api/v4/organizations/\u003corg_slug\u003e/mcp\"\n    }\n  }\n}\n```\n\n### Claude Web/Desktop\n\n**Settings \u003e Connectors \u003e Add custom connector.** Name it `last9`, paste the URL, authenticate.\n\n\u003e Requires admin access to your Claude organization.\n\n---\n\n## Self-Hosted (STDIO)\n\nUse this when your MCP client doesn't support HTTP transport, or when you need the server running locally.\n\n### Install\n\n**Homebrew:**\n\n```bash\nbrew install last9/tap/last9-mcp\n```\n\n**NPM:**\n\n```bash\nnpm install -g @last9/mcp-server@latest\n# or directly:\nnpx -y @last9/mcp-server@latest\n```\n\n**Binary releases** (Windows / manual):\n\nDownload from [GitHub Releases](https://github.com/last9/last9-mcp-server/releases/latest):\n\n| Platform        | Archive                                 |\n| --------------- | --------------------------------------- |\n| Windows (x64)   | `last9-mcp-server_Windows_x86_64.zip`   |\n| Windows (ARM64) | `last9-mcp-server_Windows_arm64.zip`    |\n| Linux (x64)     | `last9-mcp-server_Linux_x86_64.tar.gz`  |\n| Linux (ARM64)   | `last9-mcp-server_Linux_arm64.tar.gz`   |\n| macOS (x64)     | `last9-mcp-server_Darwin_x86_64.tar.gz` |\n| macOS (ARM64)   | `last9-mcp-server_Darwin_arm64.tar.gz`  |\n\n### Get a Refresh Token\n\nOnly **admins** can create tokens.\n\n1. Go to [API Access](https://app.last9.io/settings/api-access)\n2. Click **Generate Token** with Write permissions\n3. Copy it\n\n### Client Configuration\n\n**Homebrew:**\n\n```json\n{\n  \"mcpServers\": {\n    \"last9\": {\n      \"command\": \"/opt/homebrew/bin/last9-mcp\",\n      \"env\": {\n        \"LAST9_REFRESH_TOKEN\": \"\u003cyour_refresh_token\u003e\"\n      }\n    }\n  }\n}\n```\n\n**NPM:**\n\n```json\n{\n  \"mcpServers\": {\n    \"last9\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@last9/mcp-server@latest\"],\n      \"env\": {\n        \"LAST9_REFRESH_TOKEN\": \"\u003cyour_refresh_token\u003e\"\n      }\n    }\n  }\n}\n```\n\n**Where to paste this:**\n\n| Client             | Location                                                                                                                                |\n| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |\n| Claude Web/Desktop | Settings \u003e Developer \u003e Edit Config (`claude_desktop_config.json`)                                                                       |\n| Cursor             | Settings \u003e Cursor Settings \u003e MCP \u003e Add New Global MCP Server                                                                            |\n| Windsurf           | Settings \u003e Cascade \u003e MCP Marketplace \u003e gear icon (`mcp_config.json`)                                                                    |\n| VS Code            | Wrap in `{ \"mcp\": { \"servers\": { ... } } }` in `settings.json` — [details](https://code.visualstudio.com/docs/copilot/chat/mcp-servers) |\n\n\u003cdetails\u003e\n\u003csummary\u003eVS Code STDIO config\u003c/summary\u003e\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"last9\": {\n        \"type\": \"stdio\",\n        \"command\": \"/opt/homebrew/bin/last9-mcp\",\n        \"env\": {\n          \"LAST9_REFRESH_TOKEN\": \"\u003cyour_refresh_token\u003e\"\n        }\n      }\n    }\n  }\n}\n```\n\nFor NPM: use `\"command\": \"npx\"` and add `\"args\": [\"-y\", \"@last9/mcp-server@latest\"]`.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eWindows\u003c/summary\u003e\n\nAfter downloading from [GitHub Releases](https://github.com/last9/last9-mcp-server/releases/latest), extract and point to the full path:\n\n```json\n{\n  \"mcpServers\": {\n    \"last9\": {\n      \"command\": \"C:\\\\Users\\\\\u003cuser\u003e\\\\AppData\\\\Local\\\\Programs\\\\last9-mcp-server.exe\",\n      \"env\": {\n        \"LAST9_REFRESH_TOKEN\": \"\u003cyour_refresh_token\u003e\"\n      }\n    }\n  }\n}\n```\n\nThe NPM route is easier on Windows — no path management.\n\n\u003c/details\u003e\n\n### Environment Variables\n\n| Variable                     | Default              | Description |\n| ---------------------------- | -------------------- | ----------- |\n| `LAST9_REFRESH_TOKEN`        | *(required)*         | Refresh token from [API Access](https://app.last9.io/settings/api-access) |\n| `LAST9_DATASOURCE`           | org default          | Datasource/cluster name — useful when you have multiple Levitate clusters |\n| `LAST9_API_HOST`             | `app.last9.io`       | Override the API host |\n| `LAST9_TOOLSETS`             | all tools            | Comma-separated toolsets to expose (`logs`, `traces`, `metrics`, `alerts`, `dashboards`, `investigate`, `all`). Alias: `LAST9_MCP_TOOLSETS` |\n| `LAST9_MAX_GET_LOGS_ENTRIES` | `5000`               | Max entries for chunked `get_logs` requests |\n| `LAST9_USE_LOG_SEARCH_API`   | `false`              | Set `true` to answer `get_logs` and `get_service_logs` with one server-side search call instead of client-side chunking |\n| `LAST9_DEBUG_CHUNKING`       | `false`              | Set `true` to log chunk-planning details for `get_logs`, `get_service_logs`, `get_traces` |\n| `LAST9_DISABLE_TELEMETRY`    | `true`               | Set `false` to enable internal OTel tracing |\n| `OTEL_SDK_DISABLED`          | —                    | Standard OTel env var. Overrides `LAST9_DISABLE_TELEMETRY` |\n| `OTEL_EXPORTER_OTLP_ENDPOINT`| —                    | OTLP collector endpoint (only when telemetry is enabled) |\n| `OTEL_EXPORTER_OTLP_HEADERS` | —                    | OTLP auth headers (only when telemetry is enabled) |\n\n---\n\n## What It Can Do\n\n### Service Health\n\n- **`get_service_summary`** — Ranked fleet `(service, env)` rows: interval request_count, throughput_rpm, HTTP 4xx/5xx counts, and gRPC error counts\n- **`get_service_environments`** — Available environments for your services. Run this first — other APM tools need `env` from here\n- **`get_service_performance_details`** — Full breakdown: throughput, error rate, p50/p90/p95/avg/max, apdex, availability\n- **`get_service_operations_summary`** — Operations grouped by HTTP endpoints, DB calls, messaging, HTTP clients\n- **`get_service_dependency_graph`** — Dependency map with throughput, latency, and error rates for upstream/downstream/infra\n- **`get_apm_service_deviations`** — Compare a current window against an equal-duration baseline: regressions/improvements, Apdex reconciliation, and a terminal outcome (fleet or single service)\n- **`get_exceptions`** — Server-side exceptions with service and span filters\n\n### Database Observability\n\nFour tools that go directly at your database performance, derived from OpenTelemetry trace spans. No extra instrumentation needed if you're already using OTel.\n\n- **`get_databases`** — Discover all databases across your infrastructure: DB type, host, throughput (queries/min), p95 latency, error rate, number of dependent services\n- **`get_database_slow_queries`** — The actual slowest query executions, ordered by duration, with trace IDs for drilling into full traces\n- **`get_database_queries`** — Query patterns and aggregates: how often a query runs, average/p95 duration, error rate\n- **`get_database_server_metrics`** — Server-side metrics from the DB host itself (CPU, connections, buffer hit rates — depends on your DB system)\n\nSupports PostgreSQL, MySQL, MongoDB, Redis, Aerospike, and anything else OTel traces with a `db_system` attribute.\n\n### Prometheus / PromQL\n\n- **`prometheus_range_query`** — PromQL range queries over any metric\n- **`prometheus_instant_query`** — Instant queries; use rollup functions like `avg_over_time`, `sum_over_time`\n- **`prometheus_label_values`** — Label values for a given series\n- **`prometheus_labels`** — All labels available for a series\n\nPoint these at a different datasource/cluster than the default by setting `LAST9_DATASOURCE`.\n\n### Logs\n\n- **`get_logs`** — Full JSON pipeline log queries (aggregations, filters, field extraction)\n- **`get_service_logs`** — Raw log lines for a service, filterable by severity and body content\n- **`get_log_attributes`** — Global catalog of attributes in the log schema for a time window\n- **`get_log_attributes_for_pipeline`** — Log fields actually present for an in-progress pipeline (scoped discovery), each with its exact `filter_field`\n- **`get_drop_rules`** — Log drop rules from [Last9 Control Plane](https://last9.io/control-plane)\n- **`add_drop_rule`** — Create a new drop rule to cut log volume at the source\n\n### Traces\n\n- **`get_traces`** — JSON pipeline trace queries for broad searches and aggregations\n- **`get_service_traces`** — Traces by exact trace ID or service name. Use this when you have a trace ID — it's faster\n- **`get_trace_attributes`** — Global catalog of attributes in the trace schema\n- **`get_trace_attributes_for_pipeline`** — Attributes actually present for an in-progress pipeline (scoped discovery), each with its exact `filter_field`\n- **`get_trace_attribute_values`** — Distinct values for a trace attribute, optionally scoped to a pipeline\n- **`get_trace_attribute_deviations`** — Ranks attribute values that differ between two bounded span cohorts (slow vs fast, error vs non-error, or two time windows). Correlation, not cause\n- **`get_trace_waterfall`** — One exact trace as a parent/child waterfall with interval-union self-time, slowest spans, and graph warnings\n\n### Change Events \u0026 Alerts\n\n- **`get_change_events`** — Deployments, config changes, rollbacks. Correlate incidents with what changed\n- **`get_alert_config`** — Alert rule configurations — searchable by name, severity, type, tags\n- **`get_alerts`** — Currently firing alerts within a time window\n- **`get_alert_rule_state`** — Historical firing state (1/0) per alert rule over a time range, grouped by `rule_id`. Filterable by alert group, rule name, label filters, and state.\n- **`get_notification_channels`** — Configured notification channels (Slack, PagerDuty, email, etc.)\n\n### Custom Dashboards\n\n- **`list_dashboards`** — All custom dashboards in your org: IDs, names, and metadata\n- **`get_dashboard`** — Full dashboard definition by ID, including panels and queries\n- **`create_dashboard`** — Create a new custom dashboard with panels, queries, and metadata\n- **`update_dashboard`** — Update an existing dashboard by ID (readonly system dashboards return an error)\n- **`delete_dashboard`** — Delete a custom dashboard by ID\n- **`list_dashboard_snapshots`** — Frozen point-in-time snapshots for a dashboard (metadata only)\n- **`get_dashboard_snapshot`** — Full frozen snapshot including panel data for RCA / shareable views\n- **`delete_dashboard_snapshot`** — Delete a frozen snapshot by ID\n\n### Fuzzy Name Resolution\n\n- **`did_you_mean`** — When the agent isn't sure about an entity name, this returns the closest matches from your catalog (services, environments, hosts, databases, K8s deployments/namespaces, jobs). Up to 3 suggestions with similarity scores. The server calls this automatically before most tools when a name lookup returns empty.\n\n### Service Profile\n\n- **`get_service_profile`** — What a service's telemetry actually looks like, before you query it: which signals exist, language and runtime, deployment environments, the shape of its logs, and a recommended ingest fix where one applies. Lets the agent skip trace tools when a service has no traces, and parse severity from the log body when `SeverityText` is empty instead of filtering on it and finding nothing.\n\n---\n\n## How It Works\n\n**Deep links on every response.** Every tool returns a `deep_link` field — a direct URL into the Last9 dashboard for that exact query and time range. The agent can hand you the link; you click it; you're there.\n\n**Toolsets.** By default the server exposes every tool. Automation hosts that only need investigation (logs/traces/metrics) can set `LAST9_TOOLSETS=investigate` (or pass `--toolsets=investigate`) so `tools/list` stays small without client-side mass-disable. Named packs: `logs`, `traces`, `metrics`, `alerts`, `dashboards`, `investigate`, `all`. Unknown names fail fast. The `metrics` pack alone does **not** include `list_datasources` or `did_you_mean` — use `investigate` (or combine toolsets) when you need those discovery helpers.\n\n**Tool reference resources.** Long logjson/tracejson/service-logs/metrics manuals are MCP resources (`last9://reference/logjson`, `last9://reference/tracejson`, `last9://reference/service_logs`, `last9://reference/metrics`), not always-on tool description text. Critical query rules stay on the tool description so agents that never call `resources/read` still get correct construction guidance. Discover org-specific fields with `get_log_attributes` / `get_log_attributes_for_pipeline` (and the trace equivalents)—they are not injected into descriptions.\n\n**Chunked large results.** `get_logs` and `get_traces` handle large result sets through chunking rather than truncating. The default limit is 5000 entries for logs; configurable via `LAST9_MAX_GET_LOGS_ENTRIES`.\n\n---\n\n## Development\n\n\u003cdetails\u003e\n\u003csummary\u003eHTTP mode, curl testing, building from source\u003c/summary\u003e\n\n### Run in HTTP Mode\n\n```bash\nexport LAST9_REFRESH_TOKEN=\"your_refresh_token\"\nexport LAST9_HTTP=true\nexport LAST9_PORT=8080\n./last9-mcp-server\n```\n\nServer starts at `http://localhost:8080/mcp`.\n\n### Test with curl\n\nThe Streamable HTTP handler runs in **stateless** mode, so any request is served independently. An `initialize` handshake and an `Mcp-Session-Id` header are optional — clients that send them still work (the header is accepted and ignored), and clients can also skip straight to `tools/list` / `tools/call`. Every tool is an independent request/response query; the server issues no server→client notifications, so `GET /mcp` (the SSE stream) returns `405`.\n\n```bash\n# List tools — a session handshake is optional in stateless mode\ncurl -s -X POST http://localhost:8080/mcp \\\n    -H \"Content-Type: application/json\" \\\n    -H \"Accept: application/json, text/event-stream\" \\\n    -d '{\"jsonrpc\": \"2.0\", \"id\": 1, \"method\": \"tools/list\", \"params\": {}}'\n\n# Call a tool\ncurl -s -X POST http://localhost:8080/mcp \\\n    -H \"Content-Type: application/json\" \\\n    -H \"Accept: application/json, text/event-stream\" \\\n    -d '{\n      \"jsonrpc\": \"2.0\",\n      \"id\": 2,\n      \"method\": \"tools/call\",\n      \"params\": {\n        \"name\": \"get_service_logs\",\n        \"arguments\": {\n          \"service_name\": \"your-service-name\",\n          \"lookback_minutes\": 30,\n          \"limit\": 10\n        }\n      }\n    }'\n```\n\n### Build from Source\n\n```bash\ngit clone https://github.com/last9/last9-mcp-server.git\ncd last9-mcp-server\ngo build -o last9-mcp-server\nLAST9_HTTP=true ./last9-mcp-server\n```\n\n`LAST9_HTTP=true` is for local development. For actual usage, the [hosted HTTP endpoint](#start-in-30-seconds-hosted) is easier.\n\n\u003c/details\u003e\n\n---\n\n## Tool Reference\n\n\u003cdetails\u003e\n\u003csummary\u003eAll parameters, time input standards, and details\u003c/summary\u003e\n\n### Time Input\n\n- Absolute times (`start_time_iso`/`end_time_iso`, or `time_iso`) take precedence over `lookback_minutes`.\n- For relative windows: use `lookback_minutes`.\n- For absolute windows: use RFC3339/ISO8601 — `2026-02-09T15:04:05Z`.\n- Legacy `YYYY-MM-DD HH:MM:SS` is accepted for compatibility only.\n\n### get_exceptions\n\n- `limit` (integer, optional): Max exceptions. Default: 20.\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional): Absolute time range.\n- `service_name` (string, optional): Filter by service.\n- `span_name` (string, optional): Filter by span name.\n- `env` (string, optional): Filter by environment.\n\n### get_service_summary\n\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `env` (string, optional): PromQL regex. Defaults to `.*`. Exact match needs anchors (e.g. `^prod$`).\n- `sort_by` (string, optional): `request_count` (default), `throughput_rpm`, `http_4xx_count`, `http_5xx_count`, or `grpc_error_count`.\n- `limit` (integer, optional): Max ranked rows. Omit or 0 means 10; values above 100 clamp to 100.\n\n### get_service_environments\n\n- `start_time_iso` / `end_time_iso` (string, optional)\n\n\u003e All other APM tools require an `env` value. Use `\"\"` if this returns empty.\n\n### get_service_performance_details\n\n- `service_name` (string, required)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `env` (string, optional): Defaults to `prod`.\n\n### get_service_operations_summary\n\n- `service_name` (string, required)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `env` (string, optional): Defaults to `prod`.\n\n### get_service_dependency_graph\n\n- `service_name` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `env` (string, optional): Defaults to `prod`.\n\n### get_apm_service_deviations\n\n- `service_name` (string, optional): Omit for fleet scope; provide for one service and its operation correlations.\n- `lookback_minutes` (integer, optional): Current window. Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional): Explicit current window.\n- `baseline_start_time_iso` / `baseline_end_time_iso` (string, optional): Explicit baseline. Defaults to the immediately preceding equal-duration window.\n- `datasource` (string, optional): Restrict the comparison to one datasource.\n- `env` (string, optional): Defaults to `prod`.\n- `max_services` / `max_operations` (integer, optional): Default 10, max 10 each.\n\n### get_databases\n\n- `env` (string, optional): Filter by environment. Default: all.\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n\n### get_database_slow_queries\n\n- `db_system` (string, optional): e.g. `postgresql`, `mysql`, `mongodb`, `redis`.\n- `host` (string, optional): Database host (`net_peer_name`).\n- `service_name` (string, optional): Calling service name.\n- `env` (string, optional)\n- `min_duration_ms` (float, optional): Minimum query duration in ms.\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `limit` (integer, optional): Default: 20.\n\n### get_database_queries\n\n- `db_system` (string, optional)\n- `host` (string, optional)\n- `service_name` (string, optional)\n- `env` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `limit` (integer, optional): Default: 20.\n\n### get_database_server_metrics\n\n- `db_system` (string, required): e.g. `postgresql`, `mysql`, `mongodb`, `redis`, `aerospike`.\n- `host` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `start_time_iso` / `end_time_iso` (string, optional)\n\n### prometheus_range_query\n\n- `query` (string, required): The PromQL query.\n- `start_time_iso` / `end_time_iso` (string, optional): Defaults to last 60 min.\n- `lookback_minutes` (float, optional): Default: 60.\n\n### prometheus_instant_query\n\n- `query` (string, required)\n- `time_iso` (string, optional): Defaults to now.\n- `lookback_minutes` (float, optional)\n\n### prometheus_label_values\n\n- `match_query` (string, optional): PromQL filter.\n- `label` (string, required): Label name.\n- `start_time_iso` / `end_time_iso` (string, optional)\n\n### prometheus_labels\n\n- `match_query` (string, optional): PromQL filter.\n- `start_time_iso` / `end_time_iso` (string, optional)\n\n### get_logs\n\n- `logjson_query` (array, required): JSON pipeline query.\n- `lookback_minutes` (integer, optional): Default: 5.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `limit` (integer, optional): Server default: 5000.\n- `index` (string, optional): `physical_index:\u003cname\u003e` or `rehydration_index:\u003cblock_name\u003e`.\n\nFor log-based service inventory, query `physical_index_service_count` first:\n\n```promql\nsum by (name, service_name, env) (physical_index_service_count{destination=\"logs\"})\n```\n\nUse `service_name` as `ServiceName`, `env` as the environment when present, and `name` as the physical index name. If `name=\"default\"`, omit `index`; for a non-default physical index selected by the user, pass `index: \"physical_index:\u003cname\u003e\"`. If the backend rejects explicit physical index filtering, retry without `index` and report that explicit physical index filtering is unavailable for that backend.\n\n### get_service_logs\n\n- `service_name` (string, required)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `limit` (integer, optional): Default: 20.\n- `env` (string, optional)\n- `severity_filters` (array, optional): e.g. `[\"error\", \"warn\"]`. OR logic.\n- `body_filters` (array, optional): e.g. `[\"timeout\", \"failed\"]`. OR logic.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `index` (string, optional)\n\nMultiple filter types combine with AND. Each array uses OR internally.\nUse `get_logs` for broad aggregate counts first; use `get_service_logs` only after narrowing to a service/env/index and a small sample set.\n\n### get_log_attributes\n\n- `lookback_minutes` (integer, optional): Default: 15.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `region` (string, optional)\n- `index` (string, optional)\n\n### get_log_attributes_for_pipeline\n\n- `pipeline` (array, required): Prior filter stages to scope discovery, e.g. `[{\"type\":\"filter\",\"query\":{\"$eq\":[\"ServiceName\",\"\u003cservice\u003e\"]}}]`.\n- `lookback_minutes` (integer, optional): Default: 15.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `region` (string, optional)\n- `index` (string, optional)\n\n### get_drop_rules\n\nNo parameters. Lists drop rules via `GET /otel_settings/drop?region=...`.\n\n### add_drop_rule\n\n- `name` (string, required)\n- `filters` (array, required): Each filter: `key`, `value`, `operator` (`equals`/`not_equals`), `conjunction` (`and`).\n- Filter keys must use `attributes[\"key_name\"]` or `resource.attributes[\"key_name\"]` (required by the Last9 API).\n- Creates the rule via `POST /otel_settings/drop?region=...\u0026cluster_id=...`.\n\n### get_traces\n\nUse for broad searches and aggregations. For exact trace ID lookup, use `get_service_traces`.\n\n- `tracejson_query` (array, required)\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `limit` (integer, optional): Default: 5000.\n\n### get_service_traces\n\nExactly one of `trace_id` or `service_name` is required.\n\n- `trace_id` (string, optional): Default lookback: 72 hours.\n- `service_name` (string, optional): Default lookback: 60 min.\n- `lookback_minutes` (integer, optional)\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `limit` (integer, optional): Default: 10.\n- `env` (string, optional)\n\n### get_trace_attributes\n\n- `lookback_minutes` (integer, optional): Default: 15.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `region` (string, optional)\n\n### get_trace_attributes_for_pipeline\n\n- `pipeline` (array, required): Prior filter stages to scope discovery, e.g. `[{\"type\":\"filter\",\"query\":{\"$eq\":[\"ServiceName\",\"\u003cservice\u003e\"]}}]`.\n- `lookback_minutes` (integer, optional): Default: 15.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `region` (string, optional)\n\n### get_trace_attribute_values\n\n- `tag_name` (string, required): Attribute name from `get_trace_attributes` (e.g. `resource_department` or `attributes['http.method']`).\n- `pipeline` (array, optional): Prior filter stages to scope the values; omit for global values.\n- `region` (string, optional)\n\n### get_trace_attribute_deviations\n\n- `comparison_mode` (string, required): `latency`, `errors`, or `time`.\n- `service_name` (string, required)\n- `environment` (string, required): Exact `deployment.environment` value.\n- `operation` (string, optional)\n- `filters` (array, optional): Trace JSON filter conditions.\n- `candidate_attributes` (array, optional): Maximum 8; omit for bounded discovery.\n- `latency_threshold_ms` (number, optional): Required for `latency` mode; rejected for other modes.\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 15. Maximum: 15.\n- `baseline_start_time_iso` / `baseline_end_time_iso` (string, optional): Required for `time` mode; non-overlapping and equal in duration to the target window.\n- `minimum_cohort_size` (integer, optional): Default: 100. Minimum: 20.\n- `minimum_value_support` (integer, optional): Default: 20. Minimum: 10.\n- `limit` (integer, optional): Default: 10. Maximum: 10.\n\nRequires the companion backend capability to be enabled.\n\n### get_trace_waterfall\n\n- `trace_id` (string, required)\n- `environment` (string, optional)\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 4320 (72 hours).\n- `selected_span_id` (string, optional): Returns attributes, events, and links for that span only.\n- `max_spans` (integer, optional): Default: 500. Maximum: 1000.\n\nReturns an `investigation-evidence/v1` envelope; the waterfall is under `data`.\n\n### get_change_events\n\n- `start_time_iso` / `end_time_iso` (string, optional)\n- `lookback_minutes` (integer, optional): Default: 60.\n- `service_name` (string, optional)\n- `env` (string, optional)\n- `event_name` (string, optional): Call without this first to get `available_event_names`.\n\n### get_alert_config\n\n- `search_term` (string, optional): Free-text search across name, group, data source, tags.\n- `rule_name` (string, optional)\n- `severity` (string, optional)\n- `rule_type` (string, optional): `static` or `anomaly`.\n- `alert_group_name` / `alert_group_type` / `data_source_name` (string, optional)\n- `tags` (array, optional): All must match (AND logic).\n\n### get_alerts\n\n- `time_iso` (string, optional): Evaluation time in RFC3339.\n- `window` (integer, optional): Lookback in seconds. Default: 900. Range: 60–86400.\n- `lookback_minutes` (integer, optional): Range: 1–1440.\n\n### get_alert_rule_state\n\n- `start_time` (integer, required): Unix epoch start of the range (inclusive).\n- `end_time` (integer, required): Unix epoch end of the range (inclusive).\n- `step` (integer, required): Resolution in seconds between samples. The number of samples `((end_time - start_time) / step + 1)` is capped at 100.\n- `alert_group_id` (string, optional): Filter by alert group ID.\n- `rule_name` (string, optional): Regex filter on rule name.\n- `alert_group_name` (string, optional): Regex filter on alert group name.\n- `label_filters` (string, optional): Comma-separated `key=value` label filters.\n- `state` (string, optional): Filter by state (e.g. `firing`).\n\nReturns a JSON map of `rule_id -\u003e [{timestamp, is_firing}]`. A timestamp at which a rule is absent from the upstream response is reported as `is_firing=0` — this means \"not observed as firing\", not a confirmed normal state.\n\n### get_notification_channels\n\nNo parameters. Returns all configured notification channels (Slack, PagerDuty, email, webhooks, etc.).\n\n### did_you_mean\n\n- `query` (string, required): The name to search for — partial, misspelled, or abbreviated.\n- `type` (string, optional): Restrict to entity type: `service`, `environment`, `host`, `database`, `k8s_deployment`, `k8s_namespace`, `job`.\n\nReturns up to 3 closest matches with similarity scores. Use this before any tool call where the entity name is uncertain. If a previous call returned empty results, try this before retrying.\n\n### get_service_profile\n\n- `service_name` (string, required): Service to derive a telemetry profile for.\n- `datasource` (string, optional): Datasource name. Omit for the default.\n\nReturns a short investigation brief followed by the full profile as raw JSON: signal presence (`logs`/`traces`/`metrics` as `present`, `absent`, or `unknown`), language and runtime, deployment environments, log `signal_shape` (`log_format`, `severity_set`, `level_field`), and a recommended ingest fix where one applies. Derived upstream and cached with a ~15 minute TTL.\n\nCall it before any service-scoped investigation so tool selection matches the service's actual telemetry — skip trace tools when `traces` is `absent`, and when `severity_set` is `none` or `partial` parse severity from `level_field` in the log body rather than using `severity_filters`. `metrics` is always `unknown` and `dependencies` is unpopulated in v1. When `logs` and `traces` are both `absent`, confirm the name with `did_you_mean` before concluding the service is unmonitored.\n\n### list_dashboards\n\nNo parameters. Returns all custom dashboards in the org as a JSON array with `id`, `name`, and metadata.\n\n### get_dashboard\n\n- `id` (string, required): Dashboard UUID.\n- `region` (string, optional): Region for panel query population. Defaults to configured datasource region.\n\n### create_dashboard\n\n- `dashboard` (object, required): Dashboard definition with `name` and `panels[]`. Each panel requires `name`, `version`, `layout` (`x`, `y`, `w`, `h`), `visualization.type`, and `queries[]`.\n- `metadata` (object, optional): Dashboard metadata — `_category` and `_type` fields (e.g. `{\"_category\":\"custom\",\"_type\":\"metrics\"}`).\n\n### update_dashboard\n\n- `id` (string, required): Dashboard UUID to update.\n- `dashboard` (object, required): Full replacement dashboard body (same shape as create).\n- `metadata` (object, optional): Replacement metadata. Readonly system dashboards return a 403 error.\n\n### delete_dashboard\n\n- `id` (string, required): Dashboard UUID to delete. Readonly system dashboards cannot be deleted.\n\n### list_dashboard_snapshots\n\n- `dashboard_id` (string, required): Dashboard UUID whose snapshots to list.\n\nReturns metadata only (`id`, `name`, `expires_at`, etc.). Use `get_dashboard_snapshot` for frozen panel data.\n\n### get_dashboard_snapshot\n\n- `id` (string, required): Snapshot UUID.\n\nReturns the full frozen snapshot including `dashboard_definition`, `panel_data`, `time_range`, and `variables`.\n\n### delete_dashboard_snapshot\n\n- `id` (string, required): Snapshot UUID to delete.\n\n\u003c/details\u003e\n\n---\n\n## Testing\n\nSee [TESTING.md](TESTING.md) for integration test setup and instructions.\n\n---\n\n[![MseeP.ai Security Assessment Badge](https://mseep.net/pr/last9-last9-mcp-server-badge.png)](https://mseep.ai/app/last9-last9-mcp-server)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast9%2Flast9-mcp-server","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flast9%2Flast9-mcp-server","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast9%2Flast9-mcp-server/lists"}