MCP Log Analyzer

A Model Context Protocol (MCP) server for analyzing different types of logs on Windows systems, built with the FastMCP framework.

Features

• Multiple Log Format Support
  • Windows Event Logs (EVT/EVTX)
  • Windows Event Trace Logs (ETL)
  • Structured Logs (JSON, XML)
  • CSV Logs
  • Unstructured Text Logs

• MCP Tools
  • `register_log_source`: Register new log sources
  • `list_log_sources`: View all registered sources
  • `get_log_source`: Get details about a specific source
  • `delete_log_source`: Remove a log source
  • `query_logs`: Query logs with filters and pagination
  • `analyze_logs`: Perform analysis (summary, pattern, anomaly)

• MCP Resources
  • `logs://sources`: View registered log sources
  • `logs://types`: Learn about supported log types
  • `logs://analysis-types`: Understand analysis options
  • `system://windows-event-logs`: Recent Windows System and Application event logs
  • `system://linux-logs`: Linux systemd journal and application logs
  • `system://process-list`: Current processes with PID, CPU, and memory usage
  • `system://netstat`: Network connections and statistics for troubleshooting

• MCP Prompts
  • Log analysis quickstart guide
  • Troubleshooting guide
  • Windows Event Log specific guide

Installation

# Clone the repository
git clone https://github.com/your-username/mcp-log-analyzer.git
cd mcp-log-analyzer

# Install the package
pip install -e .

# For ETL file support (optional)
pip install -e ".[etl]"

# For development dependencies
pip install -e ".[dev]"

Windows Setup

On Windows, the package includes Windows Event Log support via `pywin32`. If you encounter import errors:

# Ensure Windows dependencies are installed
pip install pywin32>=300

# Test the setup
python test_windows_setup.py

# If successful, start the server
python main.py

Note: On first install of `pywin32`, you may need to run the post-install script:

python Scripts/pywin32_postinstall.py -install

Usage

Understanding MCP Servers

MCP (Model Context Protocol) servers don't have traditional web endpoints. They communicate via stdin/stdout with MCP clients (like Claude Code). When you run `python main.py`, the server starts silently and waits for MCP protocol messages.

Testing the Server

# Test that the server is working
python check_server.py

# See usage instructions
python check_server.py --usage

Starting the MCP Server

# Run directly
python main.py

# Or use Claude Code's MCP integration
claude mcp add mcp-log-analyzer python main.py

Using with Claude Code

1. Add the server to Claude Code:

claude mcp add mcp-log-analyzer python /path/to/main.py

2. Use the tools in Claude Code:

3. Access resources:

System Monitoring Resources

These resources provide real-time system information without needing to register log sources:

1. Check System Processes:

2. Windows Event Logs (Windows only):

3. Linux System Logs (Linux only):

4. Network Monitoring (Cross-platform):

Time Format Examples:

• Relative time: `30m` (30 minutes), `2h` (2 hours), `1d` (1 day)
• Absolute time: `2025-01-07 13:00`, `2025-01-07 13:30:15`, `07/01/2025 13:00`

Example Workflow

1. Register a Windows System Log:

Use register_log_source tool with:
   - name: "system-logs"
   - source_type: "evt"
   - path: "System"

2. Query Recent Errors:

Use query_logs tool with:
   - source_name: "system-logs"
   - filters: {"level": "Error"}
   - limit: 10

3. Analyze Patterns:

Use analyze_logs tool with:
   - source_name: "system-logs"
   - analysis_type: "pattern"

4. Register an ETL File:

Use register_log_source tool with:
   - name: "network-trace"
   - source_type: "etl"
   - path: "C:\\Traces\\network.etl"

Development

# Run tests
pytest

# Code formatting
black .
isort .

# Type checking
mypy src

# Run all quality checks
black . && isort . && mypy src && flake8

Project Structure

• `src/mcp_log_analyzer/`: Main package
  • `mcp_server/`: MCP server implementation using FastMCP
  • `core/`: Core functionality and models
  • `parsers/`: Log parsers for different formats
• `main.py`: Server entry point
• `.mcp.json`: MCP configuration
• `tests/`: Test files

Requirements

• Python 3.12+
• Windows OS (for Event Log support)
• See `pyproject.toml` for full dependencies

License

MIT