Skip to main content

Connecting an AI assistant (MCP server)

This feature is in beta and isn’t enabled by default. Contact support to request access. This is a new feature that evolves quickly: new tools are added as they are released.

What is the MCP server?​

Model Context Protocol (MCP) is an open standard that lets an AI assistant use external tools. The Centreon Log Management MCP server connects an AI assistant to the logs of your organization. Claude, Visual Studio Code, or any other client compatible with MCP can then search your logs, summarize them, chart their volume and forecast it, directly from the conversation.

The MCP server does not store any data, but your logs go through two language models:

  • The model of your assistant, which receives the logs returned by the tools. Only use the MCP server with an assistant whose terms of use fit your data policy, for example a local model or a service that does not train on your data.
  • The model of Log Management, which turns questions in natural language into queries (search_logs) and writes log summaries (summarize_logs), as with the Ask AI and Log summary features of the Log explorer.

Limitations​

  • The MCP server only reads your logs: it does not create or modify anything in your organization.
  • One connection gives access to one organization.
  • Authentication relies on a token sent in an HTTP header. Clients that only support the OAuth sign-in flow cannot connect yet.

Prerequisites​

  • An API token for your organization. Tokens are created by an Administrator on the Administration > Token management page: see Managing authentication tokens. The token gives access to all the logs of your organization: store it as a secret and do not share it. Create a token dedicated to the MCP server rather than reusing the token of your collectors: you can then delete it without stopping log collection.
  • The name of your organization. It appears in the address of the Log Management interface, after /organizations/: for https://obs.mycentreon.com/organizations/acme/..., the organization is acme.
  • The MCP server must be enabled for your organization. If the server answers with a 404 error, contact Centreon support (see Troubleshooting).

Endpoint and authentication​

The MCP server is reachable at the following address, where <organization> is the name of your organization:

https://api.euwest1.obs.mycentreon.com/v1/orgs/<organization>/log-analysis/mcp

Every request must carry your API token in the X-Api-Key: <token> header. Do not send an Authorization header as well: the request would be rejected.

The organization is fixed by the address: a connection gives access to one organization only, and a token only works with the organization it was created in. To work with several organizations, add one connection per organization.

The MCP server does not support the OAuth sign-in flow yet. You can therefore only connect clients that let you set a custom HTTP header, such as the ones below.

Connecting a client​

In the examples below, replace <organization> with the name of your organization and <token> with your API token.

Run the following command:

claude mcp add --transport http centreon-logs https://api.euwest1.obs.mycentreon.com/v1/orgs/<organization>/log-analysis/mcp --header "X-Api-Key: <token>"

Or add the server to the .mcp.json file of your project. This file is meant to be shared with your team, so the configuration below takes the token from the CLM_API_KEY environment variable instead of containing it: set this variable to your token before you start Claude Code.

{
  "mcpServers": {
    "centreon-logs": {
      "type": "http",
      "url": "https://api.euwest1.obs.mycentreon.com/v1/orgs/<organization>/log-analysis/mcp",
      "headers": {
        "X-Api-Key": "${CLM_API_KEY}"
      }
    }
  }
}

In Claude Code, the /mcp command shows centreon-logs as connected.

Once connected, your client lists 6 tools and 3 prompts for the server. To check that everything works, ask for example:

Are there errors in the last 24 hours? Summarize what happened and forecast whether the log volume will keep rising over the next few hours.

Tools​

ToolWhat it does
search_logsSearches logs from a question in natural language or from a query
summarize_logsWrites a summary of the logs that match a query over a time window
aggregate_logsCounts the logs over time, in total, per severity or per service
forecast_logsForecasts the log volume of a query from its recent history
list_log_fieldsLists the fields you can query in your logs
list_field_valuesLists the most frequent values of a field

You do not call the tools yourself: you ask a question, and the assistant chooses the tools and chains them. Knowing what each tool does helps you phrase your questions.

  • search_logs accepts either a question in natural language ("errors from the billing service in the last hour") or a query written with the query syntax. A question is translated into a query, and the tool returns that query, so the assistant can refine it or reuse it with the other tools. The tool returns the number of matching logs and up to 1,000 of them (20 by default), each with its timestamp, severity, service and message only: attributes are not returned.
  • summarize_logs returns a written summary of the logs that match a query, by default over the last hour. It reads at most 2,000 logs of the time window, so keep the window narrow.
  • aggregate_logs returns the number of logs over time, as one curve in total, one curve per severity, or one curve per service (the 20 largest). This is how the assistant spots a peak or a trend without reading every log.
  • forecast_logs counts the logs that match a query over a time window (by default the last 24 hours) and forecasts the next points at the same interval.
  • list_log_fields lists the fields of your logs, with their types and whether they can be searched or aggregated. The assistant uses it before writing a query on a field it does not know.
  • list_field_values lists the most frequent values of a field, with their count. For example, the severity of a log can be written ERROR or Error depending on the application that sent it: this tool shows every variant.

Prompts​

The MCP server also provides prompts: ready-made instructions that guide the assistant through a complete investigation. Depending on your client, they appear as commands (for example /centreon-logs:incident_postmortem in Claude Code) or in a prompt picker. Each prompt takes optional arguments in free text.

PromptWhat it doesOptional arguments
incident_postmortemInvestigates an incident in the logs and writes a post-mortem: precursors, timeline to the minute, with the query behind every statementincident: what is already known (time window, affected services, symptoms)
period_digestAnswers "what happened while I was away?" by comparing a period with a baseline: trends, anomalies or an explicit all-clear, highlights per serviceperiod: the period to cover (the last 24 hours by default); focus: what normal looks like, or the services to watch
understand_logsGives a tour of your logs for a newcomer: the services present, their volume and severity profile, typical logs, and starter queriesfocus: an area to start with (a service, a technology, a question)

Troubleshooting​

  • 401 Unauthorized: the X-Api-Key header is missing or its token is invalid, an Authorization header was sent, or the name of the organization in the address is wrong (the token belongs to a different organization).
  • 404 Not Found: either the path is wrong (check /log-analysis/mcp, without a trailing slash), or the token was accepted but the MCP server is not enabled for your organization. In that case, contact Centreon support.