Logclaw MCP Server

LogClaw

AI SRE that deploys in your VPC. Real-time anomaly detection, trace-correlated incident tickets, and AI root cause analysis — your logs never leave your infrastructure.

---

TL;DR — Try It

Option A: Managed Cloud (no install — fastest)

Try the full experience instantly at [console.logclaw.ai](https://console.logclaw.ai) — includes AI root cause analysis, API key management, multi-tenant isolation, and the complete incident pipeline. No Docker required.

Option B: Docker Compose (self-hosted, no Kubernetes)

curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/docker-compose.yml

curl -O https://raw.githubusercontent.com/logclaw/logclaw/main/otel-collector-config.yaml docker compose up -d

Open http://localhost:3000 — the LogClaw stack is running:

• Dashboard (:3000) — incidents, log ingestion, config
• OTel Collector (:4317 gRPC, :4318 HTTP) — send logs via OTLP
• Bridge (:8080) — anomaly detection + trace correlation
• Ticketing Agent (:18081) — AI-powered incident management
• OpenSearch (:9200) — log storage + search
• Kafka (:9092) — event bus

All images are pulled from ghcr.io/logclaw/ — no registry auth required.

Note: The local stack runs in single-tenant mode with LLM-powered root cause analysis disabled. For AI RCA, API key management, and multi-tenant isolation, use the managed cloud or deploy to Kubernetes with LLM_PROVIDER=claude|openai|ollama.

Option C: Kind Cluster (full Kubernetes stack)

git clone https://github.com/logclaw/logclaw.git && cd logclaw

./scripts/setup-dev.sh

This creates a Kind cluster, installs all operators and services, builds the dashboard, and runs a smoke test. Takes ~20 minutes on a 16 GB laptop.

Container Images

All LogClaw images are published to GHCR as public packages:

Pull any image directly:

docker pull ghcr.io/logclaw/logclaw-dashboard:stable

---

See It in Action

Incident Management AI Root Cause Analysis

Log Ingestion Dashboard Overview

Live demo: console.logclaw.ai | Video walkthrough: logclaw.ai

---

Open Source vs Cloud vs Enterprise

No per-seat fees. No per-host fees. AI features included at every tier.

Start Free (Cloud) | Deploy from GitHub (OSS) | Book a Demo (Enterprise)

---

Architecture

All components below are included in every tier — Open Source, Cloud, and Enterprise.

LogClaw Stack (per tenant, namespace-isolated)

│ ├── logclaw-auth-proxy API key validation + tenant ID injection ├── logclaw-otel-collector OpenTelemetry Collector (OTLP gRPC + HTTP) ├── logclaw-ingestion Vector.dev edge ingestion (optional) ├── logclaw-kafka Strimzi Kafka 3-broker KRaft cluster ├── logclaw-flink ETL + enrichment + anomaly scoring ├── logclaw-opensearch OpenSearch cluster (hot-tier log storage) ├── logclaw-bridge OTLP ETL + trace correlation + lifecycle manager ├── logclaw-ml-engine Feast Feature Store + KServe/TorchServe + Ollama ├── logclaw-airflow Apache Airflow (ML training DAGs) ├── logclaw-ticketing-agent AI-powered RCA + multi-platform ticketing ├── logclaw-agent In-cluster infrastructure health collector ├── logclaw-dashboard Next.js web UI (ingestion, incidents, config, dark mode) └── logclaw-console Enterprise SaaS console (multi-tenant)

Data flow: Logs → Auth Proxy (API key + tenant injection) → OTel Collector (OTLP ingestion) → Kafka → Bridge (ETL + anomaly + trace correlation) → OpenSearch + Ticketing Agent → Incident tickets

All charts are wired together by the `logclaw-tenant` umbrella chart — a single helm install deploys the full stack for one tenant.

---

Quick Start (Production / ArgoCD)

Prerequisites

One-time cluster setup (operators, run once per cluster):

helmfile -f helmfile.d/00-operators.yaml apply

Onboard a new tenant

1. Copy the template:

   cp gitops/tenants/_template.yaml gitops/tenants/tenant-<id>.yaml

1. Fill in the required values (tenantId, tier, cloudProvider, secret store config).

1. Commit and push — ArgoCD will detect the new file and deploy the full stack in ~30 minutes.

Manual install (dev/staging)

helm install logclaw-acme charts/logclaw-tenant \

--namespace logclaw-acme \ --create-namespace \ -f gitops/tenants/tenant-acme.yaml

---

Running Locally (Step by Step)

Prefer the one-command setup? Run ./scripts/setup-dev.sh and skip to Step 6.

Prerequisites

# macOS (Homebrew)

brew install helm helmfile kind kubectl node python3

Helm plugins

helm plugin install https://github.com/databus23/helm-diff helm plugin install https://github.com/helm-unittest/helm-unittest

Docker Desktop must be running

open -a Docker

1 — Create a local Kubernetes cluster

make kind-create

Verify:

kubectl cluster-info --context kind-logclaw-dev

2 — Install cluster-level operators

make install-operators

Wait for operators to be ready (~3 min):

kubectl get pods -n strimzi-system -w

kubectl get pods -n opensearch-operator-system -w

3 — Install the full tenant stack

make install TENANT_ID=dev-local STORAGE_CLASS=standard

This deploys all 16 helmfile releases in dependency order. Monitor progress:

watch kubectl get pods -n logclaw-dev-local

4 — Build and deploy the Dashboard

The dashboard requires a Docker image build:

docker build -t logclaw-dashboard:dev apps/dashboard/

kind load docker-image logclaw-dashboard:dev --name logclaw-dev

helm upgrade --install logclaw-dashboard-dev-local charts/logclaw-dashboard \ --namespace logclaw-dev-local \ --set global.tenantId=dev-local \ -f charts/logclaw-dashboard/ci/default-values.yaml

5 — Access the services

# Dashboard (main UI)

kubectl port-forward svc/logclaw-dashboard-dev-local 3333:3000 -n logclaw-dev-local open http://localhost:3333

OpenSearch (query API)

kubectl port-forward svc/logclaw-opensearch-dev-local 9200:9200 -n logclaw-dev-local

Airflow (ML pipelines)

kubectl port-forward svc/logclaw-airflow-dev-local-webserver 8080:8080 -n logclaw-dev-local open http://localhost:8080 # admin / admin

6 — Send logs

LogClaw ingests logs via OTLP (OpenTelemetry Protocol) — the CNCF industry standard. Port-forward the OTel Collector:

kubectl port-forward svc/logclaw-otel-collector-dev-local 4318:4318 -n logclaw-dev-local &

Send a single log via OTLP HTTP:

curl -X POST http://localhost:4318/v1/logs \

-H "Content-Type: application/json" \ -d '{ "resourceLogs": [{ "resource": { "attributes": [ {"key": "service.name", "value": {"stringValue": "payment-api"}} ] }, "scopeLogs": [{ "logRecords": [{ "timeUnixNano": "'$(date +%s)000000000'", "severityText": "ERROR", "body": {"stringValue": "Connection refused to database"}, "traceId": "abcdef1234567890abcdef1234567890", "spanId": "abcdef12345678" }] }] }] }'

Any OpenTelemetry SDK or agent can send logs to LogClaw — no custom integration needed. See OTLP Integration Guide for SDK examples.

Generate and ingest 900 sample Apple Pay logs:

# Generate sample OTel logs

python3 scripts/generate-applepay-logs.py # → 500 payment flow logs python3 scripts/generate-applepay-logs-2.py # → 400 infra/security errors

Ingest them

./scripts/ingest-logs.sh scripts/applepay-otel-500.json ./scripts/ingest-logs.sh scripts/applepay-otel-400-batch2.json

Or use the helper script:

./scripts/ingest-logs.sh --generate   # generates + ingests all sample logs

./scripts/ingest-logs.sh --smoke # single test log

7 — See it in action

After ingesting error logs, the Bridge detects anomalies and the Ticketing Agent creates incident tickets. View them:

# Watch Bridge trace correlation in real-time

kubectl logs -f deployment/logclaw-bridge-dev-local -n logclaw-dev-local

Check auto-created incidents

kubectl port-forward svc/logclaw-opensearch-d