Logicmonitor

LogicMonitor MCP Server

Model Context Protocol (MCP) server for LogicMonitor REST API v3 integration. Enables AI assistants to interact with LogicMonitor monitoring data through 306 structured tools, 15 workflow prompts, and 26 resources. Optional integrations: IBM watsonx.ai for Granite TTM forecasting and NL summaries, Terraform IaC for any provider, and HuggingFace local Granite model fallback.

Works with any MCP-compatible client: Claude Desktop, Claude Code, Cursor, Continue, Cline, and more.

Quick Start

1. Get your LogicMonitor Bearer Token:

• Log into your LogicMonitor portal
• Go to Settings → Users and Roles → API Tokens
• Create a new API-only user or add a token to an existing user
• Copy the Bearer token

2. Configure your MCP client:

For Claude Code (CLI):

claude mcp add logicmonitor \

-e LM_PORTAL=yourcompany.logicmonitor.com \ -e LM_BEARER_TOKEN= \ -- uvx --from lm-mcp lm-mcp-server

With IBM watsonx.ai integration (optional -- adds Granite TTM forecasting and NL summaries):

claude mcp add logicmonitor \

-e LM_PORTAL=yourcompany.logicmonitor.com \ -e LM_BEARER_TOKEN= \ -e WATSONX_API_KEY= \ -e WATSONX_URL=https://us-south.ml.cloud.ibm.com \ -e WATSONX_PROJECT_ID=your-watsonx-project-id \ -- uvx --from "lm-mcp[ibm]" lm-mcp-server

With Terraform IaC (optional -- adds terraform plan/apply/generate tools):

claude mcp add logicmonitor \

-e LM_PORTAL=yourcompany.logicmonitor.com \ -e LM_BEARER_TOKEN= \ -e TF_WORKSPACE_DIR=/path/to/terraform/workspaces \ -- uvx --from lm-mcp lm-mcp-server

With HuggingFace local models (optional -- local Granite TTM + NL summaries, no cloud API needed):

claude mcp add logicmonitor \

-e LM_PORTAL=yourcompany.logicmonitor.com \ -e LM_BEARER_TOKEN= \ -- uvx --from "lm-mcp[huggingface]" lm-mcp-server

For Claude Desktop, add to your config file (see MCP Client Configuration below).

3. Verify it's working:

claude mcp list

You should see: logicmonitor: uvx --from lm-mcp lm-mcp-server - ✓ Connected

4. Test with a prompt:

"Show me all critical alerts in LogicMonitor"

What's New in v4.2.1

A fix release. LMv1 portals authenticate again, writes included: the signature follows LogicMonitor's documented recipe and covers the exact bytes sent. Tool errors reach the client with isError: true and are audited as failures, every tool is callable per its own schema, stdio starts in every configuration, and /readyz no longer calls the portal. Releases are now gated on the suite across Python 3.11 to 3.13, and the container installs from uv.lock with hash checking, digest-pinned base images, and a fixed non-root UID.

v4.2.0

What's New in v4.2.0

Multi-portal mode arrives, hardened. A single server can now serve many customer portals, selecting the active one at runtime with list_portals, use_portal, current_portal, and reload_portals — one entry in your MCP client instead of one server (and one pasted token) per portal. Credentials live in an age-encrypted vault, every portal is read-only unless its vault record says otherwise, and the mode is deliberately stdio-only: the server refuses to start it on the shared HTTP transport. The release also carries a full dependency refresh clearing 53 dependabot alerts across the lockfile.

v4.1.0

What's New in v4.1.0

Native OTLP metrics arrive. LogicMonitor's new OTLP Metrics feature (feature-flag gated, Prometheus-backed) ships in its first phase with a single UI surface (the dashboard Advanced Metrics Widget) and no Metrics Explorer yet; these four tools are the first programmatic window into that data: get_otlp_metric_names, get_otlp_metric_labels, and get_otlp_label_values for discovery, and query_otlp_metrics for full PromQL range queries returning time-series matrices. All four were validated live against a flag-enabled portal fed by a real OTel collector (Kubernetes cAdvisor and application metrics), translate the feature-disabled portal responses into a clear availability notice, and cap large matrix responses with even-stride downsampling so they stay LLM-friendly.

What's New in v4.0.0

Major. Every tool now wraps an endpoint proven to exist, validated against a live portal. Six tools that called nonexistent API paths since introduction are removed (get_cloud_cost_accounts, get_cost_summary, get_resource_cost, get_remediation_status, get_remediation_history, get_batchjob_history); the cost recommendation tools move onto the working /cost-optimization API; the Service Insight tools query real Service Insight objects (deviceType 6 devices and BizService groups) instead of the legacy v1 websites API. The Automated Diagnostics & Remediation surface arrives in full: get_diagnostic_remediation_assignments and get_diagnostic_remediation_results (structured execution records with script output, replacing audit-log scraping), execute_diagnostic, full CRUD plus import/export for diagnostic and remediation sources, and the new action chain / action rule namespace (11 tools including the set_action_rule_status toggle). update_logicmodule gains the two new source types and its apply mode actually applies now (it previously tripped its own sub-tools' confirm guards). run_report executions are pollable via get_report_execution, get_alert_details can fetch the full message body, and NextGen reports are visible to the report list tools.

Full release history, including v3.9.x and earlier, is in CHANGELOG.md. The v3.8.0 networking intelligence tools have a dedicated reference: documentation/networking-intelligence.md.

Features

306 Tools across comprehensive LogicMonitor API coverage (277 LM + 18 AAP + 10 Terraform + 1 watsonx):

Core Monitoring

• Alert Management: Query, acknowledge, bulk acknowledge, add notes, view rules
• Device Management: Full CRUD - list, create, update, delete devices and groups
• Metrics & Data: Query datasources, instances, metric data, and graphs. Instance CRUD for manual datasource instances.
• Dashboard Management: Full CRUD for dashboards, widgets, and groups
• SDT Management: Create, list, bulk create/delete Scheduled Downtime
• Collector Management: List collectors and collector groups

Extended Features

• Website Monitoring: Full CRUD for synthetic checks and website groups
• Report Management: List, view, run reports, manage schedules
• Escalation Management: Full CRUD for escalation chains and recipient groups
• Alert Rules: Full CRUD for alert routing rules
• User & Role Management: View users, roles, access groups, API tokens
• Ops Management: Audit logs, ops notes, login/change audits
• Automated Diagnostics & Remediation: Assigned-source resolution, structured execution results with script output, diagnostic/remediation source CRUD, manual execution, action chains and rules
• Native OTLP Metrics (preview): Metric and label discovery plus PromQL range queries against the feature-flag-gated OTLP metrics store

AI Analysis Tools

Server-side intelligence that transforms raw monitoring data into actionable insights:

• Alert Correlation: Automatically clusters related alerts by device, datasource, and temporal proximity — replaces dozens of manual API calls with a single aggregated view
• Alert Statistics: Aggregated alert counts by severity, top-10 devices and datasources, time-bucketed distributions for trend analysis
• Metric Anomaly Detection: Multi-method anomaly detection (z-score, IQR, MAD) with auto-selection based on data distribution
• Metric Baselines: Save baseline snapshots of metric behavior, then compare current performance against the baseline to detect drift
• Scheduled Analysis: HTTP API endpoints for triggering analysis workflows (alert correlation, RCA, top talkers, health checks) from external schedulers and webhooks

ML/Statistical Analysis Tools

Pure-Python statistical methods for capacity planning, trend analysis, and operational scoring:

• Metric Forecasting: Linear regression, Holt-Winters triple exponential smoothing, and IBM Granite TTM (via watsonx.ai, optional) with auto-selection, confidence intervals, and threshold breach prediction
• Metric Correlation: Pearson correlation matrix across multiple metric series with strong-correlation highlighting
• Error Budget Tracking: SLO-based error budget calculation with burn rate, projected exhaustion, and status classification
• Change Point Detection: CUSUM algorithm for identifying regime shifts and mean-level changes
• Alert Noise Scoring: Shannon entropy and flap detection to quantify alert noise (0-100) with tuning recommendations
• Seasonality Detection: Autocorrelation-based periodicity detection at standard intervals with peak-hour identification
• Availability Calculation: SLA-style uptime percentage from alert history with MTTR, incident counts, and per-device breakdown
• Blast Radius Analysis: Topology-based downstream impact scoring for device failure scenarios
• Change Correlation: Cross-references alert spikes with audit/change logs to identify change-induced incidents
• Trend Classification: Categorizes metrics as stable, increasing, decreasing, cyclic, or volatile
• Device Health Scoring: Multi-metric composite health score (0-100) using z-score analysis with configurable weights

Composite Workflow Tools

Multi-step analysis tools that combine several sub-tools into a single call. Each supports detail_level ("summary" or "full"), optional summarize=true for plain-English NL summaries via IBM Granite (requires watsonx.ai), and handles sub-tool failures gracefully with partial results.

• Triage: Correlates active alerts, scores noise, analyzes blast radius, and cross-references recent changes
• Health Check: Device health score, monitoring coverage, anomaly detection, active alerts, and 30-day availability
• Capacity Plan: Per-datasource forecasting, trend classification, seasonality detection, and change point analysis
• Portal Overview: Alert statistics, collector health, active SDTs, alert clusters, noise assessment, and down devices
• Diagnose: Alert details, device context, correlation, blast radius, health scoring, and root cause analysis
• Update LogicModule (Safe Partial Updates): update_logicmodule(type, id, changes, mode) exports the current full definition, deep-merges your changes, validates required fields, and returns a dry-run diff (default) or applies the merge. Prevents the full-replace blanking that wiped production Groovy scripts in two prior incidents. Supports configsource, datasource, eventsource, logsource, propertysource, topologysource.
• Search Tools: Keyword search across all tools by name and description with category filtering

APM Trace Tools

Service discovery and RED metrics for LogicMonitor APM (Application Performance Monitoring):

• Service Discovery: List all traced services, inspect individual service details and properties
• Operation Listing: Discover endpoints/routes monitored within each se