Log10x MCP

Log10x MCP Server

Ask your AI assistant about log costs, log patterns, and incidents in plain English, and get structured answers backed by per-pattern metrics. "Why did our log costs spike this week?", "what's driving payments-svc volume?", "pull the payment_retry events for acme-corp from Jan 15 to Apr 15." The server exposes the 10x platform to Claude and any MCP-compatible assistant as a set of tools.

10x groups your logs by message type. The same lines repeat over and over with only the timestamp or request ID changing, so 10x collapses each flood of near-identical lines into one message type and ranks them by volume and cost. Names come from symbols compiled from code, so the same line gets the same name on every node under the same engine, library and configuration.

This server is open source under MIT. A Log10x product license (API key) unlocks the account-scoped tools; without one, the server boots read-only against a public demo dataset so the tools can be explored immediately.

What you can ask

Install

Claude Code

claude mcp add --transport stdio --env LOG10X_API_KEY=your-api-key log10x -- npx -y log10x-mcp

Verify with /mcp. Omit the --env flag to run read-only against the public demo dataset.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{

"mcpServers": { "log10x": { "command": "npx", "args": ["-y", "log10x-mcp"], "env": { "LOG10X_API_KEY": "your-api-key" } } } }

Cursor, Windsurf, and other MCP clients

Add an mcpServers entry of the same shape: "command": "npx", "args": ["-y", "log10x-mcp"], and LOG10X_API_KEY in env. Omit the key to run read-only demo mode.

Full setup walkthrough: https://doc.log10x.com/apps/mcp/

Chart images (include_chart on log10x_top_patterns and log10x_pattern_trend) need chart.js and chartjs-node-canvas, optional peers that are not installed with the package; without them charts render as text.

The Elasticsearch, Azure Monitor and GCP Cloud Logging connectors, and the Azure App Configuration and GCP Secret Manager config stores, also use optional SDKs that keep the default install small. Add them when the server starts, for example npx -y -p log10x-mcp -p @azure/monitor-query -p @azure/identity log10x-mcp; the connector names the packages it needs if they are missing.

Credentials

Account-scoped tools need a Log10x API key. Two ways to get one:

• GitHub sign-in: run log10x_signin_start, complete the flow, then log10x_signin_complete. The key is stored for you. log10x_login_status shows who you're connected as.
• Environment variable: set LOG10X_API_KEY directly.

No key? The server boots read-only against the public 10x demo dataset (the same sample data the website console shows), so analysis, discovery, and the install advisors all work out of the box. Mutating tools are disabled in this mode so shared demo state stays untouched. Set LOG10X_DEMO_FALLBACK=off to boot into pure POC mode (savings estimates on your own files, no account). The mode is fixed at startup; restart the server to re-detect.

Environment variables

All optional. The common path is just LOG10X_API_KEY (or no key at all).

Connect your own data (optional)

10x keeps logs queryable without paying to index everything. The Receiver ships budget-overflow noise to your own S3, and the Retriever fetches those exact events back on demand when you need them. log10x_offload_add and log10x_retriever_register wire up the offload-and-fetch path; log10x_backfill_metric pushes per-pattern volume and cost series into your existing Datadog or Prometheus so the cost views light up alongside the rest of your dashboards.

Security

The server runs locally as a subprocess of your AI client. Only pre-aggregated metric queries (per-pattern volume and cost) leave the machine, never raw log content. Local triage with log10x_resolve_batch runs entirely on your machine over stdin and stdout. Connections to your own log platform use read-only credentials. Set LOG10X_MCP_READ_ONLY=true to refuse every mutating tool regardless of mode.

The fenced POC: provably offline

For an evaluation that has to be checkable rather than promised: MCP server and log engine in one container started with --network none, over a log sample you exported yourself with your own credentials.

docker run -i --rm --pull=never --network none --hostname localhost \

--cap-drop ALL --security-opt no-new-privileges \ -v "$PWD/poc/logs:/data:ro" -v "$PWD/poc/out:/out" \ -e TENX_LICENSE_KEY -e TENX_AIRGAPPED=true log10x/poc:local

There is no npx variant of this line, and that is not an oversight. npx resolves and executes a packag