Last9 MCP Server

1# Last9 MCP Server
2 
3![last9 mcp demo](mcp-demo.gif)
4A [Model Context Protocol](https://modelcontextprotocol.io/) server
5implementation for [Last9](https://last9.io/mcp/) that enables AI agents to
6seamlessly bring real-time production context — logs, metrics, and traces — into
7your local environment to auto-fix code faster.
8 
9- [View demo](https://www.youtube.com/watch?v=AQH5xq6qzjI)
10- Read our
11  [announcement blog post](https://last9.io/blog/launching-last9-mcp-server/)
12 
13## Quick Links
14 
15- [Status](#status)
16- [Installation](#installation)
17- [Configuration](#configuration)
18- [Usage](#usage)
19- [Tools Documentation](#tools-documentation)
20- [Development](#development)
21- [Testing](#testing)
22- [Badges](#badges)
23 
24## Installation
25 
26You can connect to Last9 MCP in two ways:
27 
28### Recommended: Managed MCP over HTTP
29 
30This is the easiest and cleanest setup. You do not need to run a local binary.
31You'll need a **Client Token** (MCP type) — see [Getting your credentials](#getting-your-credentials) below. Your org slug is in your Last9 URL: `app.last9.io/<org_slug>/...`
32 
33```bash
34claude mcp add --transport http last9 https://app.last9.io/api/v4/organizations/<organization_slug>/mcp \
35  --header "X-LAST9-API-TOKEN: Bearer <last9_api_token>"
36```
37 
38Or add it directly to your MCP client config:
39 
40```json
41{
42  "mcpServers": {
43    "last9": {
44      "type": "http",
45      "url": "https://app.last9.io/api/v4/organizations/<organization_slug>/mcp",
46      "headers": {
47        "X-LAST9-API-TOKEN": "Bearer <last9_api_token>"
48      }
49    }
50  }
51}
52```
53 
54### Local Installation (STDIO fallback)
55 
56Use this only if your client needs a local STDIO server process.
57 
58#### Homebrew
59 
60```bash
61brew update
62brew install last9/tap/last9-mcp
63brew upgrade last9/tap/last9-mcp
64last9-mcp --version
65```
66 
67#### NPM
68 
69```bash
70# Install globally
71npm install -g @last9/mcp-server@latest
72# Or run directly with npx
73npx -y @last9/mcp-server@latest
74```
75 
76#### GitHub Releases (Windows / manual install)
77 
78Download the binary for your platform from [GitHub Releases](https://github.com/last9/last9-mcp-server/releases/latest):
79 
80| Platform | Archive |
81|----------|---------|
82| Windows (x64) | `last9-mcp-server_Windows_x86_64.zip` |
83| Windows (ARM64) | `last9-mcp-server_Windows_arm64.zip` |
84| Linux (x64) | `last9-mcp-server_Linux_x86_64.tar.gz` |
85| Linux (ARM64) | `last9-mcp-server_Linux_arm64.tar.gz` |
86| macOS (x64) | `last9-mcp-server_Darwin_x86_64.tar.gz` |
87| macOS (ARM64) | `last9-mcp-server_Darwin_arm64.tar.gz` |
88 
89Extract the archive. On Windows the binary is `last9-mcp-server.exe`. Use the full path to the binary in your MCP client config (see [Windows example](#windows-example-claude-desktop) below).
90 
91> On Windows, [NPM](#npm) is easier to set up (no path management needed), or use the [hosted HTTP transport](#recommended-managed-mcp-over-http) to skip local installation entirely.
92 
93## Getting Your Credentials
94 
95### For hosted MCP (recommended)
96 
97You need a **Client Token** with MCP type. Only **admins** can create tokens. If you're not an admin, ask your admin to create one or grant you admin access via [User Access settings](https://app.last9.io/settings/user-access).
98 
991. Go to [Ingestion Tokens](https://app.last9.io/control-plane/ingestion-tokens)
1002. Click **New Ingestion Token**
1013. Set **Token Type** to **Client**
1024. Set **Client Type** to **MCP**
1035. Enter a name (e.g., `claude-desktop`, `cursor`)
1046. Click **Create** — copy the token immediately (shown only once)
105 
106Your **organization slug** is in your Last9 URL: `https://app.last9.io/<org_slug>/...`
107 
108### For local binary (STDIO mode)
109 
110You need a **Refresh Token** with Write permissions. Only **admins** can create them.
111 
1121. Go to [API Access](https://app.last9.io/settings/api-access)
1132. Click **Generate Token** with Write permissions
1143. Copy the token
115 
116## Status
117 
118Works with Claude desktop app, or Cursor, Windsurf, and VSCode (Github Copilot)
119IDEs. Implements the following MCP
120[tools](https://modelcontextprotocol.io/docs/concepts/tools):
121**Observability & APM Tools:**
122 
123- `get_exceptions`: Get the list of exceptions.
124- `get_service_summary`: Get service summary with throughput, error rate, and response time.
125- `get_service_environments`: Get available environments for services.
126- `get_service_performance_details`: Get detailed performance metrics for a service.
127- `get_service_operations_summary`: Get operations summary for a service.
128- `get_service_dependency_graph`: Get service dependency graph showing incoming/outgoing dependencies.
129  **Prometheus/PromQL Tools:**
130- `prometheus_range_query`: Execute PromQL range queries for metrics data.
131- `prometheus_instant_query`: Execute PromQL instant queries for metrics data.
132- `prometheus_label_values`: Get label values for PromQL queries.
133- `prometheus_labels`: Get available labels for PromQL queries.
134  **Logs Management:**
135- `get_logs`: Get logs filtered by service name and/or severity level.
136- `get_drop_rules`: Get drop rules for logs that determine what logs get
137  filtered out at [Last9 Control Plane](https://last9.io/control-plane)
138- `add_drop_rule`: Create a drop rule for logs at
139  [Last9 Control Plane](https://last9.io/control-plane)
140- `get_service_logs`: Get raw log entries for a specific service over a time range. Can apply filters on severity and body.
141- `get_log_attributes`: Get available log attributes (labels) for a specified time window.
142  **Traces Management:**
143- `get_traces`: Retrieve traces using JSON pipeline queries for advanced filtering.
144- `get_service_traces`: Retrieve traces by trace ID or service name with time range filtering.
145- `get_trace_attributes`: Get available trace attributes (series) for a specified time window.
146  **Change Events:**
147- `get_change_events`: Get change events from the last9_change_events prometheus metric over a given time range.
148  **Alert Management:**
149- `get_alert_config`: Get alert configurations (alert rules) from Last9.
150- `get_alerts`: Get currently active alerts from Last9 monitoring system.
151 
152## Tools Documentation
153 
154### Time Input Standard
155 
156- For relative windows, prefer `lookback_minutes`.
157- For absolute windows, use `start_time_iso`, `end_time_iso`, or `time_iso` in RFC3339/ISO8601 (for example, `2026-02-09T15:04:05Z`).
158- If both relative and absolute inputs are provided, absolute time inputs take precedence.
159- Legacy `YYYY-MM-DD HH:MM:SS` is accepted only for compatibility.
160 
161### get_exceptions
162 
163Retrieves server-side exceptions over a specified time range.
164Parameters:
165 
166- `limit` (integer, optional): Maximum number of exceptions to return.
167  Default: 20.
168- `lookback_minutes` (integer, recommended): Number of minutes to look back from
169  now. Default: 60. Examples: 60, 30, 15.
170- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to use lookback_minutes.
171- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
172- `service_name` (string, optional): Filter exceptions by service name (e.g., api-service).
173- `span_name` (string, optional): Name of the span to filter by.
174- `deployment_environment` (string, optional): Filter exceptions by deployment environment from resource attributes (e.g., production, staging).
175 
176### get_service_summary
177 
178Get service summary over a given time range. Includes service name, environment, throughput, error rate, and response time. All values are p95 quantiles over the time range.
179Parameters:
180 
181- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to end_time_iso - 1 hour.
182- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
183- `env` (string, optional): Environment to filter by. Defaults to 'prod'.
184 
185### get_service_environments
186 
187Get available environments for services. Returns an array of environments that can be used with other APM tools.
188Parameters:
189 
190- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to end_time_iso - 1 hour.
191- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
192  Note: All other APM tools that retrieve service information (like `get_service_performance_details`, `get_service_dependency_graph`, `get_service_operations_summary`, `get_service_summary`) require an `env` parameter. This parameter must be one of the environments returned by this tool. If this tool returns an empty array, use an empty string `""` for the env parameter.
193 
194### get_service_performance_details
195 
196Get detailed performance metrics for a specific service over a given time range.
197Parameters:
198 
199- `service_name` (string, required): Name of the service to get performance details for.
200- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
201- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
202- `env` (string, optional): Environment to filter by. Defaults to 'prod'.
203 
204### get_service_operations_summary
205 
206Get a summary of operations inside a service over a given time range. Returns operations like HTTP endpoints, database queries, messaging producer and HTTP client calls.
207Parameters:
208 
209- `service_name` (string, required): Name of the service to get operations summary for.
210- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
211- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
212- `env` (string, optional): Environment to filter by. Defaults to 'prod'.
213 
214### get_service_dependency_graph
215 
216Get details of the throughput, response times and error rates of incoming, outgoing and infrastructure components of a service. Useful for analyzing cascading effects of errors and performance issues.
217Parameters:
218 
219- `service_name` (string, optional): Name of the service to get the dependency graph for.
220- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
221- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
222- `env` (string, optional): Environment to filter by. Defaults to 'prod'.
223 
224### prometheus_range_query
225 
226Perform a Prometheus range query to get metrics data over a specified time range. Recommended to check available labels first using `prometheus_labels` tool.
227Parameters:
228 
229- `query` (string, required): The range query to execute.
230- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
231- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
232 
233### prometheus_instant_query
234 
235Perform a Prometheus instant query to get metrics data at a specific time. Typically should use rollup functions like sum_over_time, avg_over_time, quantile_over_time over a time window.
236Parameters:
237 
238- `query` (string, required): The instant query to execute.
239- `time_iso` (string, optional): Time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to current time.
240 
241### prometheus_label_values
242 
243Return the label values for a particular label and PromQL filter query. Similar to Prometheus /label_values call.
244Parameters:
245 
246- `match_query` (string, required): A valid PromQL filter query.
247- `label` (string, required): The label to get values for.
248- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
249- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
250 
251### prometheus_labels
252 
253Return the labels for a given PromQL match query. Similar to Prometheus /labels call.
254Parameters:
255 
256- `match_query` (string, required): A valid PromQL filter query.
257- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - 60 minutes.
258- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
259 
260### get_logs
261 
262Gets logs filtered by service name and/or severity level within a specified time range. This tool now uses the advanced v2 logs API with physical index optimization for better performance.
263**Note**: This tool now requires a `service_name` parameter and internally uses the same advanced infrastructure as `get_service_logs`.
264Parameters:
265 
266- `service_name` (string, required): Name of the service to get logs for.
267- `severity` (string, optional): Severity of the logs to get (automatically converted to severity_filters format).
268- `lookback_minutes` (integer, recommended): Number of minutes to look back from now. Default: 60. Examples: 60, 30, 15.
269- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to use lookback_minutes.
270- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
271- `limit` (integer, optional): Maximum number of logs to return. Default: 20.
272- `env` (string, optional): Environment to filter by. Use "get_service_environments" tool to get available environments.
273 
274### get_drop_rules
275 
276Gets drop rules for logs, which determine what logs get filtered out from
277reaching Last9.
278 
279### add_drop_rule
280 
281Adds a new drop rule to filter out specific logs at
282[Last9 Control Plane](https://last9.io/control-plane)
283Parameters:
284 
285- `name` (string, required): Name of the drop rule.
286- `filters` (array, required): List of filter conditions to apply. Each filter
287  has:
288  - `key` (string, required): The key to filter on. Only attributes and
289    resource.attributes keys are supported. For resource attributes, use format:
290    resource.attributes[key_name] and for log attributes, use format:
291    attributes[key_name] Double quotes in key names must be escaped.
292  - `value` (string, required): The value to filter against.
293  - `operator` (string, required): The operator used for filtering. Valid
294    values:
295    - "equals"
296    - "not_equals"
297  - `conjunction` (string, required): The logical conjunction between filters.
298    Valid values:
299    - "and"
300 
301### get_alert_config
302 
303Get alert configurations (alert rules) from Last9. Returns all configured alert rules including their conditions, labels, and annotations.
304Parameters:
305None - This tool retrieves all available alert configurations.
306Returns information about:
307 
308- Alert rule ID and name
309- Primary indicator being monitored
310- Current state and severity
311- Algorithm used for alerting
312- Entity ID and organization details
313- Properties and configuration
314- Creation and update timestamps
315- Group timeseries notification settings
316 
317### get_alerts
318 
319Get currently active alerts from Last9 monitoring system. Returns all alerts that are currently firing or have fired recently within the specified time window.
320Parameters:
321 
322- `time_iso` (string, optional): Evaluation time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Preferred.
323- `timestamp` (integer, optional): Unix timestamp for the query time. Deprecated alias.
324- `window` (integer, optional): Time window in seconds to look back for alerts. Defaults to 900 seconds (15 minutes). Range: 60-86400 seconds.
325  Returns information about:
326- Alert rule details (ID, name, group, type)
327- Current state and severity
328- Last fired timestamp and duration
329- Rule properties and configuration
330- Alert instances with current values
331- Metric degradation information
332- Group labels and annotations for each instance
333 
334### get_service_logs
335 
336Get raw log entries for a specific service over a time range. This tool retrieves actual log entries including log messages, timestamps, severity levels, and other metadata. Useful for debugging issues, monitoring service behavior, and analyzing specific log patterns.
337Parameters:
338 
339- `service_name` (string, required): Name of the service to get logs for.
340- `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 minutes. Examples: 60, 30, 15.
341- `limit` (integer, optional): Maximum number of log entries to return. Default: 20.
342- `env` (string, optional): Environment to filter by. Use "get_service_environments" tool to get available environments.
343- `severity_filters` (array, optional): Array of severity patterns to filter logs (e.g., ["error", "warn"]). Uses OR logic.
344- `body_filters` (array, optional): Array of message content patterns to filter logs (e.g., ["timeout", "failed"]). Uses OR logic.
345- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - lookback_minutes.
346- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
347  Filtering behavior:
348- Multiple filter types are combined with AND logic (service AND severity AND body)
349- Each filter array uses OR logic (matches any pattern in the array)
350  Examples:
351- service_name="api" + severity_filters=["error"] + body_filters=["timeout"] → finds error logs containing "timeout"
352- service_name="web" + body_filters=["timeout", "failed", "error 500"] → finds logs containing any of these patterns
353 
354### get_log_attributes
355 
356Get available log attributes (labels) for a specified time window. This tool retrieves all attribute names that exist in logs during the specified time range, which can be used for filtering and querying logs.
357Parameters:
358 
359- `lookback_minutes` (integer, optional): Number of minutes to look back from now for the time window. Default: 15. Examples: 15, 30, 60.
360- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to use lookback_minutes.
361- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
362- `region` (string, optional): AWS region to query. Leave empty to use default from configuration. Examples: ap-south-1, us-east-1, eu-west-1.
363  Returns:
364- List of log attributes grouped into two categories:
365  - Log Attributes: Standard log fields like service, severity, body, level, etc.
366  - Resource Attributes: Resource-related fields prefixed with "resource\_" like resource_k8s.pod.name, resource_service.name, etc.
367 
368### get_traces
369 
370Execute advanced trace queries using JSON pipeline syntax for complex filtering and aggregation. This tool provides powerful querying capabilities for traces using a pipeline-based approach with filters, aggregations, and transformations.
371Parameters:
372 
373- `tracejson_query` (array, required): JSON pipeline query for traces. Use the tracejson_query_builder prompt to generate JSON pipeline queries from natural language.
374- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z).
375- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z).
376- `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 minutes.
377- `limit` (integer, optional): Maximum number of traces to return. Default: 20. Range: 1-100.
378  This tool supports complex queries with multiple filter conditions, aggregations, and custom processing pipelines for advanced trace analysis.
379 
380### get_service_traces
381 
382Retrieve traces from Last9 by trace ID or service name. This tool allows you to get specific traces either by providing a trace ID for a single trace, or by providing a service name to get all traces for that service within a time range.
383Parameters:
384 
385- `trace_id` (string, optional): Specific trace ID to retrieve. Cannot be used with service_name.
386- `service_name` (string, optional): Name of service to get traces for. Cannot be used with trace_id.
387- `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 minutes. Examples: 60, 30, 15.
388- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to use lookback_minutes.
389- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
390- `limit` (integer, optional): Maximum number of traces to return. Default: 10. Range: 1-100.
391- `env` (string, optional): Environment to filter by. Use "get_service_environments" tool to get available environments.
392  Usage rules:
393- Exactly one of `trace_id` or `service_name` must be provided (not both, not neither)
394- Time range filtering only applies when using `service_name`
395  Examples:
396- trace_id="abc123def456" - retrieves the specific trace
397- service_name="payment-service" + lookback_minutes=30 - gets all payment service traces from last 30 minutes
398  Returns trace data including trace IDs, spans, duration, timestamps, and status information.
399 
400### get_trace_attributes
401 
402Get available trace attributes (series) for a specified time window. This tool retrieves all attribute names that exist in traces during the specified time range, which can be used for filtering and querying traces.
403Parameters:
404 
405- `lookback_minutes` (integer, optional): Number of minutes to look back from now for the time window. Default: 15. Examples: 15, 30, 60.
406- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to use lookback_minutes.
407- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
408- `region` (string, optional): AWS region to query. Leave empty to use default from configuration. Examples: ap-south-1, us-east-1, eu-west-1.
409  Returns:
410- An alphabetically sorted list of all available trace attributes (e.g., http.method, http.status_code, db.name, resource_service.name, duration, etc.)
411 
412### get_change_events
413 
414Get change events from the last9_change_events prometheus metric over a given time range. Returns change events that occurred in the specified time window, including deployments, configuration changes, and other system modifications.
415Parameters:
416 
417- `start_time_iso` (string, optional): Start time in RFC3339/ISO8601 format (e.g. 2026-02-09T15:04:05Z). Leave empty to default to now - lookback_minutes.
418- `end_time_iso` (string, optional): End time in RFC3339/ISO8601 format (e.g. 2026-02-09T16:04:05Z). Leave empty to default to current time.
419- `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 minutes. Examples: 60, 30, 15.
420- `service` (string, optional): Name of the service to filter change events for.
421- `environment` (string, optional): Environment to filter by.
422- `event_name` (string, optional): Name of the change event to filter by (use available_event_names to see valid values).
423  Returns:
424- `available_event_names`: List of all available event types that can be used for filtering
425- `change_events`: Array of timeseries data with metric labels and timestamp-value pairs
426- `count`: Total number of change events returned
427- `time_range`: Start and end time of the query window
428  Each change event includes:
429- `metric`: Map of metric labels (service_name, env, event_type, message, etc.)
430- `values`: Array of timestamp-value pairs representing the timeseries data
431  Common event types include: deployment, config_change, rollback, scale_up/scale_down, restart, upgrade/downgrade, maintenance, backup/restore, health_check, certificate, database.
432  Best practices:
433 
4341. First call without event_name to get available_event_names
4352. Use exact event name from available_event_names for the event_name parameter
4363. Combine with other filters (service, environment, time) for precise results
437 
438## Configuration
439 
440### Managed HTTP transport (recommended)
441 
442Set this header in your MCP client config:
443 
444- `X-LAST9-API-TOKEN`: Bearer token for Last9 API access.
445 
446### Local STDIO server environment variables
447 
448If you run the server locally (`last9-mcp`), use these environment variables:
449 
450- `LAST9_REFRESH_TOKEN`: (required) Refresh Token with Write permissions from
451  [API Access](https://app.last9.io/settings/api-access). Only admins can create
452  refresh tokens.
453 
454Optional environment variables:
455 
456- `LAST9_DISABLE_TELEMETRY`: Defaults to `true` (telemetry is disabled by default). Set to `false` to enable OpenTelemetry tracing if you have an OTLP collector configured.
457- `OTEL_EXPORTER_OTLP_ENDPOINT`: OpenTelemetry collector endpoint URL. Only needed if `LAST9_DISABLE_TELEMETRY=false`.
458- `OTEL_EXPORTER_OTLP_HEADERS`: Headers for OTLP exporter authentication. Only needed if `LAST9_DISABLE_TELEMETRY=false`.
459- `LAST9_DATASOURCE`: Name of the datasource/cluster to use. If not specified, the default datasource configured in your Last9 organization will be used.
460- `LAST9_API_HOST`: API host to connect to. Defaults to `app.last9.io`. Use this if you need to connect to a different Last9 endpoint (e.g., regional or self-hosted instances).
461 
462## Usage
463 
464Use the managed HTTP transport config from [Installation](#installation) whenever possible. The examples below are for local STDIO setup via Homebrew or NPM.
465 
466## Usage with Claude Desktop
467 
468Configure the Claude app to use the MCP server:
469 
4701. Open the Claude Desktop app, go to Settings, then Developer
4712. Click Edit Config
4723. Open the `claude_desktop_config.json` file
4734. Copy and paste the server config to your existing file, then save
4745. Restart Claude
475 
476### Hosted MCP over HTTP (recommended)
477 
478No local binary needed. Use a [Client Token (MCP type)](#getting-your-credentials):
479 
480```json
481{
482  "mcpServers": {
483    "last9": {
484      "type": "http",
485      "url": "https://app.last9.io/api/v4/organizations/<org_slug>/mcp",
486      "headers": {
487        "X-LAST9-API-TOKEN": "Bearer <mcp_client_token>"
488      }
489    }
490  }
491}
492```
493 
494Or via the Claude Code CLI:
495 
496```bash
497claude mcp add --transport http last9 https://app.last9.io/api/v4/organizations/<org_slug>/mcp \
498  --header "X-LAST9-API-TOKEN: Bearer <mcp_client_token>"
499```
500 
501### Local STDIO (alternative)
502 
503Install via [Homebrew](#homebrew) or [NPM](#npm) first, then use a [Refresh Token](#getting-your-credentials).
504 
505### If installed via Homebrew:
506 
507```json
508{
509  "mcpServers": {
510    "last9": {
511      "command": "/opt/homebrew/bin/last9-mcp",
512      "env": {
513        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
514      }
515    }
516  }
517}
518```
519 
520### If installed via NPM:
521 
522```json
523{
524  "mcpServers": {
525    "last9": {
526      "command": "npx",
527      "args": ["-y", "@last9/mcp-server@latest"],
528      "env": {
529        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
530      }
531    }
532  }
533}
534```
535 
536## Usage with Cursor
537 
538Configure Cursor to use the MCP server:
539 
5401. Open Cursor, go to Settings, then Cursor Settings
5412. Select MCP on the left
5423. Click Add "New Global MCP Server" at the top right
5434. Copy and paste the server config to your existing file, then save
5445. Restart Cursor
545 
546### Hosted MCP over HTTP (recommended)
547 
548```json
549{
550  "mcpServers": {
551    "last9": {
552      "type": "http",
553      "url": "https://app.last9.io/api/v4/organizations/<org_slug>/mcp",
554      "headers": {
555        "X-LAST9-API-TOKEN": "Bearer <mcp_client_token>"
556      }
557    }
558  }
559}
560```
561 
562### Local STDIO (alternative)
563 
564### If installed via Homebrew:
565 
566```json
567{
568  "mcpServers": {
569    "last9": {
570      "command": "/opt/homebrew/bin/last9-mcp",
571      "env": {
572        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
573      }
574    }
575  }
576}
577```
578 
579### If installed via NPM:
580 
581```json
582{
583  "mcpServers": {
584    "last9": {
585      "command": "npx",
586      "args": ["-y", "@last9/mcp-server@latest"],
587      "env": {
588        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
589      }
590    }
591  }
592}
593```
594 
595## Usage with Windsurf
596 
597Configure Windsurf to use the MCP server:
598 
5991. Open Windsurf, go to Settings, then Developer
6002. Click Edit Config
6013. Open the `windsurf_config.json` file
6024. Copy and paste the server config to your existing file, then save
6035. Restart Windsurf
604 
605### Hosted MCP over HTTP (recommended)
606 
607```json
608{
609  "mcpServers": {
610    "last9": {
611      "type": "http",
612      "url": "https://app.last9.io/api/v4/organizations/<org_slug>/mcp",
613      "headers": {
614        "X-LAST9-API-TOKEN": "Bearer <mcp_client_token>"
615      }
616    }
617  }
618}
619```
620 
621### Local STDIO (alternative)
622 
623### If installed via Homebrew:
624 
625```json
626{
627  "mcpServers": {
628    "last9": {
629      "command": "/opt/homebrew/bin/last9-mcp",
630      "env": {
631        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
632      }
633    }
634  }
635}
636```
637 
638### If installed via NPM:
639 
640```json
641{
642  "mcpServers": {
643    "last9": {
644      "command": "npx",
645      "args": ["-y", "@last9/mcp-server@latest"],
646      "env": {
647        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
648      }
649    }
650  }
651}
652```
653 
654## Usage with VS Code
655 
656> Note: MCP support in VS Code is available starting v1.99 and is currently in
657> preview. For advanced configuration options and alternative setup methods,
658> [view the VS Code MCP documentation](https://code.visualstudio.com/docs/copilot/chat/mcp-servers).
659 
6601. Open VS Code, go to Settings, select the User tab, then Features, then Chat
6612. Click "Edit settings.json"
6623. Copy and paste the server config to your existing file, then save
6634. Restart VS Code
664 
665### Hosted MCP over HTTP (recommended)
666 
667```json
668{
669  "mcp": {
670    "servers": {
671      "last9": {
672        "type": "http",
673        "url": "https://app.last9.io/api/v4/organizations/<org_slug>/mcp",
674        "headers": {
675          "X-LAST9-API-TOKEN": "Bearer <mcp_client_token>"
676        }
677      }
678    }
679  }
680}
681```
682 
683### Local STDIO (alternative)
684 
685### If installed via Homebrew:
686 
687```json
688{
689  "mcp": {
690    "servers": {
691      "last9": {
692        "type": "stdio",
693        "command": "/opt/homebrew/bin/last9-mcp",
694        "env": {
695          "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
696        }
697      }
698    }
699  }
700}
701```
702 
703### If installed via NPM:
704 
705```json
706{
707  "mcp": {
708    "servers": {
709      "last9": {
710        "type": "stdio",
711        "command": "npx",
712        "args": ["-y", "@last9/mcp-server@latest"],
713        "env": {
714          "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
715        }
716      }
717    }
718  }
719}
720```
721 
722## Windows Example (Claude Desktop)
723 
724After downloading `last9-mcp-server_Windows_x86_64.zip` from [GitHub Releases](https://github.com/last9/last9-mcp-server/releases/latest), extract to get `last9-mcp-server.exe` and use its full path:
725 
726```json
727{
728  "mcpServers": {
729    "last9": {
730      "command": "C:\\Users\\<user>\\AppData\\Local\\Programs\\last9-mcp-server.exe",
731      "env": {
732        "LAST9_REFRESH_TOKEN": "<last9_refresh_token>"
733      }
734    }
735  }
736}
737```
738 
739The same pattern applies for Cursor and Windsurf on Windows. For VS Code, use the `"mcp": { "servers": { ... } }` wrapper. On Windows, prefer [NPM](#npm) to avoid path management, or use the [hosted HTTP transport](#recommended-managed-mcp-over-http) to skip local installation entirely.
740 
741## Development
742 
743For local development and testing, you can run the MCP server in HTTP mode which makes it easier to debug requests and responses.
744 
745### Running in HTTP Mode
746 
747Set the `LAST9_HTTP` environment variable to enable HTTP server mode:
748 
749```bash
750# Export required environment variables
751export LAST9_REFRESH_TOKEN="your_refresh_token"
752export LAST9_HTTP=true
753export LAST9_PORT=8080  # Optional, defaults to 8080
754# Run the server
755./last9-mcp-server
756```
757 
758The server will start on `http://localhost:8080/mcp` and you can test it with curl:
759 
760### Testing with curl
761 
762The MCP Streamable HTTP protocol requires an initialize handshake first. The server creates and returns a session ID in the response — do **not** set `Mcp-Session-Id` on the first request.
763 
764```bash
765# Step 1: Initialize — omit Mcp-Session-Id so the server creates the session.
766# Extract the returned Mcp-Session-Id from the response headers.
767SESSION_ID=$(curl -si -X POST http://localhost:8080/mcp \
768    -H "Content-Type: application/json" \
769    -d '{
770      "jsonrpc": "2.0",
771      "id": 1,
772      "method": "initialize",
773      "params": {
774        "protocolVersion": "2024-11-05",
775        "capabilities": {},
776        "clientInfo": {"name": "curl-test", "version": "1.0"}
777      }
778    }' | grep -i "^Mcp-Session-Id:" | awk '{print $2}' | tr -d '\r')
779echo "Session: $SESSION_ID"
780 
781# Step 2: Send the initialized notification
782curl -s -X POST http://localhost:8080/mcp \
783    -H "Content-Type: application/json" \
784    -H "Mcp-Session-Id: $SESSION_ID" \
785    -d '{"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}'
786 
787# Step 3: List available tools
788curl -s -X POST http://localhost:8080/mcp \
789    -H "Content-Type: application/json" \
790    -H "Mcp-Session-Id: $SESSION_ID" \
791    -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}}'
792 
793# Step 4: Call a tool
794curl -s -X POST http://localhost:8080/mcp \
795    -H "Content-Type: application/json" \
796    -H "Mcp-Session-Id: $SESSION_ID" \
797    -d '{
798      "jsonrpc": "2.0",
799      "id": 3,
800      "method": "tools/call",
801      "params": {
802        "name": "get_service_logs",
803        "arguments": {
804          "service_name": "your-service-name",
805          "lookback_minutes": 30,
806          "limit": 10
807        }
808      }
809    }'
810```
811 
812### Building from Source
813 
814```bash
815# Clone the repository
816git clone https://github.com/last9/last9-mcp-server.git
817cd last9-mcp-server
818# Build the binary
819go build -o last9-mcp-server
820# Run in development mode
821LAST9_HTTP=true ./last9-mcp-server
822```
823 
824**Note**: `LAST9_HTTP=true` is for local development and debugging of your own server process. For normal client integration, prefer the managed HTTP endpoint from [Installation](#installation).
825 
826## Testing
827 
828See [TESTING.md](TESTING.md) for detailed testing instructions.
829 
830## Badges
831 
832[![MseeP.ai Security Assessment Badge](https://mseep.net/pr/last9-last9-mcp-server-badge.png)](https://mseep.ai/app/last9-last9-mcp-server)
833