Content
# sumo-logic-mcp
MCP server for Sumo Logic — 48 tools for searching logs, managing monitors, alerts, dashboards, collectors, metrics, content library, users, roles, fields, partitions, lookup tables, and ingest budgets.
Generic and org-agnostic. Any team can plug in their own Sumo Logic credentials and start querying.
> **Note:** This is an experimental, community-driven project — not an official Sumo Logic product. Feel free to test it and use it.
## Installation
```bash
pip install sumo-logic-mcp
```
Or run without installing (via [uv](https://docs.astral.sh/uv/)):
```bash
uvx sumo-logic-mcp
```
## Setup
### 1. Get Access Credentials
1. Log in to your Sumo Logic account (e.g., `https://<your-org>.sumologic.com`)
2. Click on your profile icon (top right) and go to **Preferences**
3. Scroll to **My Access Keys** and click **Add Access Key**
4. Give it a name, leave scopes to default or set as needed
5. Copy both the **Access ID** and **Access Key**
### 2. Configure Your MCP Client
Add to your MCP client configuration (e.g., `~/.cursor/mcp.json` or Claude Desktop config):
```json
{
"mcpServers": {
"sumologic": {
"command": "uvx",
"args": ["sumo-logic-mcp"],
"env": {
"SUMOLOGIC_ACCESS_ID": "<your-access-id>",
"SUMOLOGIC_ACCESS_KEY": "<your-access-key>",
"SUMOLOGIC_ENDPOINT": "https://api.sumologic.com"
}
}
}
}
```
**Or run directly:**
```bash
export SUMOLOGIC_ACCESS_ID="your-access-id"
export SUMOLOGIC_ACCESS_KEY="your-access-key"
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp
```
## Tool Reference
### Search & Analytics (4 tools)
| Tool | Description | Required Params |
|---|---|---|
| `search_logs` | Execute a log search (full lifecycle: create job, poll, fetch, cleanup) | `query` |
| `get_search_status` | Check status of a running search job | `job_id` |
| `get_search_results` | Fetch messages or records from a search job | `job_id` |
| `cancel_search` | Cancel a running search job | `job_id` |
**`search_logs` optional params:** `from_time` (default `-15m`), `to_time` (default `now`), `timezone` (default `UTC`), `limit` (default `100`), `by_receipt_time`, `timeout` (default `300s`).
**Time formats:** ISO 8601 (`2024-01-15T09:00:00`), relative (`-15m`, `-1h`, `-2d`, `-1w`), epoch ms (`1718745600000`), or `now`.
### Monitor Management (10 tools)
| Tool | Description | Required Params |
|---|---|---|
| `list_monitors` | List all monitors | — |
| `search_monitors` | Search by name or status filter | `query` |
| `get_monitor` | Get full monitor configuration | `monitor_id` |
| `create_monitor` | Create a new monitor | `name`, `query`, `threshold` |
| `update_monitor` | Update monitor config (read-modify-write) | `monitor_id`, `fields_json` |
| `delete_monitor` | Delete a monitor (irreversible) | `monitor_id` |
| `enable_monitor` | Enable a disabled monitor | `monitor_id` |
| `disable_monitor` | Disable a monitor | `monitor_id` |
| `get_monitor_status` | Get current health/triggering state | `monitor_id` |
| `get_monitor_history` | Get alert history for a monitor | `monitor_id` |
### Alert Management (3 tools)
| Tool | Description | Required Params |
|---|---|---|
| `get_active_alerts` | Get all currently firing alerts | — |
| `get_alert_details` | Get detailed alert info for a monitor | `monitor_id` |
| `resolve_alert` | Resolve an alert by disabling its monitor | `monitor_id` |
### Dashboard Management (5 tools)
| Tool | Description | Required Params |
|---|---|---|
| `list_dashboards` | List dashboards with pagination | — |
| `get_dashboard` | Get full dashboard config | `dashboard_id` |
| `create_dashboard` | Create a dashboard with panels and layout | `title`, `panels_json`, `layout_json` |
| `update_dashboard` | Update dashboard config (read-modify-write) | `dashboard_id`, `fields_json` |
| `delete_dashboard` | Delete a dashboard (irreversible) | `dashboard_id` |
### Collector & Source Management (8 tools)
| Tool | Description | Required Params |
|---|---|---|
| `list_collectors` | List all collectors | — |
| `get_collector` | Get collector configuration | `collector_id` |
| `create_hosted_collector` | Create a new Hosted collector | `name` |
| `update_collector` | Update collector config (with ETag locking) | `collector_id`, `fields_json` |
| `delete_collector` | Delete a collector and its sources | `collector_id` |
| `list_sources` | List sources on a collector | `collector_id` |
| `get_source` | Get source configuration | `collector_id`, `source_id` |
| `create_http_source` | Create an HTTP source (returns endpoint URL) | `collector_id`, `name` |
### Metrics (4 tools)
| Tool | Description | Required Params |
|---|---|---|
| `query_metrics` | Execute a metrics query | `query` |
| `list_metric_definitions` | Discover available metric names | — |
| `get_metric_metadata` | Get dimensions for a metric | `metric_name` |
| `list_metric_namespaces` | List metric content types | — |
### Content Library (3 tools)
| Tool | Description | Required Params |
|---|---|---|
| `get_personal_folder` | Get your personal content folder and children | — |
| `get_folder` | Get a folder and its child items | `folder_id` |
| `get_content_by_path` | Look up content by library path | `path` |
### Administration (8 tools)
| Tool | Description | Required Params |
|---|---|---|
| `list_users` | List all users with emails, roles, status | — |
| `list_roles` | List roles with capabilities and filters (v2) | — |
| `list_fields` | List all fields (built-in + custom) | — |
| `list_field_extraction_rules` | List FERs with scopes and parse expressions | — |
| `list_partitions` | List partitions with routing and retention | — |
| `list_lookup_tables` | List lookup tables with schemas | — |
| `get_lookup_table` | Get a lookup table's config and fields | `table_id` |
| `list_ingest_budgets` | List ingest budgets with scopes and capacity | — |
### Utility (3 tools)
| Tool | Description | Required Params |
|---|---|---|
| `check_connection` | Verify API connectivity and auth | — |
| `get_account_usage` | Get account status and ingestion info | — |
| `validate_query` | Check if a query is syntactically valid | `query` |
## Usage Examples
Once configured, just ask your AI assistant naturally:
```
"Search for 500 errors in the last hour"
"Show me all critical alerts"
"Create a monitor for high error rates on our API"
"List all hosted collectors"
"What CPU metrics are available?"
"Show me the field extraction rules"
"List all partitions and their retention periods"
```
## Development
```bash
git clone https://github.com/rajfirke/sumo-logic-mcp.git
cd sumo-logic-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
# Lint
ruff check src/ tests/
# Test
pytest -v
# Run locally
export SUMOLOGIC_ACCESS_ID="..."
export SUMOLOGIC_ACCESS_KEY="..."
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp
```
## Architecture
```
src/sumo_logic_mcp/
├── __init__.py # Exports mcp, triggers tool registration
├── __main__.py # Entry point: python -m sumo_logic_mcp
├── server.py # FastMCP instance + lifespan (shared HTTP client)
├── client.py # Async HTTP client (httpx, Basic Auth, retry, cookies)
├── validation.py # Time parsing and validation
└── tools/
├── __init__.py # Imports all tool modules
├── search.py # 4 search tools
├── monitors.py # 10 monitor tools
├── alerts.py # 3 alert tools
├── dashboards.py # 5 dashboard tools
├── collectors.py # 8 collector/source tools
├── metrics.py # 4 metrics tools
├── content.py # 3 content library tools
├── admin.py # 8 admin tools (users, roles, fields, partitions, etc.)
└── utils.py # 3 utility tools
```
