MCP Graylog

MCP Graylog is a Model Context Protocol server for querying Graylog 6+ from AI assistants. The default transport is Codex stdio. Streamable HTTP is available only when you explicitly opt in for a remote, shared, or containerized runtime. The server uses MCP Python SDK 2.x and supports its current and legacy protocol revisions.

Install Dependencies

Use Python 3.11 or newer. If you are new to Python projects, the safest setup is to keep this server in its own virtual environment.

1. Install Python 3.11+ and uv.

   On macOS with Homebrew:

   brew install [email protected] uv
   

   If Python is already installed, you can install uv with pip:

   python3 -m pip install --user uv
   

2. Create and activate a virtual environment from the repository root:

   uv venv venv --python 3.11
   source venv/bin/activate
   

3. Install the server dependencies:

   uv pip install -e .
   

   For development, tests, linting, and type checks, install the dev extras:

   uv pip install -e ".[dev]"
   

4. Check that the command is available:

   uv run mcp-graylog --help
   

5. If you installed the dev extras, run the test suite:

   uv run pytest -q
   

Quick Start: Codex Stdio

Install the project dependencies, then add this server to your Codex config:

[mcp_servers.graylog]
command = "uv"
args = ["run", "mcp-graylog"]

[mcp_servers.graylog.env]
GRAYLOG_ENDPOINT = "https://graylog.example.com"
GRAYLOG_TOKEN = "gl2-your-token"
MCP_SERVER_TRANSPORT = "stdio"

Run the command from this repository when Codex starts the MCP server:

uv run mcp-graylog

Token authentication with GRAYLOG_TOKEN is preferred. Legacy basic credentials are still supported by the runtime for older installations, but new setups should use a Graylog access token.

MCP Client Configuration Examples

All local client examples use stdio. Run them from this repository checkout, or replace uv with an absolute command that can start mcp-graylog in your environment.

Codex

Add this to ~/.codex/config.toml:

[mcp_servers.graylog]
command = "uv"
args = ["run", "mcp-graylog"]

[mcp_servers.graylog.env]
GRAYLOG_ENDPOINT = "https://graylog.example.com"
GRAYLOG_TOKEN = "gl2-your-token"
MCP_SERVER_TRANSPORT = "stdio"

Claude Code

For a project-shared server, add .mcp.json at the repository root:

{
  "mcpServers": {
    "graylog": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "mcp-graylog"],
      "env": {
        "GRAYLOG_ENDPOINT": "https://graylog.example.com",
        "GRAYLOG_TOKEN": "gl2-your-token",
        "MCP_SERVER_TRANSPORT": "stdio"
      }
    }
  }
}

Equivalent CLI setup:

claude mcp add-json graylog '{"type":"stdio","command":"uv","args":["run","mcp-graylog"],"env":{"GRAYLOG_ENDPOINT":"https://graylog.example.com","GRAYLOG_TOKEN":"gl2-your-token","MCP_SERVER_TRANSPORT":"stdio"}}'