Last9 MCP Server

Your AI agent doesn’t know what’s broken in production. This fixes that.

Last9 MCP Server connects Claude, Cursor, Windsurf, and any other MCP-capable AI assistant directly to your production observability data — logs, metrics, traces, exceptions, database queries, alerts, and deployments. The agent stops guessing and starts reading the actual signal.

• Watch the demo
• Announcement post

---

Start in 30 seconds (Hosted)

No binary to install. No tokens to manage. One URL, OAuth in your browser, done.

Find your org slug in your Last9 URL: app.last9.io//...

Claude Code

claude mcp add --transport http last9 https://app.last9.io/api/v4/organizations//mcp

Type /mcp, select last9, authenticate. That’s it.

Cursor

Settings > MCP > Add New MCP Server:

{
  "mcpServers": {
    "last9": {
      "type": "http",
      "url": "https://app.last9.io/api/v4/organizations//mcp"
    }
  }
}

Click Connect, complete OAuth.

VS Code

Requires v1.99+. Open Command Palette → MCP: Add Server, paste the URL, authenticate.

Or directly in settings.json:

{
  "mcp": {
    "servers": {
      "last9": {
        "type": "http",
        "url": "https://app.last9.io/api/v4/organizations//mcp"
      }
    }
  }
}

Windsurf

Settings > Cascade > Open MCP Marketplace > gear icon (mcp_config.json):

{
  "mcpServers": {
    "last9": {
      "serverUrl": "https://app.last9.io/api/v4/organizations//mcp"
    }
  }
}

Claude Web/Desktop

Settings > Connectors > Add custom connector. Name it last9, paste the URL, authenticate.

Requires admin access to your Claude organization.

---

Self-Hosted (STDIO)

Use this when your MCP client doesn’t support HTTP transport, or when you need the server running locally.

Install

Homebrew:

brew install last9/tap/last9-mcp

NPM:

npm install -g @last9/mcp-server@latest
# or directly:
npx -y @last9/mcp-server@latest

Binary releases (Windows / manual):

Download from GitHub Releases:

Get a Refresh Token

Only admins can create tokens.

1. Go to API Access
2. Click Generate Token with Write permissions
3. Copy it

Client Configuration

Homebrew:

{
  "mcpServers": {
    "last9": {
      "command": "/opt/homebrew/bin/last9-mcp",
      "env": {
        "LAST9_REFRESH_TOKEN": ""
      }
    }
  }
}

NPM:

{
  "mcpServers": {
    "last9": {
      "command": "npx",
      "args": ["-y", "@last9/mcp-server@latest"],
      "env": {
        "LAST9_REFRESH_TOKEN": ""
      }
    }
  }
}

Where to paste this:

Environment Variables

---

What It Can Do

Service Health

• get_service_summary — Ranked fleet (service, env) rows: interval request_count, throughput_rpm, HTTP 4xx/5xx counts, and gRPC error counts
• get_service_environments — Available environments for your services. Run this first — other APM tools need env from here
• get_service_performance_details — Full breakdown: throughput, error rate, p50/p90/p95/avg/max, apdex, availability
• get_service_operations_summary — Operations grouped by HTTP endpoints, DB calls, messaging, HTTP clients
• get_service_dependency_graph — Dependency map with throughput, latency, and error rates for upstream/downstream/infra
• get_apm_service_deviations — Compare a current window against an equal-duration baseline: regressions/improvements, Apdex reconciliation, and a terminal outcome (fleet or single service)
• get_exceptions — Server-side exceptions with service and span filters

Database Observability

Four tools that go directly at your database performance, derived from OpenTelemetry trace spans. No extra instrumentation needed if you’re already using OTel.

• get_databases — Discover all databases across your infrastructure: DB type, host, throughput (queries/min), p95 latency, error rate, number of dependent services
• get_database_slow_queries — The actual slowest query executions, ordered by duration, with trace IDs for drilling into full traces
• get_database_queries — Query patterns and aggregates: how often a query runs, average/p95 duration, error rate
• get_database_server_metrics — Server-side metrics from the DB host itself (CPU, connections, buffer hit rates — depends on your DB system)

Supports PostgreSQL, MySQL, MongoDB, Redis, Aerospike, and anything else OTel traces with a db_system attribute.

Prometheus / PromQL

• prometheus_range_query — PromQL range queries over any metric
• prometheus_instant_query — Instant queries; use rollup functions like avg_over_time, sum_over_time
• prometheus_label_values — Label values for a given series
• prometheus_labels — All labels available for a series

Point these at a different datasource/cluster than the default by setting LAST9_DATASOURCE.

Logs

• get_logs — Full JSON pipeline log queries (aggregations, filters, field extraction)
• get_service_logs — Raw log lines for a service, filterable by severity and body content
• get_log_attributes — Global catalog of attributes in the log schema for a time window
• get_log_attributes_for_pipeline — Log fields actually present for an in-progress pipeline (scoped discovery), each with its exact filter_field
• get_drop_rules — Log drop rules from Last9 Control Plane
• add_drop_rule — Create a new drop rule to cut log volume at the source

Traces

• get_traces — JSON pipeline trace queries for broad searches and aggregations
• get_service_traces — Traces by exact trace ID or service name. Use this when you have a trace ID — it’s faster
• get_trace_attributes — Global catalog of attributes in the trace schema
• get_trace_attributes_for_pipeline — Attributes actually present for an in-progress pipeline (scoped discovery), each with its exact filter_field
• get_trace_attribute_values — Distinct values for a trace attribute, optionally scoped to a pipeline
• get_trace_attribute_deviations — Ranks attribute values that differ between two bounded span cohorts (slow vs fast, error vs non-error, or two time windows). Correlation, not cause
• get_trace_waterfall — One exact trace as a parent/child waterfall with interval-union self-time, slowest spans, and graph warnings

Change Events & Alerts

• get_change_events — Deployments, config changes, rollbacks. Correlate incidents with what changed
• get_alert_config — Alert rule configurations — searchable by name, severity, type, tags
• get_alerts — Currently firing alerts within a time window
• get_alert_rule_state — Historical firing state (1/0) per alert rule over a time range, grouped by rule_id. Filterable by alert group, rule name, label filters, and state.
• get_notification_channels — Configured notification channels (Slack, PagerDuty, email, etc.)

Custom Dashboards

• list_dashboards — All custom dashboards in your org: IDs, names, and metadata
• get_dashboard — Full dashboard definition by ID, including panels and queries
• create_dashboard — Create a new custom dashboard with panels, queries, and metadata
• update_dashboard — Update an existing dashboard by ID (readonly system dashboards return an error)
• delete_dashboard — Delete a custom dashboard by ID
• list_dashboard_snapshots — Frozen point-in-time snapshots for a dashboard (metadata only)
• get_dashboard_snapshot — Full frozen snapshot including panel data for RCA / shareable views
• delete_dashboard_snapshot — Delete a frozen snapshot by ID

Fuzzy Name Resolution

• did_you_mean — When the agent isn’t sure about an entity name, this returns the closest matches from your catalog (services, environments, hosts, databases, K8s deployments/namespaces, jobs). Up to 3 suggestions with similarity scores. The server calls this automatically before most tools when a name lookup returns empty.

---

How It Works

Deep links on every response. Every tool returns a deep_link field — a direct URL into the Last9 dashboard for that exact query and time range. The agent can hand you the link; you click it; you’re there.

Toolsets. By default the server exposes every tool. Automation hosts that only need investigation (logs/traces/metrics) can set LAST9_TOOLSETS=investigate (or pass --toolsets=investigate) so tools/list stays small without client-side mass-disable. Named packs: logs, traces, metrics, alerts, dashboards, investigate, all. Unknown names fail fast. The metrics pack alone does not include list_datasources or did_you_mean — use investigate (or combine toolsets) when you need those discovery helpers.

Tool reference resources. Long logjson/tracejson/service-logs/metrics manuals are MCP resources (last9://reference/logjson, last9://reference/tracejson, last9://reference/service_logs, last9://reference/metrics), not always-on tool description text. Critical query rules stay on the tool description so agents that never call resources/read still get correct construction guidance. Discover org-specific fields with get_log_attributes / get_log_attributes_for_pipeline (and the trace equivalents)—they are not injected into descriptions.

Chunked large results. get_logs and get_traces handle large result sets through chunking rather than truncating. The default limit is 5000 entries for logs; configurable via LAST9_MAX_GET_LOGS_ENTRIES.

---

Development

---

Tool Reference

---

Testing

See TESTING.md for integration test setup and instructions.

---