# Last9 MCP > Connect your AI client to Last9 logs, traces, metrics, alerts, and dashboards through MCP. Source: https://last9.io/docs/ai/mcp/ Last9's MCP server lets your AI assistant query production telemetry from your IDE. Ask questions such as "What's causing the recent spike in errors?" or "Show me the slowest endpoints from the last hour", then open the supporting Last9 data from the response. Use [AI Assistant](/docs/ai/ai-assistant/) for chat in Last9 or [agent skills](/docs/ai/agent-skills/) for instructions your coding agent can follow. To connect your own bot or investigation service, see [Build your own AI SRE](/docs/ai/build-your-own-ai-sre/). ## What is Model Context Protocol? [MCP](https://modelcontextprotocol.io/introduction) is an open protocol for connecting AI applications to tools and data sources. Last9 MCP exposes tools to query telemetry, inspect service dependencies, review alerts, and manage dashboards. Your client chooses which tools to call and uses their results to answer your question. :::note Last9 MCP provides the tools, and your AI client or agent controls which calls need confirmation. Review its tool permissions before enabling actions such as creating, updating, or deleting dashboards. ::: ## Why use Last9 MCP? Connect Last9 MCP to investigate production behavior alongside your code: - Query the logs and traces for a failing request. - Compare service latency, errors, and dependencies over a specific time window. - Give a coding agent evidence to use when proposing a fix. Start with the service, environment, and incident window. For a complete investigation workflow, see [Investigate an incident](/docs/ai/investigate-an-incident/). ## Example use cases ### Debug production exceptions ``` "I'm seeing errors in production. Can you help me understand what's happening?" ``` _Agent uses `get_exceptions` and `get_service_performance_details` to analyze the issue_ ### Performance investigation ``` "My API response times seem slow. What's causing the latency?" ``` _Agent uses `get_service_dependency_graph` and `prometheus_range_query` to identify bottlenecks_ ### Trace waterfall analysis ``` "I have a slow trace ID. Show me where the time is going." ``` _Agent uses `get_trace_waterfall` to return a bounded parent/child waterfall with millisecond timing, self-time, and the slowest spans_ ### Compare slow vs fast spans ``` "What attributes differ between slow and fast requests on checkout-service?" ``` _Agent uses `get_trace_attribute_deviations` with `comparison_mode: latency` to rank attribute values that correlate with slow spans_ ### Detect performance regressions ``` "What services regressed in the last hour compared to the previous hour?" ``` _Agent uses `get_apm_service_deviations` to compare the current window against an equal-duration baseline and return regressions/improvements leaderboards_ ### Log analysis for issues ``` "Find error logs from the user-service in the last 30 minutes" ``` The agent can use `get_service_logs` to read service log lines, or `get_logs` with a LogJSON pipeline to filter and aggregate them. ### Correlate incidents with deployments ``` "We had performance issues around 2pm. Were there any deployments around that time?" ``` _Agent uses `get_change_events` to check for recent deployments and `get_service_performance_details` to analyze the correlation_ ### Database performance investigation ``` "Which databases are my services hitting, and what are the slowest PostgreSQL queries in prod right now?" ``` _Agent uses `get_databases`, `get_database_queries`, `get_database_slow_queries`, and `get_database_server_metrics` to connect database load, slow queries, and exporter-backed server health_ ### Auto-correct typos in entity names ``` "Can you look up last9-apiii logs" ``` The agent can use `did_you_mean` to suggest matching entity names. Confirm the intended service before querying its logs. ## Prerequisites Before setting up Last9 MCP, ensure you have: - Telemetry flowing to your Last9 organization. - One of the supported clients: Claude Code, Cursor, VS Code, Windsurf, Claude.ai / Claude Desktop, Codex CLI, or ChatGPT - A Last9 account with access to the organization you want to query. Check your connection settings on the [MCP](https://app.last9.io/mcp) page in Last9. ## Setup :::tip[Recommended: use the hosted MCP server] Connect to `https://app.last9.io/api/v4/organizations//mcp` and authorize access with your Last9 account. The hosted server requires no local binary. For your own application, see [MCP for agents](/docs/ai/mcp-for-agents/). ::: 1. **Find your organization slug** Your org slug is in your Last9 URL when logged in: ``` https://app.last9.io/v2/organizations//... ``` For example, if your URL contains `/v2/organizations/acme/`, your slug is `acme`. 2. **Configure your IDE** Choose your client below, replace ``, and complete its OAuth sign-in flow. **Claude Code** 1. Run the following command to add the Last9 MCP server: ```bash claude mcp add --transport http last9 "https://app.last9.io/api/v4/organizations//mcp" ``` 2. Replace `` with your organization slug 3. Type `/mcp` in Claude Code, select the **last9** server, and authenticate 4. After authorizing, check the server's available tools in your session. **Cursor** 1. Open Cursor → **Settings** → **Cursor Settings** → **MCP** 2. Click **Add New MCP Server** 3. Add the configuration: ```json { "mcpServers": { "last9": { "type": "http", "url": "https://app.last9.io/api/v4/organizations//mcp" } } } ``` 4. Replace `` with your organization slug 5. Save, then select **Connect** for the server. 6. Click **Connect** → a browser window opens → authorize with your Last9 account **VS Code** See the [VS Code MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers) for client settings and permissions. 1. Open the Command Palette (`cmd+shift+P` on macOS / `ctrl+shift+P` on Windows/Linux) 2. Select **MCP: Add Server** → choose **HTTP** as the type 3. Paste the server URL with your organization slug: ``` https://app.last9.io/api/v4/organizations//mcp ``` 4. Enter `last9` as the server name 5. Choose **Global** or **Workspace** scope 6. Complete the OAuth sign-in flow in your browser when VS Code prompts you. **Windsurf** 1. Open Windsurf → **Settings** → **Cascade** → click **Open MCP Marketplace** 2. Click the gear icon (⚙) to open `mcp_config.json` 3. Add the Last9 MCP server configuration: ```json { "mcpServers": { "last9": { "serverUrl": "https://app.last9.io/api/v4/organizations//mcp" } } } ``` 4. Replace `` with your organization slug 5. Save the file and follow Windsurf's authentication prompt. 6. Complete the OAuth flow in your browser to authorize Last9 access **Claude.ai / Claude Desktop** > **Note:** Admin access to your Claude organization is required to add custom connectors. For more details, see the [Claude custom connectors guide](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp). 1. Go to **Settings** → **Connectors** → click **Add custom connector** 2. Enter `last9` as the **Name** 3. Paste the **Remote MCP server URL** with your organization slug: ``` https://app.last9.io/api/v4/organizations//mcp ``` 4. Click **Add** 5. Go to **Customize** → **Connectors** → select **last9** under "Not connected" 6. Click **Connect** and complete the OAuth flow in your browser **Codex CLI** **Option A: CLI commands** ```bash codex mcp add last9 --url "https://app.last9.io/api/v4/organizations//mcp" codex mcp login last9 ``` **Option B: manual config** in `~/.codex/config.toml`: ```toml [mcp_servers.last9] url = "https://app.last9.io/api/v4/organizations//mcp" ``` Replace `` with your organization slug. After saving manual configuration, run `codex mcp login last9` to authorize access. See the [Codex MCP documentation](https://developers.openai.com/codex/mcp). **ChatGPT** Use a ChatGPT web workspace that supports custom MCP apps. Your workspace administrator may need to enable developer mode. Check [ChatGPT developer mode availability and permissions](https://help.openai.com/en/articles/12584461-developer-mode-and-full-mcp-connectors-in-chatgpt-beta). 1. **Enable Developer Mode** Go to **Settings** → **Apps** → **Advanced settings** and enable **Developer mode**, where available. 2. **Create an app** Go to **Settings** → **Apps** and click **Create**. 3. Enter the app details: - **Name:** `Last9` - **Description:** `Query Last9 logs, traces, metrics, alerts, and deployments` - **MCP server URL:** ``` https://app.last9.io/api/v4/organizations//mcp ``` Replace `` with your organization slug. 4. Select OAuth authentication, complete the Last9 sign-in flow, and use **Scan Tools** to review the available tools. Finish creating the app. 5. Select the app in the conversation where you want to use it. Try: "What exceptions occurred in the last hour?" Review any tool confirmation requests before proceeding. 3. **Verify the connection** Once configured, your AI agent will have access to Last9 tools. Try asking: _"What exceptions occurred in the last hour?"_ or _"Show me the performance summary for my services."_ ## Using Last9 MCP with OpenAI's Responses API Connect the Responses API to the hosted Last9 MCP endpoint. The example below permits only two read tools and skips approval for those tools. Set `OPENAI_MODEL` to a model that supports remote MCP, `LAST9_ORG_SLUG` to your organization slug, and `LAST9_MCP_TOKEN` to an [MCP client token](/docs/ai/mcp-for-agents/#get-an-mcp-token). ```python import os from openai import OpenAI client = OpenAI() response = client.responses.create( model=os.environ["OPENAI_MODEL"], tools=[ { "type": "mcp", "server_label": "last9", "server_url": ( "https://app.last9.io/api/v4/organizations/" f"{os.environ['LAST9_ORG_SLUG']}/mcp" ), "authorization": os.environ["LAST9_MCP_TOKEN"], "allowed_tools": ["get_service_profile", "get_service_logs"], "require_approval": "never", } ], input=( "Inspect payment-service errors in production over the last 15 minutes. " "Read its service profile and relevant log lines. " "Summarize the evidence and any missing information." ), ) print(response.output_text) ``` Keep the allowlist specific to your task. To require approval, handle the API's `mcp_approval_request` response before continuing the tool call. See the [OpenAI remote MCP guide](https://developers.openai.com/api/docs/guides/tools-connectors-mcp) for authentication, tool filters, and approval handling. ## Advanced: Self-hosting the MCP server Run the open-source server locally when you need to manage its process or choose which toolsets it exposes. The server still needs network access to Last9. **Install:** ```bash # Homebrew (macOS/Linux) brew tap last9/tap && brew install last9-mcp # NPM (cross-platform, including Windows) npm install -g @last9/mcp-server@latest ``` You can also download platform-specific binaries from [GitHub Releases](https://github.com/last9/last9-mcp-server/releases/latest). **Get a Refresh Token** (admin required) from [API Access](https://app.last9.io/settings/api-access). :::tip **One token per developer.** Create a separate refresh token for each individual developer rather than sharing one token across the team. This gives you a clear audit trail and lets you revoke access for a specific person without affecting others. ::: **Configure your IDE** using the local binary path and `LAST9_REFRESH_TOKEN`: ```json { "mcpServers": { "last9": { "command": "/opt/homebrew/bin/last9-mcp", "env": { "LAST9_REFRESH_TOKEN": "" } } } } ``` For VS Code's `.vscode/mcp.json`, use a top-level `"servers"` object keyed by `"last9"`, with `"type": "stdio"`, `"command"`, and `"env"` inside it. See the [VS Code configuration reference](https://code.visualstudio.com/docs/agents/reference/mcp-configuration) and [Last9 MCP server README](https://github.com/last9/last9-mcp-server) for configuration options. **Toolsets (optional).** By default the server exposes every tool. For automation hosts that only need investigation workflows, set `LAST9_TOOLSETS` (alias `LAST9_MCP_TOOLSETS`) or pass `--toolsets` to limit what appears in `tools/list`: ```json { "mcpServers": { "last9": { "command": "/opt/homebrew/bin/last9-mcp", "env": { "LAST9_REFRESH_TOKEN": "", "LAST9_TOOLSETS": "investigate" } } } } ``` Valid toolset names are `logs`, `traces`, `metrics`, `alerts`, `dashboards`, `investigate`, and `all`. Use a comma-separated list. An unset or empty value, or `all`, exposes every tool. Unknown names stop the server at startup. The `investigate` toolset includes logs, traces, metrics, and the discovery tools `did_you_mean`, `get_service_profile`, and `list_datasources`. **Reference resources.** The server provides five resources: `last9://reference/logjson`, `last9://reference/tracejson`, `last9://reference/service_logs`, `last9://reference/metrics`, and `last9://reference/investigation`. Clients that support MCP resources can discover and read them through `resources/list` and `resources/read`. Tool descriptions include essential query rules. Discover your organization's field names with `get_log_attributes_for_pipeline` and `get_trace_attributes_for_pipeline`. Clients that support MCP prompts can discover six guided investigation prompts through `prompts/list`: `scoped-log-attribute-discovery`, `exception-root-cause-investigation`, `investigate-latency-spike`, `diagnose-error-rate`, `analyze-slow-queries`, and `on-call-runbook`. Check the returned prompt definition for its required inputs. ## Available tools The reference below describes Last9 MCP tools. Availability and parameters depend on your connected server version and configuration. Inspect `tools/list` for its current schemas. {/* prettier-ignore-start */} ### Observability & APM 1. **`get_exceptions`**: Get server-side exceptions over a specified time range. For log-heavy services, the tool may continue to logs via aggregate-then-read: aggregate to isolate the hot logger, then read that logger's lines with a `limit` to reach the error text.
View parameters - `limit` (integer, optional): Maximum number of exceptions to return. Default: 20 - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format. Leave empty to use lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Leave empty to default to current time - `service_name` (string, optional): Filter by service name - `span_name` (string, optional): Name of the span to filter by - `env` (string, optional): Filter by environment
2. **`get_service_summary`**: Rank services using request counts, requests per minute, and HTTP or gRPC error counts over a time window.
View parameters - `lookback_minutes` (integer, optional): Number of minutes to look back. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: end_time_iso - 1 hour - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time - `env` (string, optional): Environment regex. Default: `.*` - `sort_by` (string, optional): Ranking field; use the connected tool schema for supported values - `limit` (integer, optional): Maximum number of services to return
3. **`get_service_environments`**: Get available service environments within a specified time range.
View parameters - `service_name` (string, optional): Service to find environments for - `lookback_minutes` (integer, optional): Number of minutes to look back. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time Returns available environments for use with other APM tools.
4. **`get_service_performance_details`**: Get detailed performance metrics for a specific service.
View parameters - `service_name` (string, required): Service name - `lookback_minutes` (integer, optional): Number of minutes to look back. Default: 60 - `top_n` (integer, optional): Number of results. Default: 10; maximum: 100 - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: Now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time - `env` (string, optional): Environment filter. Default: `.*`
5. **`get_service_operations_summary`**: Get operations summary for a service like HTTP endpoints, database queries, messaging producer, and HTTP client calls.
View parameters - `service_name` (string, required): Service name - `lookback_minutes` (integer, optional): Number of minutes to look back. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: Now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time - `env` (string, optional): Environment filter. Default: `.*`
6. **`get_service_dependency_graph`**: Get service dependency graph showing incoming and outgoing dependencies, including infra. Includes throughput, response times and error rates.
View parameters - `service_name` (string, optional): Name of the service - `lookback_minutes` (integer, optional): Number of minutes to look back. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time - `env` (string, optional): Environment filter. Default: `.*`
7. **`get_change_events`**: Retrieves change events from the `last9_change_events` Prometheus metric to help correlate deployments and system modifications with performance issues or incidents.
View parameters - `start_time_iso` (string, optional): Start time in RFC3339 format. Defaults to now - lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Defaults to current time - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `service_name` (string, optional): Filter by service name - `env` (string, optional): Environment filter - `event_name` (string, optional): Specific event type filter (use available_event_names to see valid values) **Returns**: - `available_event_names`: List of all available event types that can be used for filtering - `change_events`: Array of timeseries data with metric labels and timestamp-value pairs - `count`: Total number of change events returned - `time_range`: Start and end time of the query window **Common event types**: deployment, config_change, rollback, scale_up/scale_down, restart, upgrade/downgrade, maintenance, backup/restore, health_check, certificate, database **Best practices**: 1. First call without event_name to get available_event_names 2. Use exact event name from available_event_names for the event_name parameter 3. Combine with other filters (service_name, env, time) for precise results
8. **`get_apm_service_deviations`**: Compare APM performance across a current window and an equal-duration baseline. Use for regressions/improvements, incident-vs-prior-period comparisons, and fleet deviation discovery.
View parameters - `service_name` (string, optional): Omit for fleet scope; provide for one service and its operation correlations - `env` (string, optional): Filter to one deployment environment - `lookback_minutes` (integer, optional): Current window length ending now. Default: 60 - `start_time_iso` / `end_time_iso` (string, optional): Explicit current window - `baseline_start_time_iso` / `baseline_end_time_iso` (string, optional): Equal-duration baseline window; defaults to the immediately preceding period - `datasource` (string, optional): Select one datasource for the comparison - `max_services` / `max_operations` (integer, optional): Default: 10, maximum: 10 **Returns**: `regressions` and `improvements` leaderboards, `evidence_quality`, Apdex reconciliation, and a terminal `outcome`. Treat `stable`, `no_data`, and `unsupported_workload_shape` as terminal — answer from the result without automatic follow-up tool calls. V1 supports server-request workloads.
### Database investigation 1. **`get_databases`**: Discover databases from available telemetry. Trace-derived results include database type, host, throughput, p95 latency, error rate, and service counts. Connected servers that support infrastructure or CloudWatch metric discovery can also return databases found through those signals. Metric-only results may not include trace latency or throughput.
View parameters - `env` (string, optional): Environment regex, such as `prod|staging` - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60; current server limits the window to seven days - `start_time_iso` (string, optional): Start time in RFC3339 format. Overrides lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format **Useful for**: - Discovering which databases your services are talking to - Ranking database backends by throughput, latency, and error rate - Identifying shared databases used by many services
2. **`get_database_slow_queries`**: Find the slowest database operations from traces and, when available, slow-query logs. Results are sorted by duration descending.
View parameters - `db_system` (string, optional): Database system filter such as `postgresql`, `mysql`, `mongodb`, or `redis` - `host` (string, optional): Database host filter using `net_peer_name` - `service_name` (string, optional): Calling service name filter - `env` (string, optional): Deployment environment filter - `min_duration_ms` (number, optional): Minimum query duration in milliseconds - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format - `end_time_iso` (string, optional): End time in RFC3339 format - `limit` (integer, optional): Maximum number of slow queries to return. Default: 20 **Returns**: - Query source (`trace` or `log`) - Trace and span IDs when available - Service name, database system, query pattern or statement, duration, status, and timestamp - Slow-query metadata from logs such as plan summaries or rows examined when present
3. **`get_database_queries`**: Get the top query patterns for a specific database, aggregated by operation. Helps identify hot, slow, or error-prone query shapes.
View parameters - `db_system` (string, required): Database system such as `postgresql`, `mysql`, `mongodb`, or `redis` - `host` (string, optional): Database host filter using `net_peer_name` - `env` (string, optional): Deployment environment filter - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format - `end_time_iso` (string, optional): End time in RFC3339 format - `sort_by` (string, optional): Sort by `throughput` (default), `latency`, or `errors` **Returns**: - `span_name` - `calls_per_min` - `avg_latency_ms` - `p95_latency_ms` - `error_rate_pct`
4. **`get_database_server_metrics`**: Discover server-side database metrics from exporters and query key health signals such as connection utilization, cache hit ratios, replication lag, and throughput.
View parameters - `db_system` (string, optional): Focus on a specific database type. Supported values: `postgresql`, `mysql`, `oracle`, `redis`, `mongodb`, `mssql`, `elasticsearch`, `aerospike` - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `start_time_iso` (string, optional): Start time in RFC3339 format - `end_time_iso` (string, optional): End time in RFC3339 format **Notes**: - If `db_system` is omitted, the tool auto-discovers available exporters - Requires database exporters such as `postgres_exporter`, `mysqld_exporter`, `redis_exporter`, or `mongodb_exporter` to be scraped into Prometheus or Levitate - Complements client-side trace data with server-side health metrics
### Prometheus integration 1. **`list_datasources`**: List all available datasources configured for your organization. Use this before Prometheus queries to discover valid datasource names.
Returns - Array of datasource objects, each with: - `name`: datasource identifier to pass via the `datasource` parameter in Prometheus tools - `is_default`: `true` for the datasource used when no `datasource` is specified
2. **`prometheus_range_query`**: Execute Prometheus range queries for metrics over a time period.
View parameters - `query` (string, required): Range query to execute - `lookback_minutes` (integer, optional): Window ending now when absolute bounds are omitted - `datasource` (string, optional): Datasource name from `list_datasources` - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time
3. **`prometheus_instant_query`**: Execute Prometheus instant queries for metrics at a specific point in time.
View parameters - `query` (string, required): Instant query to execute - `lookback_minutes` (integer, optional): Minutes before now to evaluate when `time_iso` is omitted - `datasource` (string, optional): Datasource name from `list_datasources` - `time_iso` (string, optional): Time in RFC3339 format. Default: Current time
4. **`prometheus_label_values`**: Get all label values for a specific label name.
View parameters - `match_query` (string, required): Valid PromQL filter query - `label` (string, required): Label to get values for - `lookback_minutes` (integer, optional): Window ending now when absolute bounds are omitted - `datasource` (string, optional): Datasource name from `list_datasources` - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time
5. **`prometheus_labels`**: Get all available label names.
View parameters - `match_query` (string, required): Valid PromQL filter query - `lookback_minutes` (integer, optional): Window ending now when absolute bounds are omitted - `datasource` (string, optional): Datasource name from `list_datasources` - `start_time_iso` (string, optional): Start time in RFC3339 format. Default: now - 60 minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Default: Current time
### Log management 1. **`get_logs`**: Runs a LogJSON pipeline to filter, transform, or aggregate logs. Use `get_service_logs` for raw service log lines.
View parameters - `logjson_query` (array, required): LogJSON pipeline. Read `last9://reference/logjson` for query syntax - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 5 - `start_time_iso` (string, optional): Start time in RFC3339/ISO 8601 format. Use with `end_time_iso` for an absolute time range - `end_time_iso` (string, optional): End time in RFC3339/ISO 8601 format. Use with `start_time_iso` for an absolute time range - `limit` (integer, optional): Result limit. Defaults depend on the pipeline shape and the server's configured cap - `index` (string, optional): `physical_index:` or `rehydration_index:`
2. **`get_service_logs`**: Retrieves raw log entries for a specific service with advanced filtering capabilities. Useful for debugging issues, monitoring service behavior, and analyzing specific log patterns. Additional filters include `http_status_class`, `http_status_code`, `http_status_field`, `attribute_filters`, and `index`. Use status-class filtering for groups such as 4xx or 5xx; check the connected schema for accepted values.
View parameters - `service_name` (string, required): Name of the service to get logs for - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `limit` (integer, optional): Maximum log entries to return. Default: 20 - `env` (string, optional): Environment to filter by. Use `get_service_environments` to get available environments - `severity_filters` (array, optional): Filter by log severity levels (e.g., `["error", "warn"]`). Uses OR logic - `body_filters` (array, optional): Filter by log message content (e.g., `["timeout", "failed"]`). Uses OR logic - `start_time_iso` (string, optional): Start time in RFC3339 format - `end_time_iso` (string, optional): End time in RFC3339 format **Filtering behavior:** - Multiple filter types are combined with AND logic (service AND severity AND body) - Each filter array uses OR logic (matches any pattern in the array)
3. **`get_drop_rules`**: Gets drop rules for logs, which determine what logs get filtered out from reaching Last9. 4. **`add_drop_rule`**: Adds a new drop rule to filter out specific logs at Last9 Control Plane
View parameters - `name` (string, required): Name of the drop rule - `filters` (array, required): List of filter conditions to apply. Each filter has: - `key` (string, required): The key to filter on. Only attributes and resource.attributes keys are supported. For resource attributes, use format: `resource.attributes[key_name]` and for log attributes, use format: `attributes[key_name]`. Double quotes in key names must be escaped - `value` (string, required): The value to filter against - `operator` (string, required): The operator used for filtering. Valid values: "equals", "not_equals" - `conjunction` (string, required): The logical conjunction with the other filters. Valid values: "and"
5. **`get_log_attributes`**: Returns available log attribute names existing during the specified time window, grouped by category. Useful for discovering what attributes can be used for filtering and querying logs.
View parameters - `lookback_minutes` (integer, optional): Number of minutes to look back from now for the time window. Default: 15 - `start_time_iso` (string, optional): Start time in RFC3339 format. Leave empty to use lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Leave empty to default to current time - `region` (string, optional): AWS region to query. Leave empty to use default from configuration - `index` (string, optional): `physical_index:` or `rehydration_index:` **Returns**: Log attributes grouped into two categories: - Log Attributes: Standard log fields like service, severity, body, level, etc. - Resource Attributes: Resource-related fields prefixed with "resource_" like resource_k8s.pod.name, resource_service.name, etc.
6. **`get_log_attributes_for_pipeline`**: Returns log fields present after applying a pipeline, each with the exact `filter_field` for `get_logs` conditions. Scoped to your pipeline — use after a filter stage and before building `get_logs` queries.
View parameters - `pipeline` (array, required): In-progress pipeline, such as a `ServiceName` filter stage - `lookback_minutes` (integer, optional): Default: 15 - `start_time_iso` / `end_time_iso` (string, optional): RFC3339 time bounds - `region` (string, optional): Region to query - `index` (string, optional): `physical_index:` or `rehydration_index:` **Returns**: Each entry includes `name`, `filter_field` (use directly in `get_logs`), `hint`, and optional `source`/`sample_coverage`. Body-derived fields (`source: body`) require a parse stage before filtering.
### Traces management 1. **`get_traces`**: Execute advanced trace queries using JSON pipeline syntax for complex filtering and aggregation. This tool provides powerful querying capabilities for traces using a pipeline-based approach with filters, aggregations, and transformations.
View parameters - `tracejson_query` (array, required): JSON pipeline query for traces. Fetch the full DSL from the `last9://reference/tracejson` resource or discover fields with `get_trace_attributes_for_pipeline` first - `start_time_iso` (string, optional): Start time in RFC3339 format - `end_time_iso` (string, optional): End time in RFC3339 format - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 60 - `limit` (integer, optional): Maximum number of results to return. Default: 5000 **Notes:** - Existence checks use `{"$neq": [field, ""]}` — `$exists` and `$notnull` are not supported - `aggregate` and `window_aggregate` pipelines run as a single request (not chunked) - A `408` response means the window is too wide — narrow the time range and retry
2. **`get_service_traces`**: Retrieve traces from Last9 by trace ID or service name. Get specific traces either by providing a trace ID for a single trace, or by providing a service name to get all traces for that service within a time range.
View parameters - `trace_id` (string, optional): Specific trace ID to retrieve. Cannot be used with service_name - `service_name` (string, optional): Name of service to get traces for. Cannot be used with trace_id - `lookback_minutes` (integer, optional): Number of minutes to look back from now. Default: 4320 for `trace_id`, 60 for `service_name` - `start_time_iso` (string, optional): Start time in RFC3339 format. Leave empty to use lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Leave empty to default to current time - `limit` (integer, optional): Maximum number of traces to return. Default: 10 - `env` (string, optional): Environment filter. Use `get_service_environments` to get available environments **Usage rules:** - Exactly one of `trace_id` or `service_name` must be provided (not both, not neither) - Use `lookback_minutes` or ISO time bounds with either lookup. ISO bounds override `lookback_minutes` Returns trace data including trace IDs, spans, duration, timestamps, and status information.
3. **`get_trace_attributes`**: Identify all available trace attributes within a specified time window for use in filtering and querying. Returns the global tag catalog.
View parameters - `lookback_minutes` (integer, optional): Number of minutes to look back from now for the time window. Default: 15 - `start_time_iso` (string, optional): Start time in RFC3339 format. Leave empty to use lookback_minutes - `end_time_iso` (string, optional): End time in RFC3339 format. Leave empty to default to current time - `region` (string, optional): AWS region to query. Leave empty to use default from configuration
4. **`get_trace_attributes_for_pipeline`**: Returns trace attributes present after applying a pipeline, each with the exact `filter_field` for `get_traces` conditions. Scoped to your pipeline — use after a filter stage and before filtering on attribute keys.
View parameters - `pipeline` (array, required): In-progress pipeline, such as a `ServiceName` filter stage - `lookback_minutes` (integer, optional): Default: 15 - `start_time_iso` / `end_time_iso` (string, optional): RFC3339 time bounds - `region` (string, optional): Region to query **Returns**: Each entry includes `name`, `semantic_name`, `type`, and `filter_field` ready to use in `get_traces` conditions.
5. **`get_trace_attribute_values`**: Fetch distinct values for a single trace attribute. Use after `get_trace_attributes` or `get_trace_attributes_for_pipeline` to see what values exist (environments, HTTP methods, team names, etc.).
View parameters - `tag_name` (string, required): Trace tag name - `pipeline` (array, optional): Pipeline to filter the spans used for value discovery - `region` (string, optional): Region to query Uses a fixed recent discovery window.
6. **`get_trace_waterfall`**: Retrieve one exact trace as a bounded parent/child waterfall with millisecond timing, interval-correct self-time, slowest spans, and largest self-time contributors. Does not compute a critical path or claim root cause.
View parameters - `trace_id` (string, required): Exact trace ID - `environment` (string, optional): Exact deployment environment - `start_time_iso` / `end_time_iso` (string, optional): RFC3339 time bounds - `lookback_minutes` (integer, optional): Default: 4320 (for exact trace lookup) - `selected_span_id` (string, optional): Include attributes, events, and links for this span only - `max_spans` (integer, optional): Default: 500, maximum: 1000 **Returns**: An `investigation-evidence/v1` envelope with the waterfall under `data`, plus `evidence_quality`, truncation warnings, and graph integrity warnings (cycles, orphans, duplicate spans). An empty result has `evidence_quality: insufficient` — widen the window or verify the trace ID before concluding the trace does not exist.
7. **`get_trace_attribute_deviations`**: Compare attribute-value distributions between two bounded span cohorts and rank supported differences. Use for slow vs fast, error vs non-error, or two equal-duration time windows. Results describe correlation, not cause.
View parameters - `comparison_mode` (string, required): `latency`, `errors`, or `time` - `service_name` (string, required): Exact service name - `environment` (string, required): Exact `deployment.environment` value - `operation` (string, optional): Exact operation/span name - `filters` (array, optional): Trace JSON filter conditions — discover valid fields with `get_trace_attributes_for_pipeline` first - `candidate_attributes` (array, optional): Up to 8 attribute names; omit for bounded auto-discovery - `latency_threshold_ms` (number, required for `latency` mode): Positive threshold in milliseconds - `start_time_iso` / `end_time_iso` (string, optional): Target window in RFC3339 - `lookback_minutes` (integer, optional): Alternative target lookback ending now. Default: 15, maximum: 15 - `baseline_start_time_iso` / `baseline_end_time_iso` (string, required for `time` mode): Non-overlapping baseline window equal in duration to the target window - `minimum_cohort_size` (integer, optional): Default: 100, minimum: 20 - `minimum_value_support` (integer, optional): Default: 20, minimum: 10 - `limit` (integer, optional): Default: 10, maximum: 10 **Returns**: Full-denominator shares, percentage-point deltas, representative trace IDs, and `evidence_quality`. Requires the trace-analysis capability to be enabled for your tenant.
### Alert management Use `get_alert_groups` to discover alert groups and `get_entity_alert_rules` to list rules for a selected entity. 1. **`get_alert_config`**: Get all configured alert rules from Last9. Supports typed filters and free-text search.
View parameters and returns **Optional filters:** - `rule_id`, `search_term`, `rule_name`, `severity`, `rule_type` (`static` or `anomaly`) - `alert_group_name`, `alert_group_type`, `data_source_name`, `tags` - `only_without_notification_channel`: Rules whose alert group has no per-entity channel binding (Alert Studio "Not configured") - `notification_channel_types`: Rules with a per-entity channel of any listed type (e.g. `slack`, `email`, `pagerduty`) - `notification_channel_names`: Rules with a per-entity channel matching any listed name (AND-combined with other `notification_channel_*` filters on the same binding row) - `notification_channel_severities`: Rules with a per-entity channel matching any listed severity (`breach` or `threat`) **Returns per rule:** - Alert rule ID, name, primary indicator, entity ID, state, severity, algorithm - Alert group `name`, `data_source`, and `tags` when resolved - **Notification Channels**: configured types in dashboard order, or "Not configured" - **Notification Channel Bindings**: each binding row (type, name, severity) with snooze/in_use flags - Timestamps for creation/updates
2. **`get_alerts`**: Get currently active alerts from the Last9 monitoring system.
View parameters and returns Parameters: - `time_iso` (string, optional): Evaluation time in RFC3339 format - `timestamp` (integer, optional): Deprecated Unix timestamp alias - `window` (integer, optional): Time window in seconds. Default: 900 seconds, range: 1-3600 - `lookback_minutes` (integer, optional): Window in minutes when `window` is omitted. Range: 1-60 Returns: - Alert rule details - Alert state and severity - Firing timestamps - Rule configurations - Metric degradation information - Group labels and annotations
3. **`get_notification_channels`**: Get all notification channel configurations from Last9.
Returns Returns all notification channels as a table with the following columns: - `id`, `name`, `type` - `service_fqid`: per-entity alert-group binding ID - `global`: whether the channel applies to all services - `in_use`: whether the channel is actively used in an alert rule - `send_resolved`: whether resolved alerts trigger a notification (`true` / `false` / `null` if not set) - `snoozed_until`: UTC timestamp if the channel is snoozed, `-` otherwise - `severity`, `priority` - `services`: comma-separated `namespace/name` pairs, `-` if the channel is global
4. **`get_alert_rule_state`**: Get historical firing state (1/0) per alert rule over a time range, grouped by `rule_id`.
View parameters - `start_time` (integer, required): Unix epoch start of the range (inclusive) - `end_time` (integer, required): Unix epoch end of the range (inclusive) - `step` (integer, required): Resolution in seconds between samples - `alert_group_id` (string, optional): Filter by alert group ID - `rule_name` (string, optional): Regex filter on rule name - `alert_group_name` (string, optional): Regex filter on alert group name - `label_filters` (string, optional): Comma-separated `key=value` label filters - `state` (string, optional): Filter by state (e.g. `firing`) **Returns**: JSON map of `rule_id` → `[{timestamp, is_firing}]`. Sample count is capped at 100.
### Custom dashboards 1. **`list_dashboards`**: List all custom dashboards in your Last9 organization.
Returns - JSON array of dashboard summaries: `id`, `name`, and metadata - `reference_url` in MCP metadata linking to the dashboards index in the Last9 UI
2. **`get_dashboard`**: Get the full definition of a custom dashboard by ID.
View parameters and returns Parameters: - `id` (string, required): Dashboard UUID - `region` (string): Region for panel query population. Optional when a default datasource region is configured Returns: - Full dashboard JSON including `name`, `panels[]`, and `metadata` - Each panel includes `layout`, `visualization.type`, and `queries[]` - `reference_url` in MCP metadata linking directly to the dashboard
3. **`create_dashboard`**: Create a new custom dashboard with panels and queries.
View parameters - `dashboard` (object, required): Dashboard definition with `name` and `panels[]`. Each panel requires `name`, `layout` (`x`, `y`, `w`, `h`), `visualization.type`, and `queries[]`. A panel `version` defaults to `1` when omitted - `metadata` (object, optional): Dashboard metadata — `_category` and `_type` fields (e.g. `{"_category":"custom","_type":"metrics"}`) Returns the created dashboard JSON with its assigned `id` and a `reference_url` to open it in the Last9 UI.
4. **`update_dashboard`**: Update an existing custom dashboard by ID.
View parameters - `id` (string, required): Dashboard UUID to update - `dashboard` (object, required): Full replacement dashboard body (same shape as `create_dashboard`) - `metadata` (object, optional): Replacement metadata Readonly system dashboards return a 403 error. Returns updated dashboard JSON with `reference_url`.
5. **`delete_dashboard`**: Delete a custom dashboard by ID.
View parameters - `id` (string, required): Dashboard UUID to delete Readonly system dashboards cannot be deleted. Returns a `reference_url` to the dashboards index.
6. **`list_dashboard_snapshots`**: List frozen point-in-time snapshots for a dashboard.
View parameters - `dashboard_id` (string, required): Dashboard UUID **Returns**: Snapshot metadata (`id`, `name`, `expires_at`). Use `get_dashboard_snapshot` for full panel data.
7. **`get_dashboard_snapshot`**: Get a frozen dashboard snapshot by ID, including panel data at capture time.
View parameters - `id` (string, required): Snapshot UUID **Returns**: Full frozen snapshot with `dashboard_definition`, `panel_data`, `time_range`, and `variables`.
8. **`delete_dashboard_snapshot`**: Delete a frozen dashboard snapshot by ID.
View parameters - `id` (string, required): Snapshot UUID to delete
### Entity discovery Use `get_service_profile` before choosing telemetry tools for a service. It returns the service's available signals and investigation context. Supply the required `service_name` and, optionally, a `datasource`. 1. **`did_you_mean`**: Suggests correct entity names when you're unsure of the exact spelling. Use this proactively before querying with a name that might be a typo, abbreviation, or partial match.
View parameters - `query` (string, required): The name to search for — can be a partial name, misspelling, or abbreviation - `type` (string, optional): Restrict suggestions to a specific entity type. Supported values: `service`, `environment`, `host`, `database`, `k8s_deployment`, `k8s_namespace`, `job` Returns up to 3 closest matches with similarity scores (0–100%) from the Last9 catalog, covering services, environments, hosts, databases, Kubernetes workloads, and more. **When to use:** - Before calling `get_service_logs`, `get_service_traces`, `get_service_performance_details`, etc. with a service name that might be misspelled (e.g. `"paymnt-svc"`, `"prod-srvice"`) - When a previous tool call returned empty results for a given entity name - When the user provides an ambiguous or abbreviated name (e.g. `"the payment thing"` or `"prod env"`) **Example results:** - `query="paymnt-svc"` → `payment-service (92%, service)` - `query="prod"` → `production (89%, environment)`, `prod-eu (82%, environment)`
{/* prettier-ignore-end */} ## Demos 1. Fixing a recent exception 2. Optimizing logs for a service 3. Creating an RCA basis recent issues in the production environment 4. Analyze background worker processes ## Best practices - **Name the service and environment.** Use `get_service_profile` to identify the available telemetry before choosing investigation tools. - **Provide the incident window.** Prefer absolute UTC start and end times when returning to an earlier incident. - **Discover fields before filtering.** Use `get_log_attributes_for_pipeline` and `get_trace_attributes_for_pipeline` to find valid field names. - **Choose a trace tool for the question.** Use `get_trace_waterfall` for one trace's timing and `get_trace_attribute_deviations` to compare groups of spans. - **Limit automation tools.** Set a read-tool allowlist in your agent. Self-hosted servers can also use `LAST9_TOOLSETS=investigate` to expose investigation tools. --- ## Troubleshooting - **"Last9 tools not available"**: Verify your IDE configuration and restart the application - **OAuth flow not completing**: Ensure you are logged in to [app.last9.io](https://app.last9.io) before authorizing. If redirected to a 404, try logging in to the dashboard first and then re-initiating the OAuth flow from your IDE - **"Authentication failed"** or **"401 Unauthorized"**: Reauthorize a hosted OAuth connection. For programmatic access, check the MCP client token. For a local server, check `LAST9_REFRESH_TOKEN`. - **"No data returned"**: Ensure your services are sending telemetry to Last9 and try broader time ranges - **"Connection issues"**: Double-check: - Your organization slug is correct. Find it in `app.last9.io/v2/organizations//...`. - The URL format: `https://app.last9.io/api/v4/organizations//mcp` Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.