Skip to content
Last9 named a Gartner Cool Vendor in AI for SRE Observability for 2025! Read more →
Last9
Talk to an Expert

Last9 MCP

Connect your AI agent to production observability data for intelligent debugging and issue resolution.

Last9’s MCP server transforms your development workflow by bringing production observability directly into your IDE. Ask your AI assistant questions like “What’s causing the recent spike in errors?” or “Show me the slowest endpoints from the last hour” and get instant insights with suggested fixes.

What is Model Context Protocol?

MCP is an open protocol that standardizes how applications provide context to LLMs. Think of MCP like a universal adapter for AI applications — it provides a standardized way to connect AI models to different data sources and tools.

Using MCP, AI agents in your IDE (Cursor, Windsurf, VS Code) or Claude Desktop can access your observability data in Last9’s Telemetry Data Platform to provide intelligent assistance based on real production context.

Why use Last9 MCP?

Turn production issues into local solutions. The Last9 MCP server brings real-time production context directly to your development environment, enabling AI agents to deliver conversational observability through:

  • Debug with production context: Analyze exceptions, performance issues, and service dependencies using actual production data
  • Suggest intelligent fixes: Get code suggestions based on real observability signals, not just theoretical best practices
  • Eliminate “works on my machine”: Bridge the gap between local development and production reality with agentic dx

Gone are the days of switching between multiple tools to understand production issues. This represents the shift from traditional monitoring to an AI-native approach. Read more in our launch blog post and our thoughts on why your observability stack needs to speak agent.

Example Use Cases

Debug Production Exceptions

"I'm seeing errors in production. Can you help me understand what's happening?"

Agent uses get_exceptions and get_service_performance_details to analyze the issue

Performance Investigation

"My API response times seem slow. What's causing the latency?"

Agent uses get_service_dependency_graph and prometheus_range_query to identify bottlenecks

Log Analysis for Issues

"Find error logs from the user-service in the last 30 minutes"

Agent uses get_logs with service and severity filters to surface relevant logs

Correlate Incidents with Deployments

"We had performance issues around 2pm. Were there any deployments around that time?"

Agent uses get_change_events to check for recent deployments and get_service_performance_details to analyze the correlation

Prerequisites

Before setting up Last9 MCP, ensure you have:

  • Observability data flowing to Last9 via OpenTelemetry integration
  • One of the supported IDEs: Cursor, Windsurf, VS Code, or Claude Desktop
  • Access to your Last9 authentication credentials

Setup

  1. Get your Last9 credentials

    You’ll need the following values from your Last9 account:

    Required:

    Optional:

    • Datasource (LAST9_DATASOURCE): Name of the datasource/cluster to use (defaults to your organization’s default)
    • API Host (LAST9_API_HOST): Custom API host if using a regional or self-hosted instance (defaults to app.last9.io)

  2. Install the Last9 MCP server

    # Add the Last9 tap
    brew tap last9/tap
    

    # Install the Last9 MCP CLI
    brew install last9-mcp

  3. Configure your IDE

    1. Open Claude Desktop → Settings → Developer

    2. Click “Edit Config” to open claude_desktop_config.json

    3. Add the Last9 MCP server configuration:

      {
        "mcpServers": {
          "last9": {
            "command": "/opt/homebrew/bin/last9-mcp",
            "env": {
              "LAST9_REFRESH_TOKEN": "your_write_refresh_token_here"
            }
          }
        }
      }

    4. Save the file and restart Claude Desktop

  4. Verify the connection

    Once configured, your AI agent will have access to Last9 tools. Try asking: “What exceptions occurred in the last hour?” or “Show me the performance summary for my services.”

Available Tools

Your AI agent can now access these Last9 capabilities:

Observability & APM

  1. get_exceptions: Get server-side exceptions over a specified time range.

    View parameters
    • limit (integer, optional): Maximum number of exceptions to return. Default: 20
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to use lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to default to current time
    • service_name (string, optional): Filter by service name
    • span_name (string, optional): Name of the span to filter by
    • deployment_environment (string, optional): Filter by environment

  2. get_service_summary: Get service summary over a given time range. Includes service name, environment, throughput, error rate, and response time. All values are p95 quantiles over the time range.

    View parameters
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: end_time_iso - 1 hour
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time
    • env (string, optional): Environment to filter by. Default: ‘prod’

  3. get_service_environments: Get available service environments within a specified time range.

    View parameters
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time

    Note: Returns an array of environments that can be used with other APM tools. If the array is empty, use an empty string "" for environment parameters.

  4. get_service_performance_details: Get detailed performance metrics for a specific service.

    View parameters
    • service_name (string, required): Service name
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time
    • env (string, optional): Environment. Default: ‘prod’

  5. get_service_operations_summary: Get operations summary for a service like HTTP endpoints, database queries, messaging producer, and HTTP client calls.

    View parameters
    • service_name (string, required): Service name
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time
    • env (string, optional): Environment. Default: ‘prod’

  6. get_service_dependency_graph: Get service dependency graph showing incoming and outgoing dependencies, including infra. Includes throughput, response times and error rates.

    View parameters
    • service_name (string, optional): Name of the service
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time
    • env (string, optional): Environment. Default: ‘prod’

  7. get_change_events: Retrieves change events from the last9_change_events Prometheus metric to help correlate deployments and system modifications with performance issues or incidents.

    View parameters
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Defaults to now - lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Defaults to current time
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • service (string, optional): Filter by service name
    • environment (string, optional): Environment filter
    • event_name (string, optional): Specific event type filter (use available_event_names to see valid values)

    Returns:

    • available_event_names: List of all available event types that can be used for filtering
    • change_events: Array of timeseries data with metric labels and timestamp-value pairs
    • count: Total number of change events returned
    • time_range: Start and end time of the query window

    Common event types: deployment, config_change, rollback, scale_up/scale_down, restart, upgrade/downgrade, maintenance, backup/restore, health_check, certificate, database

    Best practices:

    1. First call without event_name to get available_event_names
    2. Use exact event name from available_event_names for the event_name parameter
    3. Combine with other filters (service, environment, time) for precise results

Prometheus Integration

  1. prometheus_range_query: Execute Prometheus range queries for metrics over a time period.

    View parameters
    • query (string, required): Range query to execute
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time

  2. prometheus_instant_query: Execute Prometheus instant queries for metrics at a specific point in time.

    View parameters
    • query (string, required): Instant query to execute
    • time_iso (string, optional): Time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time

  3. prometheus_label_values: Get all label values for a specific label name.

    View parameters
    • match_query (string, required): Valid PromQL filter query
    • label (string, required): Label to get values for
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time

  4. prometheus_labels: Get all available label names.

    View parameters
    • match_query (string, required): Valid PromQL filter query
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Default: now - 60 minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Default: Current time

Log Management

  1. get_logs: Retrieves filtered log entries by service name and/or severity. Uses advanced v2 logs API with physical index optimization for better performance.

    View parameters
    • service_name (string, required): Name of the target service to get logs for
    • severity (string, optional): Severity level of the logs to get (automatically converted to severity_filters format)
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to use lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to default to current time
    • limit (integer, optional): Maximum logs to return. Default: 20
    • env (string, optional): Environment filter. Use get_service_environments to get available environments

  2. get_service_logs: Retrieves raw log entries for a specific service with advanced filtering capabilities. Useful for debugging issues, monitoring service behavior, and analyzing specific log patterns.

    View parameters
    • service_name (string, required): Name of the service to get logs for
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • limit (integer, optional): Maximum log entries to return. Default: 20
    • env (string, optional): Environment to filter by. Use get_service_environments to get available environments
    • severity_filters (array, optional): Filter by log severity levels (e.g., ["error", "warn"]). Uses OR logic
    • body_filters (array, optional): Filter by log message content (e.g., ["timeout", "failed"]). Uses OR logic
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS)
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS)

    Filtering behavior:

    • Multiple filter types are combined with AND logic (service AND severity AND body)
    • Each filter array uses OR logic (matches any pattern in the array)

  3. get_drop_rules: Gets drop rules for logs, which determine what logs get filtered out from reaching Last9.

  4. add_drop_rule: Adds a new drop rule to filter out specific logs at Last9 Control Plane

    View parameters
    • name (string, required): Name of the drop rule
    • filters (array, required): List of filter conditions to apply. Each filter has:
      • key (string, required): The key to filter on. Only attributes and resource.attributes keys are supported. For resource attributes, use format: resource.attributes[key_name] and for log attributes, use format: attributes[key_name]. Double quotes in key names must be escaped
      • value (string, required): The value to filter against
      • operator (string, required): The operator used for filtering. Valid values: “equals”, “not_equals”
    • conjunction (string, required): The logical conjunction between filters. Valid values: “and”

  5. get_log_attributes: Returns available log attribute names existing during the specified time window, grouped by category. Useful for discovering what attributes can be used for filtering and querying logs.

    View parameters
    • lookback_minutes (integer, optional): Number of minutes to look back from now for the time window. Default: 15
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to use lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to default to current time
    • region (string, optional): AWS region to query. Leave empty to use default from configuration

    Returns: Log attributes grouped into two categories:

    • Log Attributes: Standard log fields like service, severity, body, level, etc.
    • Resource Attributes: Resource-related fields prefixed with “resource_” like resource_k8s.pod.name, resource_service.name, etc.

Traces Management

  1. get_traces: Execute advanced trace queries using JSON pipeline syntax for complex filtering and aggregation. This tool provides powerful querying capabilities for traces using a pipeline-based approach with filters, aggregations, and transformations.

    View parameters
    • tracejson_query (array, required): JSON pipeline query for traces. Use the tracejson_query_builder prompt to generate JSON pipeline queries from natural language
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS)
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS)
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • limit (integer, optional): Maximum number of traces to return. Default: 20. Range: 1-100

    This tool supports complex queries with multiple filter conditions, aggregations, and custom processing pipelines for advanced trace analysis.

  2. get_service_traces: Retrieve traces from Last9 by trace ID or service name. Get specific traces either by providing a trace ID for a single trace, or by providing a service name to get all traces for that service within a time range.

    View parameters
    • trace_id (string, optional): Specific trace ID to retrieve. Cannot be used with service_name
    • service_name (string, optional): Name of service to get traces for. Cannot be used with trace_id
    • lookback_minutes (integer, optional): Number of minutes to look back from now. Default: 60
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to use lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to default to current time
    • limit (integer, optional): Maximum number of traces to return. Default: 10. Range: 1-100
    • env (string, optional): Environment filter. Use get_service_environments to get available environments

    Usage rules:

    • Exactly one of trace_id or service_name must be provided (not both, not neither)
    • Time range filtering only applies when using service_name

    Returns trace data including trace IDs, spans, duration, timestamps, and status information.

  3. get_trace_attributes: Identify all available trace attributes within a specified time window for use in filtering and querying. Returns an alphabetically sorted list of trace attributes such as http.method, http.status_code, db.name, and resource identifiers.

    View parameters
    • lookback_minutes (integer, optional): Number of minutes to look back from now for the time window. Default: 15
    • start_time_iso (string, optional): Start time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to use lookback_minutes
    • end_time_iso (string, optional): End time in ISO format (YYYY-MM-DD HH:MM:SS). Leave empty to default to current time
    • region (string, optional): AWS region to query. Leave empty to use default from configuration

Alert Management

  1. get_alert_config: Get all configured alert rules from Last9.

    Returns
    • Alert rule ID and name
    • Primary monitoring indicator
    • Current state and severity
    • Alerting algorithm details
    • Entity and organization information
    • Configuration properties
    • Timestamps for creation/updates
    • Group timeseries notification settings

  2. get_alerts: Get currently active alerts from the Last9 monitoring system.

    View parameters and returns

    Parameters:

    • timestamp (integer, optional): Unix timestamp. Default: current time
    • window (integer, optional): Time window in seconds. Default: 900 seconds, range: 60-86400

    Returns:

    • Alert rule details
    • Alert state and severity
    • Firing timestamps
    • Rule configurations
    • Metric degradation information
    • Group labels and annotations

Demos

  1. Fixing a recent exception

  2. Optimizing logs for a service

  3. Creating an RCA basis recent issues in the production environment

  4. Analyze background worker processes

Best Practices

  • Start broad, then narrow: Ask about overall service health before diving into specific issues
  • Include time context: Specify time ranges when investigating issues (“in the last hour”, “during the outage yesterday”)
  • Combine tools: The agent can correlate data across metrics, logs, traces, and alerts for comprehensive analysis

Troubleshooting

Common Issues:

  • “Last9 tools not available”: Verify your IDE configuration and restart the application
  • “Authentication failed”: Double-check your refresh token and ensure it has Write permissions
  • “No data returned”: Ensure your services are sending telemetry to Last9 and try broader time ranges
  • “Connection issues”: If using a custom API host or datasource, verify the LAST9_API_HOST and LAST9_DATASOURCE environment variables are set correctly

Please get in touch with us on Discord or Email if you have any questions.