Sumo Logic

MCP server for Sumo Logic — 48 tools for searching logs, managing monitors, alerts, dashboards, collectors, metrics, content library, users, roles, fields, partitions, lookup tables, and ingest budgets.

Generic and org-agnostic. Any team can plug in their own Sumo Logic credentials and start querying.

Note: This is an experimental, community-driven project — not an official Sumo Logic product. Feel free to test it and use it.

Installation

pip install sumo-logic-mcp

Or run without installing (via uv):

uvx sumo-logic-mcp

Setup

1. Get Access Credentials

1. Log in to your Sumo Logic account (e.g., https://<your-org>.sumologic.com)
2. Click on your profile icon (top right) and go to Preferences
3. Scroll to My Access Keys and click Add Access Key
4. Give it a name, leave scopes to default or set as needed
5. Copy both the Access ID and Access Key

2. Configure Your MCP Client

Add to your MCP client configuration (e.g., ~/.cursor/mcp.json or Claude Desktop config):

{
  "mcpServers": {
    "sumologic": {
      "command": "uvx",
      "args": ["sumo-logic-mcp"],
      "env": {
        "SUMOLOGIC_ACCESS_ID": "<your-access-id>",
        "SUMOLOGIC_ACCESS_KEY": "<your-access-key>",
        "SUMOLOGIC_ENDPOINT": "https://api.sumologic.com"
      }
    }
  }
}

Or run directly:

export SUMOLOGIC_ACCESS_ID="your-access-id"
export SUMOLOGIC_ACCESS_KEY="your-access-key"
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp

Tool Reference

Search & Analytics (4 tools)

Tool	Description	Required Params
search_logs	Execute a log search (full lifecycle: create job, poll, fetch, cleanup)	query
get_search_status	Check status of a running search job	job_id
get_search_results	Fetch messages or records from a search job	job_id
cancel_search	Cancel a running search job	job_id

search_logs optional params: from_time (default -15m), to_time (default now), timezone (default UTC), limit (default 100), by_receipt_time, timeout (default 300s).

Time formats: ISO 8601 (2024-01-15T09:00:00), relative (-15m, -1h, -2d, -1w), epoch ms (1718745600000), or now.

Monitor Management (10 tools)

Tool	Description	Required Params
list_monitors	List all monitors	—
search_monitors	Search by name or status filter	query
get_monitor	Get full monitor configuration	monitor_id
create_monitor	Create a new monitor	name, query, threshold
update_monitor	Update monitor config (read-modify-write)	monitor_id, fields_json
delete_monitor	Delete a monitor (irreversible)	monitor_id
enable_monitor	Enable a disabled monitor	monitor_id
disable_monitor	Disable a monitor	monitor_id
get_monitor_status	Get current health/triggering state	monitor_id
get_monitor_history	Get alert history for a monitor	monitor_id

Alert Management (3 tools)

Tool	Description	Required Params
get_active_alerts	Get all currently firing alerts	—
get_alert_details	Get detailed alert info for a monitor	monitor_id
resolve_alert	Resolve an alert by disabling its monitor	monitor_id

Dashboard Management (5 tools)

Tool	Description	Required Params
list_dashboards	List dashboards with pagination	—
get_dashboard	Get full dashboard config	dashboard_id
create_dashboard	Create a dashboard with panels and layout	title, panels_json, layout_json
update_dashboard	Update dashboard config (read-modify-write)	dashboard_id, fields_json
delete_dashboard	Delete a dashboard (irreversible)	dashboard_id

Collector & Source Management (8 tools)

Tool	Description	Required Params
list_collectors	List all collectors	—
get_collector	Get collector configuration	collector_id
create_hosted_collector	Create a new Hosted collector	name
update_collector	Update collector config (with ETag locking)	collector_id, fields_json
delete_collector	Delete a collector and its sources	collector_id
list_sources	List sources on a collector	collector_id
get_source	Get source configuration	collector_id, source_id
create_http_source	Create an HTTP source (returns endpoint URL)	collector_id, name

Metrics (4 tools)

Tool	Description	Required Params
query_metrics	Execute a metrics query	query
list_metric_definitions	Discover available metric names	—
get_metric_metadata	Get dimensions for a metric	metric_name
list_metric_namespaces	List metric content types	—

Content Library (3 tools)

Tool	Description	Required Params
get_personal_folder	Get your personal content folder and children	—
get_folder	Get a folder and its child items	folder_id
get_content_by_path	Look up content by library path	path

Administration (8 tools)

Tool	Description	Required Params
list_users	List all users with emails, roles, status	—
list_roles	List roles with capabilities and filters (v2)	—
list_fields	List all fields (built-in + custom)	—
list_field_extraction_rules	List FERs with scopes and parse expressions	—
list_partitions	List partitions with routing and retention	—
list_lookup_tables	List lookup tables with schemas	—
get_lookup_table	Get a lookup table's config and fields	table_id
list_ingest_budgets	List ingest budgets with scopes and capacity	—

Utility (3 tools)

Tool	Description	Required Params
check_connection	Verify API connectivity and auth	—
get_account_usage	Get account status and ingestion info	—
validate_query	Check if a query is syntactically valid	query

Usage Examples

Once configured, just ask your AI assistant naturally:

"Search for 500 errors in the last hour"
"Show me all critical alerts"
"Create a monitor for high error rates on our API"
"List all hosted collectors"
"What CPU metrics are available?"
"Show me the field extraction rules"
"List all partitions and their retention periods"

Development

git clone https://github.com/rajfirke/sumo-logic-mcp.git
cd sumo-logic-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

# Lint
ruff check src/ tests/

# Test
pytest -v

# Run locally
export SUMOLOGIC_ACCESS_ID="..."
export SUMOLOGIC_ACCESS_KEY="..."
export SUMOLOGIC_ENDPOINT="https://api.sumologic.com"
sumo-logic-mcp

Architecture

src/sumo_logic_mcp/
├── __init__.py          # Exports mcp, triggers tool registration
├── __main__.py          # Entry point: python -m sumo_logic_mcp
├── server.py            # FastMCP instance + lifespan (shared HTTP client)
├── client.py            # Async HTTP client (httpx, Basic Auth, retry, cookies)
├── validation.py        # Time parsing and validation
└── tools/
    ├── __init__.py      # Imports all tool modules
    ├── search.py        # 4 search tools
    ├── monitors.py      # 10 monitor tools
    ├── alerts.py        # 3 alert tools
    ├── dashboards.py    # 5 dashboard tools
    ├── collectors.py    # 8 collector/source tools
    ├── metrics.py       # 4 metrics tools
    ├── content.py       # 3 content library tools
    ├── admin.py         # 8 admin tools (users, roles, fields, partitions, etc.)
    └── utils.py         # 3 utility tools