# Graylog MCP Server (npm · @jperelli/graylog-mcp)

Query logs from Graylog: get streams, search messages, aggregate, and get full data.

- Trust score: 75/100 (medium)
- Change this week: −12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@jperelli/graylog-mcp`: 75/100 (this document), [markdown](https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp.md), [page](https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp)

## Channel facts

- Registry: `npm`
- Package: `@jperelli/graylog-mcp`
- Version: `1.3.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to jperelli/graylog-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 17 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 55/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2639 tokens (~527/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add jperelli-graylog-mcp -- npx -y @jperelli/graylog-mcp
```

### Codex

```bash
codex mcp add jperelli-graylog-mcp -- npx -y @jperelli/graylog-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jperelli-graylog-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@jperelli/graylog-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jperelli-graylog-mcp --command npx --arg -y --arg @jperelli/graylog-mcp
```

### Hermes

```yaml
mcp_servers:
  jperelli-graylog-mcp:
    command: "npx"
    args: ["-y", "@jperelli/graylog-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "jperelli-graylog-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@jperelli/graylog-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 75, +4)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-02 (score 71, +40)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: jperelli/graylog-mcp
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 31, +26)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 5, −64)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 69, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 87, +61)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] The attested source repository moved: jperelli/graylog-mcp
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-27 (score 26)

First indexed and scored.

## MCP tools (5)

### `list_streams` (~148 tokens)

List the Graylog streams the API token can read (id + title, and whether each removes its matches from the Default Stream). To search everything, pass streams:"*" to search/analyze rather than listing streams here. A cluster can hold thousands of streams, so results are capped — use `titleContains` to find one specific named stream (e.g. a service whose logs are absent from the Default Stream).

Input parameters:

- `instance` (string): Graylog instance to query. Active: (none configured). Default: "none".
- `limit` (number): Max streams to return. Default: 50.
- `titleContains` (string): Case-insensitive substring filter on the stream title.

### `list_fields` (~152 tokens)

List the message fields that actually exist in the index. Use this BEFORE searching on a field you have not seen in a result, so you never guess a field name — a query on a nonexistent field returns 0 matches, which is indistinguishable from 'no logs'. Clusters index thousands of fields, so pass `contains` to narrow (e.g. "namespace").

Input parameters:

- `contains` (string): Case-insensitive substring filter on the field name, e.g. "namespace", "pod", "level".
- `instance` (string): Graylog instance to query. Active: (none configured). Default: "none".
- `limit` (number): Max field names to return. Default: 100.

### `search` (~470 tokens)

Read individual matching log lines across one or more streams, merged newest-first. Returns a concise projection of high-signal fields by default (set verbose:true for all fields). Raw lines are expensive: if you want to know WHAT is failing rather than read specific lines, use analyze first — a hundred repetitions of one error cost a hundred times as much here as one aggregated count. Pass streams:"*" to cover every readable stream when you do not know which stream a service logs to (the Default Stream often excludes it).

Input parameters:

- `fields` (string): Comma-separated explicit field list to return. Overrides the concise projection.
- `from` (string): Absolute window start, ISO-8601 UTC (e.g. "2026-07-11 14:00:00"). Requires `to`. Overrides the relative range.
- `instance` (string): Graylog instance to query. Active: (none configured). Default: "none".
- `messageChars` (number): Max characters of the raw message body per hit. Default: 500. The parsed fields (msg, name, err) usually carry the summary already, so raise this only when the detail you need lives in the raw body.
- `query` (string, required): Lucene query, e.g. "level:ERROR", "error OR exception", "source:api-*". Use "*" for everything.
- `searchCountLimit` (number): Max messages to return. Default: 50.
- `searchTimeRangeInSeconds` (number): Relative time range in seconds, ending now. Default: 900 (15 min). Ignored if from/to are set.
- `streams` (string, required): Comma-separated Graylog stream IDs (from list_streams), or "*" for every stream the token can read. Required. Prefer "*" unless you already know the stream: the Default Stream ("000000000000000000000…
- `to` (string): Absolute window end, ISO-8601 UTC. Requires `from`.
- `verbose` (boolean): Return every populated field (untruncated) instead of the concise projection. Default: false.

### `analyze` (~621 tokens)

Aggregate matching messages by the top values of a field instead of returning raw lines. Optionally add a time histogram of match volume. Three main uses: (1) WHAT IS FAILING — aggregate on a message field (`msg`, or whatever short summary field list_fields reveals) to collapse a thousand repetitions of one error into one row with a count; on `name`/`container_name`/`source` to see who is emitting them. This is far cheaper and more informative than reading the same lines via search. (2) WHEN — set histogramInterval to see whether volume spiked. (3) DISCOVER A VALUE you are about to filter on — set `valueContains` to find the real name of a namespace/pod/service rather than guessing it (Elasticsearch rejects a leading wildcard, so `field:*foo*` is an error and this is the only way to substring-match a value). Pass streams:"*" to aggregate across every readable stream in one request — cheap here, and the reliable way to see a service whose stream removes its matches from the Default Stream.

Input parameters:

- `field` (string, required): Field to break down by, e.g. "source", "namespace_name", "container_name", "level". Confirm it exists with list_fields if you have not seen it in a result.
- `from` (string): Absolute window start, ISO-8601 UTC (e.g. "2026-07-11 14:00:00"). Requires `to`. Overrides the relative range.
- `histogramInterval` (string): If set, also return a time histogram of total match counts at this bucket size.
- `instance` (string): Graylog instance to query. Active: (none configured). Default: "none".
- `query` (string): Lucene query, e.g. "level:ERROR", "error OR exception", "source:api-*". Use "*" for everything. Default: "*".
- `searchTimeRangeInSeconds` (number): Relative time range in seconds, ending now. Default: 900 (15 min). Ignored if from/to are set.
- `size` (number): Number of top values to return. Default: 20.
- `streams` (string, required): Comma-separated Graylog stream IDs (from list_streams), or "*" for every stream the token can read. Required. Prefer "*" unless you already know the stream: the Default Stream ("000000000000000000000…
- `to` (string): Absolute window end, ISO-8601 UTC. Requires `from`.
- `valueContains` (string): Case-insensitive substring filter on the returned VALUES, applied locally over a wide bucket scan. Use to find a value you only half-know, e.g. field:"namespace_name" valueContains:"catalogue" to lea…

### `get_message` (~99 tokens)

Fetch the full, untruncated document for a single message by its _id and _index (both returned by search). Use after a concise search to inspect one hit in full.

Input parameters:

- `index` (string, required): The message _index from a search result.
- `instance` (string): Graylog instance to query. Active: (none configured). Default: "none".
- `messageId` (string, required): The message _id from a search result.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp#diagnostics

## Score history

- 2026-08-04: 75
- 2026-08-03: 71
- 2026-08-02: 71
- 2026-08-01: 31
- 2026-07-31: 5
- 2026-07-30: 69
- 2026-07-29: 87
- 2026-07-28: 87
- 2026-07-27: 26

## Links

- npm package: https://www.npmjs.com/package/@jperelli/graylog-mcp
- Socket report: https://socket.dev/npm/package/@jperelli/graylog-mcp
- Repository: https://github.com/jperelli/graylog-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jperelli-graylog-mcp/jperelli-graylog-mcp