# Claude Log Analyzer

> MCP server for Kubernetes log analysis, anomaly detection, and root cause analysis with Claude Code

- **Type:** MCP server
- **Install:** `agentstack add mcp-samarthpatel24-claude-log-analyzer`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [samarthpatel24](https://agentstack.voostack.com/s/samarthpatel24)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [samarthpatel24](https://github.com/samarthpatel24)
- **Source:** https://github.com/samarthpatel24/claude-log-analyzer
- **Website:** https://www.npmjs.com/package/claude-log-analyzer

## Install

```sh
agentstack add mcp-samarthpatel24-claude-log-analyzer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

MCP server that connects to your Kubernetes cluster and provides Claude Code with tools for log analysis, anomaly detection, and root cause analysis.

---

## What it does

- Fetches pod logs, status, metrics, and events from a live K8s cluster
- Detects anomalies: CPU/memory spikes, error bursts, restart storms, OOM kills
- Correlates events across services to identify cascading failures
- Produces evidence-backed root cause analysis reports (MD or TXT)
- Every finding cites actual log lines, metric values, or event data

## Install

Add to your project's `.mcp.json`:

```json
{
  "mcpServers": {
    "k8s-analyzer": {
      "command": "npx",
      "args": ["-y", "claude-log-analyzer"]
    }
  }
}
```

> **Windows users:** Use `"command": "cmd"` with `"args": ["/c", "npx", "-y", "claude-log-analyzer"]`

## Prerequisites

-  
- A valid kubeconfig (`~/.kube/config` or set `KUBECONFIG` env var)
- RBAC permissions to read pods, logs, events, and metrics
- metrics-server on the cluster (optional, for resource metrics)

## Tools

| Tool | Description |
|------|-------------|
| `list_namespaces` | List all namespaces in the cluster |
| `fetch_pod_logs` | Fetch and filter pod logs with severity detection and noise removal |
| `get_pod_status` | Pod phase, conditions, container states, restart counts |
| `get_resource_metrics` | CPU/memory usage via Metrics API with % against limits |
| `get_events` | Kubernetes events (Warning/Normal) with filtering |
| `get_cluster_health` | High-level cluster health overview |
| `detect_anomalies` | Run anomaly detection on a namespace |
| `analyze_service` | Deep dive on a specific service |
| `get_root_cause_analysis` | Full RCA with exported report |

## Configuration

### Environment variables

| Variable | Default | Description |
|----------|---------|-------------|
| `KUBECONFIG` | `~/.kube/config` | Path to kubeconfig file |
| `K8S_CONTEXT` | current-context | Kubernetes context to use |
| `K8S_DEFAULT_NAMESPACE` | `default` | Default namespace |
| `K8S_LOG_MAX_LINES` | `500` | Max log lines per pod |
| `K8S_TIME_WINDOW` | `60` | Default time window in minutes |
| `K8S_MODE` | `both` | Default mode: `logs`, `metrics`, or `both` |

Pass env vars through MCP config:

```json
{
  "mcpServers": {
    "k8s-analyzer": {
      "command": "npx",
      "args": ["-y", "claude-log-analyzer"],
      "env": {
        "KUBECONFIG": "/path/to/kubeconfig",
        "K8S_TIME_WINDOW": "30",
        "K8S_MODE": "logs"
      }
    }
  }
}
```

### Per-call configuration

Every analysis tool accepts:
- `timeWindowMinutes` — override the default time window
- `mode` — `"logs"`, `"metrics"`, or `"both"`

The `get_root_cause_analysis` tool also accepts:
- `exportFormat` — `"md"` (default) or `"txt"`
- `exportPath` — custom file path for the report

## Token efficiency

The server minimizes token usage by:
- Filtering out noise (health checks, liveness/readiness probes)
- Detecting log severity to skip irrelevant lines
- Summarizing log results (error counts, top errors) alongside raw data
- Truncating with a `truncated` flag so Claude can narrow queries
- Returning only a summary from the RCA tool (full details go to the exported report)

## Anomaly detection

- **CPU/memory spikes** — peer comparison (z-score against sibling pods) + threshold-based (% of limit)
- **Error bursts** — 1-minute bucketing, flags statistical outliers (mean + 3σ) and absolute thresholds
- **Restart storms** — restart count thresholds + CrashLoopBackOff detection
- **OOM kills** — container termination reason + event scanning
- **Event floods** — warning event count per object with auto-escalation for critical reasons

## Report output

Reports are written to disk, not returned in full to the LLM. Every claim is backed by evidence:

```
### [CRITICAL] OOM Kill — pod/payments-7f8b9-x2k4
- **Description:** Container 'payments' was OOM killed (exit code: 137)
- **Value:** 7 (threshold: 3)

### [HIGH] Error Burst — pod/payments-7f8b9-x2k4
- **Description:** 142 errors/min detected (baseline: 3.0/min). 284 total errors in window.
- **Sample log lines:**
  - `java.lang.OutOfMemoryError: Java heap space`
  - `Failed to process transaction: heap exhausted`
```

## License

[MIT](LICENSE)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [samarthpatel24](https://github.com/samarthpatel24)
- **Source:** [samarthpatel24/claude-log-analyzer](https://github.com/samarthpatel24/claude-log-analyzer)
- **License:** MIT
- **Homepage:** https://www.npmjs.com/package/claude-log-analyzer

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-samarthpatel24-claude-log-analyzer
- Seller: https://agentstack.voostack.com/s/samarthpatel24
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.