LogTriage MCP server: security log tools for AI agents
Give Claude, Cursor, VS Code or your own agent the same tools this site offers investigators: Microsoft’s error-code tables, a field-by-field log explainer, 12 free IP blocklists, attack checks for 55 log formats and the reference library. Answers come from data and deterministic checks, not from the model’s memory, and each one links the page that explains it.
Endpoint (Streamable HTTP)
https://api.logtriage.app/mcp
Free tools: no account, no key. Full analysis: a LogTriage API key as Authorization: Bearer ltk_…
Connect
Claude Code
Run in a terminal. Add --header "Authorization: Bearer ltk_…" for the two API-key tools.
claude mcp add --transport http logtriage https://api.logtriage.app/mcpClaude (claude.ai and the desktop app)
Settings → Connectors → Add custom connector, then this URL. Custom connectors cannot send an API key, so this gives the five free tools.
https://api.logtriage.app/mcpCursor
In ~/.cursor/mcp.json (or .cursor/mcp.json in a project). Leave out "headers" for the free tools only.
{
"mcpServers": {
"logtriage": {
"url": "https://api.logtriage.app/mcp",
"headers": {
"Authorization": "Bearer ltk_…"
}
}
}
}VS Code
In .vscode/mcp.json. Leave out "headers" for the free tools only.
{
"servers": {
"logtriage": {
"type": "http",
"url": "https://api.logtriage.app/mcp",
"headers": {
"Authorization": "Bearer ltk_…"
}
}
}
}Tools
| Tool | What it does | Needs |
|---|---|---|
| lookup_error_code | AADSTS, NTSTATUS (hex or decimal) and Kerberos codes, or whole pasted errors, explained from Microsoft’s official tables, with where each code is logged. | Nothing |
| explain_log_record | One record — an access-log line, auth.log line, Windows event XML, CloudTrail or Entra ID JSON, CEF — with every field’s meaning and its source, and times, codes, addresses and encoded PowerShell decoded. | Nothing |
| check_ip_blocklists | Up to 500 IPv4 addresses, or text containing them, against IPsum, FireHOL levels 1–3, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, ET compromised and Tor exits. | Nothing |
| scan_log_for_attacks | Up to 5 MB of log text in any of 55 formats: the format is detected and the free analyzer’s checks run — brute force, password spraying, logins after failures, web scanning, cloud privilege changes, suspicious commands — with MITRE ATT&CK techniques. | Nothing |
| search_reference | Finds the reference page for a Windows event ID, an error code, a CloudTrail or CrowdStrike event, an sshd message, a scanner probe or user agent, or a log format. | Nothing |
| analyze_log_file | The full LogTriage analysis of up to 10 MB of text: threat-intelligence enrichment, risk scoring and an AI-written incident report. Uses the account’s analysis credits. | API key |
| get_analysis | Status and, when finished, the report of an analysis: severity, attack pattern, summary, indicators, ATT&CK techniques and remediation steps, with a link to the full report. | API key |
What to ask
Once connected, ask in plain language and the agent picks the tool:
- “What does Sub Status 0xC000006A in this 4625 event mean, and what should I check next?”
- “Explain every field of this CloudTrail record.”
- “Which of the IP addresses in this auth.log excerpt are on public blocklists?”
- “Scan this nginx access log for attacks and summarise what you find.”
Data and limits
The free tools process what the agent sends in memory and keep nothing; the server logs which tool was called, not what was sent.
Requests are limited to 60 a minute per address. scan_log_for_attacks reads up to 5 MB of text and makes no
threat-intelligence lookups; for a larger file, or to keep the log off any server, the browser analyzer reads
up to 25 MB without uploading it. analyze_log_file stores the log like an upload in the app, as the privacy policy describes.
The blocklists are downloaded from their publishers’ public copies and refreshed twice a day; being listed is evidence, not proof — our measurement shows how much of real attack traffic each list catches.
Questions
- Does it cost anything?
- The five lookup and scanning tools are free and need no account or key. analyze_log_file and get_analysis run the full product and need a LogTriage API key, which Pro and the one-time incident pack include; each analysis uses the account’s credits like an upload in the app.
- What happens to the logs an agent sends?
- Text sent to the free tools is processed in memory and discarded when the answer is returned: it is not stored, and the server logs only which tool was called. A log sent to analyze_log_file is handled like an upload in the app: the raw file is kept for 7 days, the results until you delete the analysis.
- Which MCP clients work?
- Any client that speaks the Streamable HTTP transport: Claude (custom connectors), Claude Code, Cursor, VS Code, and agent frameworks built on the MCP SDKs. The server is stateless and answers each request with JSON, so it also works through proxies that do not keep connections open.
- Why not just ask the model?
- Models answer error codes and blocklist questions from memory, and memory is often wrong or out of date: a model may describe a code that Microsoft documents differently, or call an address malicious with no data behind it. These tools answer from Microsoft’s published tables, from blocklists refreshed twice a day and from deterministic checks, and every answer links the page that explains it.
Full analysis from your agent
With an API key, analyze_log_file enriches every address, user agent and hash with threat intelligence and returns an AI-written incident report with indicators, ATT&CK mapping and remediation steps. API keys come with Pro and the one-time incident pack.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing