MCP server for streaming NDJSON log triage — query patterns, detect anomalies, summarize timelines without loading gigabyte files into context.
If you already use Ndjson, the ndjson mcp server is the piece that lets your assistant work with it directly. MCP server for streaming NDJSON log triage — query patterns, detect anomalies, summarize timelines without loading gigabyte files into context.
MCP server that stream-parses NDJSON log files without loading them into memory — filter by pattern, detect error spikes via Z-score analysis, summarize severity timelines by time window.
Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client. The configuration blocks on this page cover the common clients.
The toolset is worth reading before you wire it up, because it tells you what the integration is really for:
query_log_pattern — Filter log entries by a field/value match. Returns up to N matching entries, streaming the file without loading it entirely. Pass lineStartPatterndetect_error_anomalies — Z-score frequency analysis. Buckets errors by time window, computes mean + stddev, flags windows where the error rate is anomalously highsummarize_log_timeline — Chronological aggregation of errors, warnings, and info counts per time window. Quick visual of where the incident iscorrelate_request — Reconstructs a distributed trace from multiple NDJSON log files. Given a trace_id, collects all correlated events in chronological order across alldiscover_log_schema — Analyze a log file to infer its wrapper format (NDJSON, Syslog, Kubernetes container logs) and extract type schemas, identifying polymorphic keysgroup_semantic_patterns — Cluster log messages dynamically using the fixed-depth tree-based Drain parsing algorithm to isolate distinct log templates and analyze theirstart_live_triage — Start background log tailing with real-time Z-score anomaly alerting on error frequency spikes and heap memory protection limits. Dispatchesquery_external_logs — A unified gateway to query central log providers (Datadog, Splunk, Elasticsearch), converting search patterns to vendor-specific dialects and mappingThis sits in the monitoring and observability group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Ndjson's toolset — query_log_pattern, detect_error_anomalies, summarize_log_timeline and 5 more — is a fair guide to whether it matches your workflow. It is maintained by vola-trebla; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Ndjson's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| query_log_pattern | Filter log entries by a field/value match. Returns up to N matching entries, streaming the file without loading it entirely. Pass lineStartPattern (e.g. "^{") to reconstruct multiline stack traces silently dropped by the |
| detect_error_anomalies | Z-score frequency analysis. Buckets errors by time window, computes mean + stddev, flags windows where the error rate is anomalously high. |
| summarize_log_timeline | Chronological aggregation of errors, warnings, and info counts per time window. Quick visual of where the incident is. |
| correlate_request | Reconstructs a distributed trace from multiple NDJSON log files. Given a trace_id, collects all correlated events in chronological order across all files and surfaces the services involved and total duration. |
| discover_log_schema | Analyze a log file to infer its wrapper format (NDJSON, Syslog, Kubernetes container logs) and extract type schemas, identifying polymorphic keys, timestamp patterns, and severity fields. |
| group_semantic_patterns | Cluster log messages dynamically using the fixed-depth tree-based **Drain parsing algorithm** to isolate distinct log templates and analyze their parameter distributions (wildcard variations). |
| start_live_triage | Start background log tailing with real-time Z-score anomaly alerting on error frequency spikes and heap memory protection limits. Dispatches notifications directly over standard JSON-RPC channels. |
| query_external_logs | A unified gateway to query central log providers (Datadog, Splunk, Elasticsearch), converting search patterns to vendor-specific dialects and mapping the output into the standardized **OpenTelemetry Log Data Model** stru |
{
"mcpServers": {
"log-triage": {
"command": "npx",
"args": ["-y", "ndjson-local-log-triage-mcp"]
}
}
}Configuration as documented by the project. Restart the client after saving.
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
Errors with full context — stack traces, issue triage and AI-powered root-cause analysis from Sentry's server.
Enables enhanced web research capabilities for large language models through intelligent search queuing and advanced content extraction.
Automates browser interactions and enables Large Language Models (LLMs) to interact with web pages through Playwright and Chrome DevTools Protocol
Guides tool usage by providing recommendations for MCP tools at each problem-solving stage.