MCP server for Grafana Loki: LLM-friendly log search with fuzzy container-name rescue
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"loki-tail-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# loki-tail-mcp An [MCP](https://modelcontextprotocol.io) server for [Grafana Loki](https://grafana.com/oss/loki/), designed around how LLMs actually query logs: compact output, hard row caps, and a **fuzzy container-name rescue** that turns the classic empty-result-because-wrong-name failure into an auto-corrected retry or an actionable suggestion list. Built on the [Python MCP SDK](https://github.com/modelcontextprotocol/python-sdk) (FastMCP); runs as a local stdio server or a containerized Streamable HTTP service with bearer auth. ## Tools | Tool | Notes | |---|---| | `loki_tail_container` | "What is service X saying?" — the primary tool. Accepts approximate names: service vocabulary (`vpn`, `proxy`), bare names (`sonarr`), typos. On zero results it distinguishes *valid-but-quiet* from *unknown name*, auto-substitutes a unique fuzzy match (flagged in the output), or suggests candidates. | | `loki_query_range` | Raw LogQL range query — multi-container correlation (`{container=~"a\|b"} \|= "..."`) and metric queries (`count_over_time(...)`). | | `loki_query_instant` | Instant query at a point in time (metric queries). | | `loki_list_containers` | Durable container names (ephemeral CI/batch names hidden). | | `loki_list_labels` / `loki_list_label_values` | Raw label discovery. | | `loki_patterns` | Log pattern mining — thousands of lines → ranked recurring templates with counts. Requires the server-side [pattern ingester](https://grafana.com/docs/loki/latest/operations/query-patterns/) (`pattern_ingester.enabled: true`). | | `loki_log_volume` | Rank containers by log bytes over a window — "which service suddenly got noisy". | | `loki_detected_fields` | Fields Loki can auto-extract from a stream (name/type/cardinality/parser) — discover `\| logfmt \| status>=500` opportunities before writing LogQL. | ### The name-resolution design Matching always runs against **live label values**, never a hardcoded list, so it survives renames. Resolution tries, in order: exac…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.