{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_5zm443rxrrpm","handle":"mcp-syslog-crunchtools","url":"https://wellknown.network/agents/mcp-syslog-crunchtools","links":{"self":"https://wellknown.network/agents/mcp-syslog-crunchtools/record.json","html":"https://wellknown.network/agents/mcp-syslog-crunchtools","markdown":"https://wellknown.network/agents/mcp-syslog-crunchtools/record.md","api":"https://wellknown.network/api/v1/agents/mcp-syslog-crunchtools","status":"https://wellknown.network/api/v1/agents/mcp-syslog-crunchtools/status","claim":"https://wellknown.network/agents/mcp-syslog-crunchtools/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-syslog-crunchtools/claim.json","badge":"https://wellknown.network/agents/mcp-syslog-crunchtools/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-syslog-crunchtools/history","tools":"https://wellknown.network/api/v1/agents/mcp-syslog-crunchtools/tools"},"ard":{"identifier":"urn:air::server:mcp-syslog-crunchtools","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-syslog-crunchtools","summary":"Secure MCP server for centrally collected infrastructure logs — search, tail, grep, correlate","description":"# mcp-syslog-crunchtools\n\nMCP server for the logs collected by [`crunchtools/syslog`](https://github.com/crunchtools/syslog).\n\nBuilt for RT #1460, to close a specific gap: Hermes gets paged by Nagios and can\nrestart a service, but it cannot read the service's logs — so every remediation\nis a blind restart. This turns that into an informed one.\n\n## Capabilities\n\n| Tool | What it answers |\n|---|---|\n| `syslog_sources_tool` | What can I query? |\n| `syslog_search_tool` | Show me ERRs from this service in the last 15 minutes |\n| `syslog_grep_tool` | Where does this string appear across the whole fleet? |\n| `syslog_tail_tool` | What are this service's most recent lines? |\n| `syslog_context_tool` | What was *everything* saying around 03:14? |\n| `syslog_stats_tool` | Which service is loudest, and which is actually unhealthy? |\n\n## The triage loop\n\n```\nnagios_current_problems_tool          → what is broken\nsyslog_search_tool(source=…,          → why it broke\n                   severity=\"ERR\",\n                   since=\"15m\")\nsyslog_context_tool(timestamp=…)      → what else was happening at that moment\nnagios_schedule_check_tool            → confirm the fix\n```\n\n`syslog_context_tool` without a `source` is the one that earns its keep. It spans\nevery source at once, which is how \"the app died\" gets connected to \"the database\ncontainer OOMed four seconds earlier\".\n\n## Design notes\n\n**Every result is bounded, and says when it is.** Logs are unbounded and this\noutput lands in a model's context window. Each tool caps its results, caps how\nmany lines it will scan, and annotates the answer when either limit is hit:\n\n```\n[!] Stopped after the 2,000,000-line scan limit, so this result is INCOMPLETE\n    and an empty or short result does not mean nothing happened.\n```\n\nThat annotation is load-bearing. A caller that cannot distinguish \"no errors\noccurred\" from \"I stopped looking\" will draw the wrong conclusion from an empty\nresult — and this server exists to inform remediation decisions.…","publisher":{"name":"crunchtools.com","url":null},"homepage":null,"repository":null,"version":"1.2.1","license":null,"protocols":["mcp"],"tags":["fastmcp","logging","mcp","observability","syslog"],"pricing":null,"endpoints":[{"url":"pypi:mcp-syslog-crunchtools","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":1,"provenance":"declared"},{"slug":"data.database","name":"Databases","confidence":0.791,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-syslog-crunchtools","registry":"pypi","observedAt":"2026-11-03T16:26:03.608Z","publishedAt":"2026-10-31T23:06:26.145353Z","latestVersion":"1.2.1"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-syslog-crunchtools","url":"https://pypi.org/project/mcp-syslog-crunchtools/","firstSeenAt":"2026-10-04T08:21:31.511Z","fetchedAt":"2026-11-03T16:24:44.189Z","normalizedAt":"2026-11-03T16:24:44.189Z"}]},"firstSeenAt":"2026-10-04T08:21:31.511Z","updatedAt":"2026-11-03T16:26:03.608Z"}