Model Context Protocol (MCP)

The Model Context Protocol is an open standard introduced by Anthropic that defines how AI applications connect to external tools and data sources. It's analogous to LSP for editors: one protocol, many clients, many servers.

You can connect your AI agents and IDEs to your OpenObserve instance to query logs, metrics, and traces in natural language; create and manage alerts; and explore stream metadata directly from your editor or agent runtime. MCP enables:

• Natural-language queries against logs, metrics, and traces from your IDE
• Agentic operations like alert creation as part of CI/CD pipelines
• AI-assisted troubleshooting where an agent can pull stream data, correlate traces, and suggest root causes

Prerequisites

Your MCP endpoint follows the pattern:

https://your-instance/api/{org_id}/mcp

Generate a Base64-encoded auth token from your OpenObserve credentials:

echo -n "your-email@example.com:your-password" | base64

You'll use this token in every client below.

Connect to OpenObserve's MCP server

{
  "mcpServers": {
    "openobserve": {
      "url": "https://your-instance/api/default/mcp",
      "headers": {
        "Authorization": "Basic <YOUR_BASE64_TOKEN>"
      }
    }
  }
}

{
  "servers": {
    "openobserve": {
      "type": "http",
      "url": "https://your-instance/api/default/mcp",
      "headers": {
        "Authorization": "Basic <YOUR_BASE64_TOKEN>"
      }
    }
  }
}

claude mcp add openobserve https://your-instance/api/default/mcp \
  -t http \
  --header "Authorization: Basic <YOUR_BASE64_TOKEN>"

claude mcp list

{
  "mcpServers": {
    "openobserve": {
      "url": "https://your-instance/api/default/mcp",
      "headers": {
        "Authorization": "Basic <YOUR_BASE64_TOKEN>"
      }
    }
  }
}

{
  "mcpServers": {
    "openobserve": {
      "url": "https://your-instance/api/default/mcp",
      "headers": {
        "Authorization": "Basic <YOUR_BASE64_TOKEN>"
      }
    }
  }
}

Building autonomous agents

For agentic workflows outside an IDE, call the MCP server directly over HTTP. We recommend creating a dedicated user with scoped permissions for agent use.

# start_time / end_time are epoch microseconds; this example queries the last hour
START=$(python3 -c "import time; print(int((time.time() - 3600) * 1_000_000))")
END=$(python3 -c "import time; print(int(time.time() * 1_000_000))")

curl https://your-instance/api/default/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic <YOUR_BASE64_TOKEN>" \
  -d @- <<EOF
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "SearchSQL",
    "arguments": {
      "org_id": "default",
      "request_body": {
        "query": {
          "sql": "SELECT * FROM logs WHERE level = 'error' LIMIT 10",
          "start_time": $START,
          "end_time": $END,
          "from": 0,
          "size": 10
        }
      }
    }
  },
  "id": 1
}
EOF

This pattern works with OpenAI's Responses API, Anthropic's API, and any agent runtime that supports remote MCP servers.

Available tools

OpenObserve includes the following tools. Tool names are prefixed with your server name (e.g. mcp__openobserve__StreamList).

Legend: pinned = exposed directly in the initial tools/list response (no search required) · ⚠️ = destructive (modifies or deletes data)

Multi-organization workflows

Each organization in your OpenObserve instance has its own MCP endpoint. You can register multiple servers in a single client to switch contexts. The example below uses the Claude Code CLI, but the same pattern applies to every client covered above: add one entry per org in the relevant config file (mcp.json, claude_desktop_config.json, etc.).

claude mcp add o2-prod https://your-instance/api/production/mcp \
  -t http --header "Authorization: Basic <PROD_TOKEN>"

claude mcp add o2-dev https://your-instance/api/development/mcp \
  -t http --header "Authorization: Basic <DEV_TOKEN>"

This is useful for keeping production data isolated from development queries, or for SaaS deployments where each tenant has its own org.

Security considerations

• Use a dedicated MCP user with the minimum permissions required, rather than your personal admin credentials.
• Never commit credentials to version control. Store Base64 tokens in environment variables or a secrets manager.
• Rotate credentials regularly and revoke access for any client you no longer use.
• Confirm tool calls before execution in your MCP client when possible. This protects against prompt injection from untrusted data sources.
• Use organization-specific endpoints to limit blast radius. A token for org_a cannot access org_b.
• Restrict network access to the MCP endpoint via firewall rules or IP allowlisting where feasible.

Troubleshooting

# Verify your Base64 token decodes correctly
echo "<YOUR_BASE64_TOKEN>" | base64 -d
# Should print: your-email@example.com:your-password

# Test credentials against the meta endpoint
curl -u "username:password" https://your-instance/api/default/_meta

Next steps

• Claude Code MCP setup: step-by-step walkthrough for the Claude Code CLI.
• Building autonomous agents: call the MCP server directly from your own agent runtime.
• MCP Protocol Specification: the open standard behind every client and server.
• GitHub Issues: file bugs or feature requests.

Need some help?

• Join our Community Slack
• Or Contact support