LogTriage MCP Server

by logtriage-cyber Your server? Claim it

answering

LogTriage is answering right now. Last checked 10 min ago. It exposes 5 tools.

Security log tools: Windows/Entra error codes, log explainer, IP blocklists, attack scans

Uptime history 48 hours of history

48 hours agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

219 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 2

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 7 November 2026. No other catalogue keeps this.

7 Nov 2 tools disappeared analyze_log_file, get_analysis

Tools have disappeared from this server

A tool that vanishes takes a piece of your agent with it, and the change arrives silently. Watch this server and every such change lands in your inbox.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add logtriage --transport http https://api.logtriage.app/mcp

Settings → Connectors → Add custom connector, then paste this address

https://api.logtriage.app/mcp

~/.codex/config.toml

[mcp_servers.logtriage]
url = "https://api.logtriage.app/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "logtriage": {
      "url": "https://api.logtriage.app/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "logtriage": {
      "type": "http",
      "url": "https://api.logtriage.app/mcp"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

blocklists

check_ip_blocklists

Checks IPv4 addresses against 12 free public blocklists (IPsum, FireHOL levels 1-3, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, ET compromised, Tor exits), the same lists as logtriage.app's IP blocklist checker. Accepts a list of addresses or any text containing them (log lines, CSV); private and other special-purpose ranges are labelled, not looked up. Up to 500 addresses per call. Lists are refreshed twice a day. Being on a list is evidence, not proof. Free; no API key needed.

explain

explain_log_record

Identifies the format of one log record (access-log line, syslog/auth.log line, Windows event XML, CloudTrail, Entra ID, CrowdStrike, firewall, CEF/LEEF and more) and lists every field with what it means and where that meaning comes from (LogTriage's reference pages or the vendor's published definition). Decodes values: timestamps, address ranges, HTTP statuses, ports, logon types, NTSTATUS and AADSTS codes, encoded PowerShell. Runs LogTriage's attack checks on the record too. Free; no API key needed.

lookup

lookup_error_code

Explains Microsoft authentication error codes from Microsoft's official tables: Entra ID sign-in errors (AADSTS50126, or the bare 50126), Windows NTSTATUS codes as logged in events 4625/4776 (0xC000006A, C000006A, or decimal 3221225578 / -1073741718), Kerberos failure codes from events 4768/4769/4771 (0x18), and official names (IdsLocked, STATUS_ACCOUNT_LOCKED_OUT, KDC_ERR_PREAUTH_FAILED). Paste a whole error message or event to find every code in it, or give words to search names and descriptions. Returns the official name and description, where the code is logged, and LogTriage's investigation page when one exists. Free; no API key needed.

reference

search_reference

Finds LogTriage's reference pages for an investigation: Windows Security event IDs, Entra AADSTS, NTSTATUS and Kerberos codes, AWS CloudTrail events (ConsoleLogin, AssumeRole...), CrowdStrike Falcon events (ProcessRollup2...), sshd/PAM log messages, web scanner probes, scanner user agents, log format field references and the free tools. Each page explains what the entry means, the fields to read and queries (KQL, CQL, SPL, bash) to investigate it. Returns the best matches with links. Free; no API key needed.

scan

scan_log_for_attacks

Detects the log format (50+ formats: web access logs, auth.log, Windows events, Sysmon, CloudTrail, Entra ID, Okta, Kubernetes audit, firewalls, EDR exports and more) and runs LogTriage's deterministic attack checks: brute force and password spraying, logins after failures, web scanning and injection, privilege changes in cloud logs, suspicious command lines, port scans and others, with MITRE ATT&CK techniques. Up to 5 MB of text; no threat-intelligence lookups and no AI (use analyze_log_file for those). The log is processed in memory and not stored. Free; no API key needed.

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

analyze_log_file

removed 7 Nov 2026

get_analysis

removed 7 Nov 2026

Endpoints

URL	Transport	State	Latency	Checked
https://api.logtriage.app/mcp	streamable-http	answering	209 ms	10 min ago

Alternatives to LogTriage

same job, measured the same way

CodexGuild

by codexguild

What changed in your stack since the model's cutoff, error fixes, and security-scanned skills/MCPs

206 installs/wk answering

Krita Codex MCP

by cyyprezz

Control Krita through a secure local MCP server and authenticated Windows bridge.

442 installs/wk local only

Jikida

by jikida

Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.

85 installs/wk local only

Sentrint

by sentrint

Code security scanner for founders and small teams: leaked secrets, missing RLS, injection, CVEs

answering

Brevio Core

by brevio-ventures

Zero-token code rules for coding agents: scan, explain a rule, learn a guard. Local, no model call.

616 installs/wk local only

AI Scanner

by aakashbhardwaj27

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

50 installs/wk local only

SafeWeave

by safeweave

Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.

79 installs/wk answering

Agentscore

by thezenmonster

MCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.

100 installs/wk local only

LogTriage — questions

Answers built from our own checks of this server.

What can LogTriage do?

It exposes 5 tools, read directly from the server on our last check. Among them: check_ip_blocklists, explain_log_record, lookup_error_code, scan_log_for_attacks, search_reference. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is LogTriage working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 219 ms. The bar chart above shows every period we have measured.

Did LogTriage ever remove tools?

Yes. analyze_log_file, get_analysis are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.

How do I connect LogTriage?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does LogTriage need an API key?

No. LogTriage completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is LogTriage?

It answers our handshake in 219 ms on average, which is faster than 65% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.