A raw log query from an agent tends to return everything and then narrate it. Signals are filters somebody already tuned to separate the interesting from the constant, and pointing the query at one inherits that judgement for free. Reporting suppressed as a distinct alert state is the other detail worth having — an alert that is suppressed looks identical to one that is fine, and the difference is exactly what you want to know at three in the morning. Three tools, read-only, and it depends entirely on your Seq being well-organised.
A three-tool Seq client: list the saved signals, retrieve structured events, and read alert state.
- get_signals lists the saved named filters, and their ids are what get_events takes to narrow a query — so the team's existing definitions are reusable rather than reinvented.
- get_events retrieves structured log events for investigating errors and analysing behaviour.
- get_alert_state returns every alert as firing, ok or suppressed — suppressed being the state that explains why nobody was paged.
SEQ_BASE_URL and SEQ_API_KEY — Seq is self-hosted, so the base URL is your own instance.
One command plus a key — npm install -g mcp-seq, then supply credentials