query_tracesLABSCO SUMMARY
The whole APM investigation loop in one server: from an alarm, to the trace, to the log line, to the topology that explains it.
SkyWalking's own data model comes through intact — MQE expressions, layers, the four topology views — so an agent can follow a latency spike from the service down to the process without you translating anything. The metadata tools matter more than they look: services, instances and endpoints have to be named the way OAP names them, and these are what get that right before a query runs.
What it is
Apache SkyWalking's own server against an OAP backend, covering traces, logs, MQE metrics, service metadata, events, alarms and topology.
What you get
- Traces queried on service, endpoint, state, tags and a time range, in full, summary or errors-only views with performance insights attached
- Logs filtered by service, instance, endpoint, trace id, tags and time, with cold storage and pagination
- Metrics through MQE: run an expression with calculations, aggregations, TopN and trend analysis, list the available metrics by regex, and check a metric's type before writing the expression
- The metadata you need to name things correctly — layers, the services in a layer, a service's instances, its endpoints with keyword filtering, and the processes on an instance
- Events such as deployments, restarts and scaling, filtered by service, instance, endpoint, type and layer
- Alarms from metric threshold breaches, filtered by scope, keyword and tags
- Topology at four levels: global or scoped service topology, instance topology between a client and a server service, endpoint dependencies, and process topology for an instance
- Prompts that assemble the usual investigations — analyse a service's performance, compare services, rank the top N by a metric, deep-dive one trace, explore a layer's topology, build an MQE expression, and turn a phrase like "last two hours" into a start and end pair
- A read-only flag that restricts the server to read operations
Requirements
A reachable SkyWalking OAP instance; the server connects to the URL you pass with --sw-url, defaulting to http://localhost:12800/graphql, with --sw-username and --sw-password for basic auth, both accepting an environment-variable form. Built from source in Go, or run from the Docker image the repository builds. Three transports: stdio, SSE and Streamable HTTP, the latter two taking an address, a path and a CORS origin allowlist. The HTTP transports reject loopback requests that carry a non-loopback Host header as DNS rebinding protection, so a reverse proxy in front of them should rewrite Host to localhost.
Setup effort
Build from source — git clone https://github.com/apache/skywalking-mcp.git
USE CASES
Working out why a service got slow
Find its metrics with MQE, then pull the traces for that window and read the errors-only view.
Following an alarm to its cause
Read the alarms, then the traces and logs for the same service and window.
Checking whether a deploy caused it
Query the events for that service and line the restarts and scaling up against when the problem started.
Understanding what depends on what
Pull the service topology, then narrow to instance or endpoint dependencies where the failure is.
Finding the right names before you query
List the layers, the services in one, then its instances and endpoints.
Chasing one request end to end
Query the trace, then filter logs by that trace id to see what each hop recorded.
16 tools
Listed in project docs. Your client may show a different list.
query_logsexecute_mqe_expressionlist_mqe_metricsget_mqe_metric_typelist_layerslist_serviceslist_instanceslist_endpointslist_processesquery_eventsquery_alarmsquery_services_topologyquery_instances_topologyquery_endpoints_topologyquery_processes_topologyBEFORE YOU INSTALL
What to know first
Tools you get
16 tools named in the project's documentation. Every tool is a read-only query against OAP, so --read-only does not change the count. generate_duration is a prompt, not a tool.
Requires
- Go and make, to build the swmcp binary
- A reachable SkyWalking OAP (--sw-url, e.g. http://localhost:12800)
Where it runs
All 4 documented clients run the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
git clone https://github.com/apache/skywalking-mcp.git
cd skywalking-mcp && go mod tidy
makeStart it, e.g. bin/swmcp stdio --sw-url http://localhost:12800 (or sse / streamable transports)
Add the mcpServers block below to your Cursor / Copilot / Claude Code config
Docker alternative: make build-image (local linux/amd64 image), then use the docker-flavoured mcpServers block that runs docker run --rm -i skywalking-mcp:latest --sw-url http://localhost:12800
MCP Clients
Cursor, Claude Code
{
"mcpServers": {
"skywalking": {
"command": "<YOUR_PATH_TO_SKYWALKING_MCP>/bin/swmcp",
"args": [
"stdio",
"--sw-url",
"http://localhost:12800",
"--sw-username",
"admin",
"--sw-password",
"${SW_PASSWORD}"
]
}
}
}<YOUR_PATH_TO_SKYWALKING_MCP> is the folder you cloned — make builds the binary into bin/swmcp. Your client does not fill in "${SW_PASSWORD}": swmcp reads it from its own environment when it starts, so SW_PASSWORD must be set there — add "env": {"SW_PASSWORD": "<YOUR_SW_PASSWORD>"} beside args. The password can also go straight into args. admin is a sample basic-auth user; yours is your OAP's own. Or drop --sw-username and --sw-password if your OAP has no basic auth.
GitHub Copilot
{
"mcpServers": {
"skywalking": {
"command": "<YOUR_PATH_TO_SKYWALKING_MCP>/bin/swmcp",
"args": [
"stdio",
"--sw-url",
"http://localhost:12800",
"--sw-username",
"admin",
"--sw-password",
"${SW_PASSWORD}"
]
}
}
}<YOUR_PATH_TO_SKYWALKING_MCP> is the folder you cloned — make builds the binary into bin/swmcp. Your client does not fill in "${SW_PASSWORD}": swmcp reads it from its own environment when it starts, so SW_PASSWORD must be set there — add "env": {"SW_PASSWORD": "<YOUR_SW_PASSWORD>"} beside args. The password can also go straight into args. admin is a sample basic-auth user; yours is your OAP's own. Or drop --sw-username and --sw-password if your OAP has no basic auth. This is the mcpServers shape GitHub Copilot CLI reads (~/.copilot/mcp-config.json); Copilot in VS Code takes the same "skywalking" entry under a top-level "servers" key in .vscode/mcp.json.
Any MCP client — Docker
{
"mcpServers": {
"skywalking": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"skywalking-mcp:latest",
"--sw-url",
"http://localhost:12800"
]
}
}
}