Labsco
MCP SERVER · OFFICIAL PROJECT

Last9

by last9 ↗

Point an AI agent at your production observability — logs, traces, metrics, exceptions, slow database queries, alerts and deployments — so it reads the real signal instead of guessing.

Observability, Monitoring & Incident Response
Summary
Your agent stops guessing at production and reads the actual signal.

The incident-correlation path is where this earns its place: get_change_events lines up deployments and rollbacks against get_alerts and the trace waterfall, so an agent debugging an outage can tie 'what's firing' to 'what changed' rather than speculating. The database tools are a quiet strength too — they come straight from OpenTelemetry spans, so slow-query analysis with trace IDs works with no extra instrumentation if you already run OTel.

What it is

Last9's official server connecting an AI assistant to your production observability data: tools across APM and services, logs, traces, database performance, alerts and change events, and dashboards, grouped into toolsets you can narrow. It runs as a hosted OAuth endpoint with no binary to install.

What you get
  • Service performance: get_service_environments (run first — other APM tools need its env), get_service_performance_details for throughput, error rate, p50/p90/p95 and apdex, get_service_dependency_graph, and get_apm_service_deviations comparing a window against a baseline
  • Logs: get_logs for full JSON-pipeline queries with aggregations, get_service_logs for raw lines filterable by severity, and get_log_attributes / get_log_attributes_for_pipeline to discover the fields that actually exist
  • Traces: get_traces for broad queries, get_service_traces by exact trace ID, get_trace_waterfall to render one trace as a parent/child waterfall with self-time, and get_trace_attribute_deviations to rank what differs between slow and fast cohorts
  • Database performance from OpenTelemetry spans, no extra instrumentation: get_databases, get_database_slow_queries with trace IDs to drill in, get_database_queries for patterns, and get_database_server_metrics
  • get_exceptions returns server-side exceptions with service and span filters
  • Incident correlation: get_change_events for deployments, config changes and rollbacks, get_alerts for what is firing, get_alert_config and get_alert_rule_state for history, and get_notification_channels
  • Dashboards read with get_dashboard and get_dashboard_snapshot for a shareable frozen view
  • did_you_mean suggests the closest entity names when a lookup comes up empty — the server calls it automatically before most tools
  • Large log and trace results are chunked rather than truncated, and reference manuals are exposed as MCP resources rather than always-on tool text
Requirements

A Last9 account. The fastest path is the hosted server at https://app.last9.io/api/v4/organizations/<org_slug>/mcp over HTTP with OAuth in your browser — no binary, no tokens to manage; find your org slug in your Last9 URL. The @last9/mcp-server package runs it locally. LAST9_TOOLSETS narrows what is exposed to named packs (logs, traces, metrics, alerts, dashboards, investigate, all), and LAST9_MAX_GET_LOGS_ENTRIES caps chunked log requests at its default of 5000.

Setup effort

One command plus a key — claude mcp add --transport http last9 https://app.last9.io/api/v4/organizations/<org_slug>/mcp, then supply credentials