analyze_logs_for_root_cause_relative_timeLABSCO SUMMARY
Both halves of an incident: what the logs say, and what the pipeline carrying them is doing.
The analysis tools deduplicate and cluster before anything reaches the model, so a noisy window comes back as candidate causes rather than raw lines. The same server also builds pipelines, and it holds back on the irreversible parts — a pipeline created from a manifest stays a draft unless publish is explicitly set to true, and deletion is documented as needing your confirmation first.
What it is
Mezmo's remote server at https://mcp.mezmo.com/mcp, connecting an AI assistant or IDE chat agent to the Mezmo observability platform for root-cause analysis, log queries and pipeline management.
What you get
- Root-cause analysis over a relative or absolute window — logs fetched, deduplicated, clustered and analysed in one call
- Log shaping: group_logs_by_field for distributions like errors per app or p95 latency per host, get_log_histogram for volume over time, list_log_fields to find what you can filter on
- A correlated timeline that groups logs from many sources by app, host or any custom field
- OpenTelemetry trace work: the service graph, failed traces, spans for a trace_id, and find_degraded_service_edges for calls slower than a baseline period
- Pipelines listed, inspected, created from a manifest, edited node by node, paused and published — plus tap_pipeline_component for a live sample of events
- A query syntax with fielded search on app, host, level, namespace and pod, dotted paths for nested JSON, and automatic prefix matching
Requirements
A Mezmo Service Key, generated in your dashboard under Settings > API Keys and sent as an Authorization: Bearer header. Clients that speak remote URLs point straight at the endpoint; stdio-only clients bridge through mcp-remote, which needs Node.js 18 or later.
Setup effort
Paste a URL with a key — add the endpoint to your client
USE CASES
01
Finding what caused a spike of 500s
Give it the window and it fetches, deduplicates, clusters and analyses the logs, then names the likely causes.
02
Spotting which service call is degrading
Compare the current period against a baseline to find service-to-service edges whose latency has moved, then read the spans behind a failed trace.
03
Answering which app generates the most errors
Group logs by a field and get the distribution back, with p95 or averages when you ask for a metric.
04
Standing up a new pipeline
Search the node schemas for the source and destination you need, then wire the whole DAG in one manifest call — it stays a draft until you say publish.
05
Checking what a live pipeline is actually carrying
Tap a source or processor component and read a bounded sample of the events flowing through it.
38 tools
Listed in project docs. Your client may show a different list.
analyze_logs_for_root_cause_time_rangededuplicate_logs_relative_timededuplicate_logs_time_rangegroup_logs_by_fieldget_log_histogramlist_log_fieldslist_pipelinesget_pipelinecreate_pipelineget_node_catalogsearch_pipeline_node_schemasget_pipeline_node_schemaadd_pipeline_sourceadd_pipeline_transformadd_pipeline_destinationcreate_pipeline_access_keyupdate_pipeline_componentdelete_pipeline_componentcreate_pipeline_from_manifesttap_pipeline_componentpause_pipelineunpause_pipelinepublish_pipelineget_current_timerelative_time_to_time_rangeget_service_graphlist_failed_tracesget_trace_spansfind_degraded_service_edgeslist_service_latency_summariesget_service_failure_ratesget_service_failuresget_correlated_timeline_relative_timeget_correlated_timeline_time_rangelist_ai_investigationsget_ai_investigationexport_logsBEFORE YOU INSTALL
What to know first
Tools you get
38 tools named in the project's documentation. The seven trace-analysis tools appear only when Mezmo has analysed trace data from your account in the last 24 hours or so. export_logs returns raw log lines; Mezmo recommends it for dashboards or offline analysis and the root-cause tools otherwise.
Requires
A client that can reach a remote MCP server over HTTP
INSTALLATION
Connect your client
Add the endpoint to your client.
Server setup
ENDPOINT URL
https://mcp.mezmo.com/mcpMCP Clients
Aura
AURA · TOML
[mcp.servers.mezmo]
transport = "http_streamable"
url = "https://mcp.mezmo.com/mcp"
description = "Mezmo root-cause analysis, log analysis, export, and pipeline management"
[mcp.servers.mezmo.headers]
Authorization = "Bearer <YOUR_SERVICE_KEY>"Cursor, Trae, Qodo Gen
JSON
{
"mcpServers": {
"mezmo": {
"url": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Windsurf
WINDSURF · JSON
{
"mcpServers": {
"mezmo": {
"serverUrl": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}VS Code, Visual Studio
JSON
{
"servers": {
"mezmo": {
"type": "http",
"url": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Zed
ZED · JSON
{
"context_servers": {
"mezmo": {
"url": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Gemini CLI, BoltAI, Amazon Q, JetBrains IDEs
JSON
{
"mcpServers": {
"mezmo": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.mezmo.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Claude Code
CLAUDE CODE · TERMINAL
claude mcp add --transport http mezmo https://mcp.mezmo.com/mcp --header "Authorization: Bearer <YOUR_SERVICE_KEY>"Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"Mezmo": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.mezmo.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Any MCP client — Windows
ANY MCP CLIENT — WINDOWS · JSON
{
"mcpServers": {
"mezmo": {
"command": "cmd",
"args": [
"/c",
"npx",
"mcp-remote",
"https://mcp.mezmo.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Values written as ${…} are filled in only by clients that expand variables.
Roo Code
ROO CODE · JSON
{
"mcpServers": {
"mezmo": {
"type": "streamable-http",
"url": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Zencoder
ZENCODER · JSON
{
"mcpServers": {
"mezmo-mcp": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.mezmo.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <YOUR_SERVICE_KEY>"
}
}
}
}Warp
WARP · JSON
{
"mcpServers": {
"Mezmo": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.mezmo.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <YOUR_SERVICE_KEY>"
},
"working_directory": null,
"start_on_launch": true
}
}
}OpenCode
OPENCODE · JSON
{
"mcp": {
"mezmo": {
"type": "remote",
"url": "https://mcp.mezmo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_SERVICE_KEY>"
},
"enabled": true
}
}
}Codex
CODEX · TOML
[mcp_servers.mezmo]
command = "npx"
args = ["mcp-remote", "https://mcp.mezmo.com/mcp", "--header", "Authorization:${AUTH_HEADER}"]
[mcp_servers.mezmo.env]
AUTH_HEADER = "Bearer <YOUR_SERVICE_KEY>"
