list_groupsLABSCO SUMMARY
Log triage without the console.
The two tools cover the loop that matters during an incident: find the group, then pull the window around the failure with a filter applied - written as 1h rather than as a pair of timestamps.
What it is
An MCP server over AWS CloudWatch Logs with two tools: list the log groups in an account, and read events out of one. Reads take a stream name, a filter pattern and a time window expressed either as an ISO timestamp or as a relative string like 5m, 1h or 1d.
What you get
- Log groups listed, narrowed by name prefix, with creation time and stored size
- Log events from a group, filtered by pattern and bounded by a time window
- Relative time windows - 5m, 1h, 1d - instead of computed timestamps
- Credentials and region passed per call, when the default identity is not the one you need
Requirements
AWS credentials the server can find - either in the environment, or a profile configured through the AWS CLI - and read permission on the log groups you care about. Both tools also accept credentials and a region as arguments, which is how you reach a second account without restarting the server.
Setup effort
Build from source
USE CASES
01
Finding out what a function did at 3am
Give the group and a window; the events come back with timestamps and stream names.
02
Locating the right log group in a crowded account
Filter the group list by prefix instead of scrolling the console.
03
Chasing an error string across a time window
The filter pattern narrows the read before the events reach the conversation.
04
Checking a deploy went cleanly
Read the last few minutes of the group and see whether anything changed.
05
Reading logs from a second AWS account
Pass that account's credentials and region on the call rather than reconfiguring the server.
2 tools
Listed in project docs. Your client may show a different list.
get_logsBEFORE YOU INSTALL
What to know first
Tools you get
2 tools named in the project's documentation.
Requires
- uv on PATH
- AWS_ACCESS_KEY_ID in your environment
- AWS_SECRET_ACCESS_KEY in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
TERMINAL
git clone https://github.com/serkanh/cloudwatch-logs-mcpMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"cloudwatch-logs": {
"command": "uv",
"args": [
"run",
"<YOUR_PATH_TO_CLOUDWATCH_LOGS_MCP>/main.py"
],
"env": {
"AWS_ACCESS_KEY_ID": "<YOUR_ACCESS_KEY_ID>",
"AWS_SECRET_ACCESS_KEY": "<YOUR_SECRET_ACCESS_KEY>"
},
"disabled": false,
"autoApprove": []
}
}
}
