LabscoMCP early access ↗
ThoTischnerMCP SERVER · OFFICIAL PROJECT

Observability MCP

One MCP endpoint in front of Prometheus, Loki and other backends — normalized queries, server-side aggregation, and a topology graph that answers what else falls over if this node dies.

by ThoTischner ↗Observability, Monitoring & Incident Response✓ Official

LABSCO SUMMARY

Numbers instead of haystacks, and a graph instead of a guess.

The topology pair is what you cannot get from a per-vendor server: blast radius is a graph question, and the README is candid that these tools help graph-shaped questions and do not help pure single-metric drill-downs. The anomaly engine is backtested in CI against a 64-case labelled suite at 100% precision and 87.5% recall, so the alerts it raises are not noise — the misses are at the noise floor by design.

What it is

A gateway that sits between an agent and your observability stack. Instead of a separate server and query language per vendor, it exposes one normalized surface, computes summaries and anomaly analysis server-side, and ships a web UI on port 3000 for wiring up sources. Every tool is marked read-only.

What you get

  • Discovery — list_sources for configured backends and their connection status, list_services for everything monitored across them
  • query_metrics and query_logs, both returning pre-computed summary stats and top error patterns rather than raw series the agent has to reduce itself
  • get_service_health — one score from 0 to 100 combining metrics and logs
  • detect_anomalies — cross-signal detection on a median/MAD baseline with trend detection for slow ramps and dwell time to stop flapping
  • get_topology for the merged infrastructure graph, and get_blast_radius, which pivots on the RUNS_ON relation to answer "if this host fails, who else fails?" for pod-to-node, vm-to-hypervisor and container-to-host
  • A raw_query argument on query_metrics and query_logs as an escape hatch for hand-written PromQL or LogQL — off by default, enabled globally with OMCP_RAW_QUERY or per credential
  • Every tool read-only, plus triage and postmortem prompts and an agent usage guide served as an MCP resource
  • Log redaction on query_logs output before it reaches the agent, and an Inspect view that graphs which identity called which tool against which backend

Requirements

No account. Node 20+, or just npx @thotischner/observability-mcp — it starts with zero sources and the web UI on http://localhost:3000. Point it at your backends with PROMETHEUS_URL and LOKI_URL, or add them through the UI, or write ~/.observability-mcp/sources.yaml for auth-bearing sources such as Grafana Cloud. Clients connect over Streamable HTTP at /mcp; stdio-only clients run it with --stdio or MCP_TRANSPORT=stdio. Also published as a multi-arch image at ghcr.io/thotischner/observability-mcp and as a Helm chart. Apache 2.0.

Setup effort

One command — npx @thotischner/observability-mcp

See installation options