The topology pair is what you cannot get from a per-vendor server: blast radius is a graph question, and the README is candid that these tools help graph-shaped questions and do not help pure single-metric drill-downs. The anomaly engine is backtested in CI against a 64-case labelled suite at 100% precision and 87.5% recall, so the alerts it raises are not noise — the misses are at the noise floor by design.
A gateway that sits between an agent and your observability stack. Instead of a separate server and query language per vendor, it exposes one normalized surface, computes summaries and anomaly analysis server-side, and ships a web UI on port 3000 for wiring up sources. Every tool is marked read-only.
- Discovery — `list_sources` for configured backends and their connection status, `list_services` for everything monitored across them
- `query_metrics` and `query_logs`, both returning pre-computed summary stats and top error patterns rather than raw series the agent has to reduce itself
- `get_service_health` — one score from 0 to 100 combining metrics and logs
- `detect_anomalies` — cross-signal detection on a median/MAD baseline with trend detection for slow ramps and dwell time to stop flapping
- `get_topology` for the merged infrastructure graph, and `get_blast_radius`, which pivots on the `RUNS_ON` relation to answer "if this host fails, who else fails?" for pod-to-node, vm-to-hypervisor and container-to-host
- `raw_query` as an escape hatch for hand-written PromQL or LogQL — off by default, enabled globally with `OMCP_RAW_QUERY` or per credential
- Twelve read-only tools in all, plus triage and postmortem prompts and an agent usage guide served as an MCP resource
- Log redaction on `query_logs` output before it reaches the agent, and an Inspect view that graphs which identity called which tool against which backend
No account. Node 20+, or just `npx @thotischner/observability-mcp` — it starts with zero sources and the web UI on `http://localhost:3000`. Point it at your backends with `PROMETHEUS_URL` and `LOKI_URL`, or add them through the UI, or write `~/.observability-mcp/sources.yaml` for auth-bearing sources such as Grafana Cloud. Clients connect over Streamable HTTP at `/mcp`; stdio-only clients run it with `--stdio` or `MCP_TRANSPORT=stdio`. Also published as a multi-arch image at `ghcr.io/thotischner/observability-mcp` and as a Helm chart. Apache 2.0.
One command — npx @thotischner/observability-mcp