LabscoMCP early access ↗
tillkolterMCP SERVER

Guck MCP

A telemetry store built for agents debugging — filter-first log queries with output caps, so an investigation does not flood the context window.

by tillkolter ↗Observability, Monitoring & Incident ResponseCommunity

LABSCO SUMMARY

The output cap is the design, not a limitation.

Refusing to return a payload that would blow past the character limit — and returning the message-length statistics instead so you know how to narrow — is the opposite of how most log tools behave, and it is right for this consumer. So is the documented order: stats first with a tight window, then search, and tail only if live streaming is genuinely needed. Redaction runs on both write and read against configured key names and regexes, which matters when the thing reading your logs is a model. Session and trace ids are kept separate on purpose, since startup, cron and background events belong to a run but to no request.

What it is

A small JSONL telemetry store with an MCP interface. Any runtime can emit events into it — through the SDKs, or by wrapping a command's stdout and stderr — and the MCP tools are deliberately query-shaped rather than tail-shaped, because the failure mode being designed against is a model drowning in logs.

What you get

  • guck.stats — the narrow-window overview you start with, before looking at any individual event
  • guck.search — boolean search over the message with AND, OR, NOT, parentheses and quoted phrases, plus contains for substring matching across message, type, session and data
  • guck.search_batch — several named searches in one request, each with its own filters and limits
  • guck.sessions for run-scope correlation, and guck.tail which exists but is deliberately not the documented default
  • Output shaping that keeps responses small: fields to project only the columns you need including dotted paths, flatten to lift them to top level, template for one formatted line per event, and max_message_chars to trim long messages
  • A hard output cap — responses over mcp.max_output_chars return a warning with average and maximum message lengths instead of the payload, unless force is set
  • Capture without code changes through guck wrap, plus JS, browser and Python SDKs and a Vite dev plugin
  • guck checkpoint, which writes a timestamp that later queries use as their default time window

Requirements

No account and no key — everything is local. Install the CLI with npm install -g @guckdev/cli or pnpm add -g @guckdev/cli, then register guck mcp as the server command. Configuration comes from a .guck.json at the repo root, with .guck.local.json merged over it for per-developer overrides; GUCK_CONFIG_PATH points at a specific file, and each MCP tool also accepts a config_path for multi-repo use. GUCK_DIR overrides the store root, which defaults to ~/.guck/logs — pointing several services at one absolute directory is how you get cross-service tracing. GUCK_SESSION_ID correlates a run. Python and browser SDKs are separate installs. MIT licensed.

Setup effort

One command — npm install -g @guckdev/cli

See installation options