Summary

The output cap is the design, not a limitation.

Refusing to return a payload that would blow past the character limit — and returning the message-length statistics instead so you know how to narrow — is the opposite of how most log tools behave, and it is right for this consumer. So is the documented order: stats first with a tight window, then search, and tail only if live streaming is genuinely needed. Redaction runs on both write and read against configured key names and regexes, which matters when the thing reading your logs is a model. Session and trace ids are kept separate on purpose, since startup, cron and background events belong to a run but to no request.

What it is

A small JSONL telemetry store with an MCP interface. Any runtime can emit events into it — through the SDKs, or by wrapping a command's stdout and stderr — and the MCP tools are deliberately query-shaped rather than tail-shaped, because the failure mode being designed against is a model drowning in logs.

What you get

`guck.stats` — the narrow-window overview you start with, before looking at any individual event
`guck.search` — boolean search over the message with `AND`, `OR`, `NOT`, parentheses and quoted phrases, plus `contains` for substring matching across message, type, session and data
`guck.search_batch` — several named searches in one request, each with its own filters and limits
`guck.sessions` for run-scope correlation, and `guck.tail` which exists but is deliberately not the documented default
Output shaping that keeps responses small: `fields` to project only the columns you need including dotted paths, `flatten` to lift them to top level, `template` for one formatted line per event, and `max_message_chars` to trim long messages
A hard output cap — responses over `mcp.max_output_chars` return a warning with average and maximum message lengths instead of the payload, unless `force` is set
Capture without code changes through `guck wrap`, plus JS, browser and Python SDKs and a Vite dev plugin
`guck checkpoint`, which writes a timestamp that later queries use as their default time window

Requirements

No account and no key — everything is local. Install the CLI with `npm install -g @guckdev/cli` or `pnpm add -g @guckdev/cli`, then register `guck mcp` as the server command. Configuration comes from a `.guck.json` at the repo root, with `.guck.local.json` merged over it for per-developer overrides; `GUCK_CONFIG_PATH` points at a specific file, and each MCP tool also accepts a `config_path` for multi-repo use. `GUCK_DIR` overrides the store root, which defaults to `~/.guck/logs` — pointing several services at one absolute directory is how you get cross-service tracing. `GUCK_SESSION_ID` correlates a run. Python and browser SDKs are separate installs. MIT licensed.

Setup effort

One command — npm install -g @guckdev/cli