correlate_request
Reconstruct a distributed trace by collecting all log events matching a trace/request ID across multiple NDJSON files, sorted chronologically.
LABSCO SUMMARY
A 2GB log, reduced to the slice that explains the incident.
The agent never sees the whole file — it asks for a window, a pattern or a trace ID, and the server streams past everything else. That is the difference between 'the log is too big to read' and an answer about what happened in the minute the errors spiked.
What it is
A streaming NDJSON log reader: it filters by field, buckets errors by time window to find spikes, summarises severity over time, and reassembles a single request's events across files.
What you get
- Field and value filtering that returns the top N matches, streaming the file line by line
- Error spikes found by Z-score against the file's own mean and standard deviation
- A severity timeline per time window, with an adaptive mode that zooms into the peak at 10x finer resolution
- One trace or request ID reconstructed across multiple NDJSON files
- The log's own schema discovered, so you know which fields exist before filtering on one
- Multiline stack traces reassembled by passing a line-start pattern
Requirements
A local NDJSON log file and Node. Published on npm as ndjson-local-log-triage-mcp.
Setup effort
One command — npx -y ndjson-local-log-triage-mcp
USE CASES
01
Finding when an incident actually started
The timeline shows where errors cluster; the Z-score check names the windows that are genuinely anomalous rather than merely busy.
02
Pulling every line for one failing request
Give it the trace or request ID and it collects the events from every file they landed in.
03
Narrowing to one service's errors
Filter by field and value and take the top matches, without the file ever being read into memory.
04
Working with an unfamiliar log format
Discover the schema first so the filters you write match fields that exist.
05
Reading a stack trace that spans many lines
Pass a line-start pattern and the multiline entries come back whole instead of being dropped by the parser.
4 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
detect_error_anomalies
Z-score frequency analysis to find sudden error spikes by time window.
query_log_pattern
Filter NDJSON log file by field/value pattern, return top N matching entries.
summarize_log_timeline
Chronological severity aggregation — errors, warnings, and info counts per time window.
BEFORE YOU INSTALL
What to know first
Tools you get
4 tools when we connected.
Requires
npx on PATH
CONTEXT COST
Light Standing cost
Rated by the size of the 4 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"ndjson-local-log-triage-mcp": {
"command": "npx",
"args": [
"-y",
"ndjson-local-log-triage-mcp"
]
}
}
}npx
TERMINAL
npx -y ndjson-local-log-triage-mcp
