The pairing is what makes it work for people who do not write Seq filters daily: describe what you are looking for, get a correct filter expression back, and run it with proper date bounds and paging rather than eyeballing the web UI.
A stdio server in front of Seq's own API. It takes Seq filter expressions and returns matching events, with the paging and date handling that keep large queries usable. It never logs to the console, so it does not interfere with the protocol, and can optionally log its own operations back into Seq.
- `SeqSearch` — events matching a filter, ordered least to most recent. `count` defaults to 100 and caps at 1000; `fromDateUtc` and `toDateUtc` take ISO 8601 timestamps; `afterId` pages past the last event you saw; `signalId` narrows to a signal, and `timeoutSeconds` accepts 1 to 300
- `SeqWaitForEvents` — captures live events over a 5-second window, up to 100, and returns the snapshot even when it is empty
- `SignalList` — the signals available, read-only, which is where `signalId` values come from
- `SeqConvertFilter` — turns fuzzy text such as "error" or "timeout" into a strict Seq filter expression you can then pass to `SeqSearch`
A Seq server and a valid API key: `SEQ_SERVER_URL` and `SEQ_API_KEY`, with `SEQ_API_KEY_<WORKSPACE>` available for workspace-specific keys. The .NET 10.0 runtime, or install it as a global tool with `dotnet tool install -g SeqMcpServer` and point the client at `seq-mcp-server`; single-file builds for win-x64, osx-x64 and linux-x64 are also documented. For date filtering use the `fromDateUtc` and `toDateUtc` parameters rather than putting `@Timestamp` in the filter — it performs better. Older Seq builds such as 2024.3.x do not expose the `Scan` link that the fast path uses; the server falls back automatically rather than failing.
One command plus a key — dotnet tool install -g SeqMcpServer, then supply credentials