observability-mcp

npx @thotischner/observability-mcp # start (UI on :3000) claude mcp add observability --transport http http://localhost:3000/mcp # wire into Claude

🔌Open in MCP Inspector— one-line interactive explorer:

npx --yes @modelcontextprotocol/inspector \ --config <(npx --yes @thotischner/observability-mcp inspector-config)

On a real Kubernetes-platform-team question ("which other pods share a node withpayment-serviceso we know what else falls over if that node goes down?"), the same local model produces wildly different answers depending on the tools you hand it:

We don't claim universal speedup — the doc spells out exactly where the topology tools help (graph-shaped questions) and where they don't (pure single-metric drill-downs).

npx @thotischner/observability-mcp # then open http://localhost:3000

Wire it into Claude Code with one CLI call:

claude mcp add observability --transport http http://localhost:3000/mcp

…or commit it to your repo as.mcp.json(works the same in Claude Desktop / Cursor):

{ "mcpServers": { "observability": { "transport": { "type": "http", "url": "http://localhost:3000/mcp" } } } }

The server starts withzero sources. Add Prometheus/Loki via the Web UI orPROMETHEUS_URL/LOKI_URLenv vars.

If you'd rather have the snippets above printed by a Make target — including custom-host / custom-port substitution — usemake connect-claude-codeormake connect-cursor.make doctorround-trips a real MCP handshake against a running server, reports the live governance posture (auth mode, redaction, audit-log persistence, per-identity rate cap), and tells you what to fix if it can't.

Want the full chaos-engineering demo (Prometheus + Loki + 3 example services + the autonomous agent)? Clone and run:

make demo # equivalent to: docker compose --profile demo up --build --wait

Or run thesovereign quickstart— one command, fully on-prem, zero external calls: it starts the stack, injects a real incident, and shows side by side what an agent getswithoutvswiththe analysis layer (a wall of raw numbers vs a scored verdict that pinpoints the culprit). The optional agent reasons over it with alocalmodel (Ollama):

Seemake helpfor all canonical workflows.

Every observability vendor ships its own MCP server — Prometheus, Grafana, Datadog, Elastic, each siloed. An AI agent triaging an incident across systems must juggle N separate servers and learn each query language (PromQL, LogQL, …). There is no unified abstraction layer.

observability-mcpis that layer: one MCP endpoint that normalizes every backend and answers in plain service/metric/log terms, plus an analysis engine that flags anomalies the agent would otherwise have to reconstruct from raw queries itself.

Who it's for:SRE / platform teams running Prometheus + Loki who use an AI agent (Claude, local LLMs, …) for incident triage. The gateway's leverage is largest when the agent isnota frontier model — a smaller or local model that can't reliably hand-write PromQL/LogQL benefits most from normalized tools and pre-computed analysis. A strong frontier model can query raw backends competently on its own; there the value is consistency and the analysis engine, not query convenience. We state this honestly rather than claiming a universal speedup.