---
icon: material/creation
title: MCP Server
---

Requires Node.js 20+. Package: [`log10x-mcp`](https://www.npmjs.com/package/log10x-mcp) on npm. To add the server to your client (Claude, Cursor, VS Code, Codex, and more), use [Get Started](../../install/index.md#get-started). This page covers what comes after the add: credentials, optional log-analyzer access, multiple environments, and helping your AI pick the tools.

## :material-eye-outline: What you'll see after install

The MCP registers the tools your environment supports. With a key (or after signing in) you get the full set; with no key it boots **read-only against the public demo** so you can try it immediately. Run `log10x_doctor` to see what it resolved. Tools return structured JSON; pass `view: "markdown"` on any tool for a human-readable rendering.

## :material-key-variant: Credentials

Three ways to authenticate, in order of convenience:

1. **GitHub sign-in (recommended)**: install with no `LOG10X_API_KEY`, then ask the LLM to "sign in to Log10x". `log10x_signin` runs the GitHub Device Flow, mints a key, and saves it to `~/.log10x/credentials` (mode 0600), shared across every MCP host on the machine.
2. **Paste a key**: use one the workspace already holds (issued by a prior sign-in or an admin) and add it to the server's `env` block:

    ```json
    "env": { "LOG10X_API_KEY": "your-api-key" }
    ```

3. **Demo mode**: install with no key and skip sign-in, the MCP boots read-only against the public demo so you can try the tools without an account.

Your environments are autodiscovered from your account in all three cases, with no environment ID to configure.

## :material-key-variant: Optional log-analyzer access

Setting log analyzer credentials in the MCP host's `env` block unlocks executed-mode behavior in tools that scan or analyze your log analyzer directly, most prominently [Dependency check](tools/drop/dependency-check.md) (returns the actual list of dashboards / alerts referencing a pattern instead of ready-to-run bash) and [POC submit](tools/poc/poc-from-siem-submit.md). When omitted, the affected tools fall back to copy-paste output. All scans are read-only.

| Vendor | Env vars |
|---|---|
| Splunk | `SPLUNK_HOST` + `SPLUNK_TOKEN` (basic-auth and `~/.splunkrc` also accepted; `SPLUNK_WEB_URL` overrides the derived `:8000` web URL) |
| Datadog | `DD_API_KEY` + `DD_APP_KEY` (`DATADOG_*` aliases work; `DD_SITE` for site routing) |
| AWS / CloudWatch | Standard AWS credential chain (`AWS_PROFILE`, IAM role, etc.) |
| Elasticsearch (via Kibana) | `KIBANA_URL` + `KIBANA_API_KEY` (or `ELASTIC_API_KEY`) |

`vendor` and `destination` arguments are auto-detected when exactly one set of log analyzer creds is present. With multiple, the tool returns a structured "ambiguous" response listing the candidates.

## :material-layers: Multiple environments

No client-side multi-credential setup needed. Two patterns:

- **Same account owns multiple envs** (prod / staging / dev): the MCP autodiscovers every env your account can reach. Pass `environment: "<nickname>"` on any tool call, or just say "check staging costs" and the LLM routes there. The chosen env sticks for follow-up calls until you switch again.
- **Multiple accounts** (e.g. a consultant accessing customer envs): the backend supports per-env permission sharing (OWNER / WRITE / READ). Have the env owner grant your account READ from the console; it then shows up for you automatically. If you genuinely need parallel access from distinct API keys, register one MCP server per account in your host config with distinct server names.