Azure Log Analytics MCP Server

What is Azure Log Analytics MCP Server?

An MCP (Model Context Protocol) server that lets large language models convert natural language queries into KQL (Kusto Query Language) and execute them against Azure Log Analytics workspaces.

How to use Azure Log Analytics MCP Server?

Install Node.js 18+, clone the repo, install dependencies, build, and set ANTHROPIC_API_KEY and Azure CLI credentials. Run node build/index.js for CLI mode or node build/mcp-server.js for MCP server mode. Then configure MCP settings to add the azure-log-analytics server and use the query_logs tool.

Key features of Azure Log Analytics MCP Server

• Converts natural language to KQL using Claude AI
• Executes KQL queries against Azure Log Analytics
• Formats results for easy consumption by LLMs
• Supports both CLI and MCP server modes
• Provides optional time range and result limit parameters

Use cases of Azure Log Analytics MCP Server

• Query Azure trace logs using plain English instead of KQL
• Diagnose errors or service issues via natural language conversation
• Generate quick reports from Application Insights data with minimal syntax

FAQ from Azure Log Analytics MCP Server

What dependencies does it require?

Node.js 18.x or higher, an Azure subscription with a Log Analytics workspace, an Anthropic API key, and Azure CLI configured with appropriate credentials.

How do I configure Azure credentials?

Azure credentials are obtained through the Azure CLI. You must run az login before using the server, and set the subscription ID, resource group, and Application Insights resource name in the azure-service.ts file.

What transport or authentication does it use?

The server uses standard MCP transport (command/args via JSON config) and authenticates to Azure via Azure CLI credentials.

What is the main tool it provides?

The server exposes one tool: query_logs, which accepts a natural language query (required), an optional timeRange (e.g., "last 24 hours"), and an optional limit (max results).