Loki MCP Server

The product exposes a single, primarily read-only Loki query tool and documents query parameters, destination URL, tenant header, authentication environment variables, and the stdio/SSE paths, providing reasonable evidence for limited scope, data-flow visibility, and bounded external effects. Deductions apply because callers may supply the URL, server-side access control for HTTP/SSE is not specified, and the example auto-approves loki_query rather than requesting per-call confirmation. Credential guidance is only a general warning, with no demonstrated secret storage, log redaction, or transport-security policy. Dependencies are versioned and CI runs go mod verify and govulncheck, but the scanner is installed from latest and Actions are not commit-pinned. Queries normally create no persistent state needing rollback, yet recovery behavior is not explicitly documented. Attribution is weak because the module identifies scottlepp/loki-mcp while the assessed object is named grafana/loki-mcp, with no explanation of ownership or affiliation.

The README, go.mod, and CI provide partially consistent build and test instructions, while Go module versions are fixed and downloaded and verified in CI. Major deductions follow from the README requiring Go 1.16 while go.mod and CI require Go 1.24.4; the workflow documentation describes a real-Loki integration job that is entirely commented out in ci.yml; and claims of comprehensive tests cannot be checked without the test sources. The supplied material gives almost no evidence of runtime error classification, actionable user-facing failure messages, retries, or timeout handling.

Documentation thoroughly addresses Claude Desktop, Cursor, n8n, Docker, local Loki, and multi-tenant use, with varied natural-language and command examples, earning full credit for audiences and scenarios. Tool parameters and broad boundaries are described, but no handler code confirms validation, accepted time syntax, limit bounds, or claimed natural-language mapping. Environment variables and platform configurations are useful, though the Go-version conflict, unclear SSE startup selection, and cursory HTTP authentication guidance reduce environment-fit confidence.

The README is well organized and covers architecture, installation routes, environment variables, Docker, and extensive examples. Naming is mostly stable, although lokiserver, loki-mcp-server, and the repository/module identities differ. Known limitations are not collected or meaningfully discussed. The README asserts MIT licensing, but neither the LICENSE text nor confirming license metadata is supplied, so that claim is only partial evidence. No releases, semantic-version policy, or changelog are shown. CI establishes an update path, but responsible maintainers, support channels, and repository affiliation remain unclear.

Mapping LogQL queries, time ranges, limits, tenant selection, and authentication into MCP offers clear additional value to users who already operate Loki; client, container, and prompt examples improve practical usability. Deductions apply because no actual response example or output schema is supplied, and large-result handling, pagination, truncation, performance, and resource costs are not documented. Deployment also requires a Loki endpoint, credentials, and either Go or Docker, supporting adequate rather than exceptional cost-benefit.

Some claims are traceable across go.mod and ci.yml, including the Go version, pinned module dependencies, and build, test, verification, and vulnerability-scan commands; the README also identifies intended implementation locations. Deductions apply because handlers, models, tests, and the LICENSE text are absent, preventing verification of parameter behavior, authentication precedence, output formatting, error handling, and coverage. The workflow guide presents a commented-out integration job as active, while the README states comprehensive testing and automatic natural-language understanding without separating those assertions from directly demonstrated facts.