query

A command for searching and analyzing Logfire telemetry, which is recorded information about an application's traces, logs, and measurements. It can work interactively or help add Logfire queries to code.

In plain words
What is it for?
Use it to search traces, inspect logs and metrics, investigate errors, write SQL queries, calculate results, or add query code to an application.
Why use it?
It helps investigate application behavior without manually sorting through telemetry. It also clarifies whether a request needs query analysis or simply opening the Logfire interface.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/pydantic/skills/query
Clone the repo
git clone --depth 1 https://github.com/pydantic/skills
Per session 15 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,222 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00015 $0.01222
Opus 5 $0.00008 $0.00611
Sonnet 5 $0.00003 $0.00244
Haiku 4.5 $0.00002 $0.00122

Measured 2d ago against content hash 6d82aaae1b9d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

query scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/logfire/commands/query.md · 115 lines

How it starts

The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/query

Help users query traces, logs, and metrics from Logfire. Supports two approaches: interactive querying via the MCP server, or adding programmatic query capabilities to code.

Prerequisites

One of the following:

  • MCP: Logfire MCP server connected (this plugin configures it automatically). User must have run logfire auth or set LOGFIRE_TOKEN.
  • REST API: A Logfire read token (created via the Logfire UI or logfire read-tokens create).

Workflow

Route the request first

Use /query only when the user wants data fetched and analyzed, a SQL query, a computed answer, or programmatic query code.

Do not use /query for direct UI/browser/link requests such as "open in Logfire", "show in Codex", "open Explore", "live view", or "give me a link". Route those to logfire-ui.

For ambiguous prompts such as "show recent errors", "view logs", or "show spans", ask whether the user wants a Logfire UI view or query analysis in chat. Do not do both unless the user explicitly asks for both.

Determine the approach

Ask the user what they need:

  1. Explore data interactively — they want to search traces, investigate issues, or understand their telemetry. Use MCP.
  2. Add querying to code — they want their application to query Logfire programmatically. Use the REST API / Python client.

If unclear, default to interactive (MCP) since it requires no extra setup.


Interactive querying (MCP)

  1. Understand what the user is looking for. Ask clarifying questions if needed: time range, service name, error type, endpoint, trace ID, etc.

  2. Formulate the SQL query. Use Apache DataFusion SQL (Postgres-like). Always follow these rules:

    • Always include LIMIT (start with 20, increase if needed)
    • Filter by start_timestamp for time ranges: start_timestamp > now() - interval '1 hour'
    • Filter by service_name, span_name, or trace_id when possible for efficiency
    • Use min_timestamp / max_timestamp params instead of SQL WHERE for time filtering when the window is simple
    • Access JSON attributes with ->>'key' operator

Read the full file on GitHub · 115 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 115 lines · 15 tokens per session scan A 6d82aaae1b9d

Subscribe to this mod's changes

query is a command published in the GitHub repository pydantic/skills (127 stars, last pushed 2d ago), licensed MIT. It adds 15 tokens to every session and 1,222 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.