What is graylog-mcp CLAUDE.md?

A set of instructions for working on graylog-mcp, a local MCP server that lets an AI agent query Graylog, a log-management system. It covers the project layout, running and debugging, configuration, and tests.

Understanding the source files, configuring Graylog instances, running the server, debugging it, and running its tests. It also documents the available log-query tools.

It gives the agent project-specific guidance instead of requiring it to infer how this codebase is organized and operated.

How jperelli/graylog-mcp configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to jperelli/graylog-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/jperelli/graylog-mcp/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/jperelli/graylog-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/jperelli/graylog-mcp/claude-md/github.svg)](https://agentmods.dev/instructions/jperelli/graylog-mcp/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/jperelli/graylog-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/jperelli/graylog-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/jperelli/graylog-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/jperelli/graylog-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 1,946 This file is loaded in full into every session.

When invoked 1,946 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01946	$0.01946
Opus 5.5	$0.00778	$0.00778
Sonnet 5.5	$0.00389	$0.00389
Haiku 4.5	$0.00195	$0.00195

Measured 2mo ago against content hash 6f0b6990dff0, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

graylog-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 115 lines

How it starts

The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

What this is

A minimal MCP (Model Context Protocol) server that lets an AI agent query one or more Graylog instances. Published to npm as @jperelli/graylog-mcp and run via npx. Pure ESM Node.js, no build step.

Layout

src/index.js — the entire server. Single file: instance loading, tool schemas, and handlers all live here.
package.json — bin maps graylog-mcp → src/index.js (has a #!/usr/bin/env node shebang).
README.md — user-facing setup, tool reference, and design rationale.
example-config.json — sample MCP client config.
test/ — npm test (node --test test/*.test.js). Dependency-free smoke tests, one file per tool (list_streams, search, analyze, get_message). test/helpers.js stands up a mock Graylog over node:http and launches src/index.js over stdio via the MCP client; each *.test.js file drives one tool against it. No live Graylog needed.

Run / debug

GRAYLOG_BASE_URL_INSTANCE_1=http://host:9000 \
GRAYLOG_API_TOKEN_INSTANCE_1=<token> \
node src/index.js          # speaks MCP over stdio

Set DEBUG=true for verbose logging to stderr. The transport is stdio, so anything on stdout that isn't a JSON-RPC frame breaks the protocol — log to stderr only (console.error).

Configuration model

Instances are configured via numbered env vars: GRAYLOG_BASE_URL_INSTANCE_N, GRAYLOG_API_TOKEN_INSTANCE_N, and optional GRAYLOG_LABEL_INSTANCE_N. Instance 1 also falls back to the legacy BASE_URL / API_TOKEN. Only instances with both URL and token are active; the first is the default.

Tools (all in `src/index.js`)

search — read matching log lines; concise projection by default, verbose/fields for full, absolute from/to supported. On 0 matches it self-diagnoses (see below).
analyze — top values of a field + optional time histogram; valueContains substring-matches the values.
list_fields — which fields actually exist, filtered by contains.
list_streams — readable stream IDs. Rarely needed; capped output.
get_message — fetch one full document by _id + _index.

Read the full file on GitHub · 115 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 115 lines · 1,946 tokens per session scan A 6f0b6990dff0

Subscribe to this mod's changes

graylog-mcp CLAUDE.md is an instructions file published in the GitHub repository jperelli/graylog-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 1,946 tokens to every session, about $0.0078 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

LLM agent graylog mcp mcp-server

graylog-mcp CLAUDE.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
graylog-mcp CLAUDE.mdjperelli/graylog-mcp	Instructions file	2	3mo ago	MIT	A	1,946	Claude Code
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

graylog-mcp: Instructions file for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

CLAUDE.md

What this is

Layout

Run / debug

Configuration model

Tools (all in `src/index.js`)

What this file has done since we first saw it

graylog-mcp CLAUDE.md compared with instructions from other repositories

graylog-mcp: Instructions file for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

CLAUDE.md

What this is

Layout

Run / debug

Configuration model

Tools (all in src/index.js)

What this file has done since we first saw it

graylog-mcp CLAUDE.md compared with instructions from other repositories

Tools (all in `src/index.js`)