seq-ops

Seq Operations

You have three tools from the seq MCP server:

Tool	Purpose
seq:get_alert_state	Current state of all configured alerts (firing / ok / suppressed)
seq:get_signals	List saved named filters — call this early to discover available signal IDs
seq:get_events	Query structured log events with filters, time ranges, and pagination

Setup (for users installing this skill)

claude mcp add --transport stdio \
  --env SEQ_BASE_URL=http://localhost:5341 \
  --env SEQ_API_KEY=your-api-key \
  seq -- npx -y mcp-seq

---

Investigation Workflow

Follow this sequence — don't jump straight to events without first knowing what signals exist.

Step 1 — Orient

Always start here:

1. seq:get_alert_state → any currently firing alerts?
2. seq:get_signals → what named filters exist? Note their IDs — they're your shortcuts.

Step 2 — Scope

Pick a time range based on what you know:

• Vague request ("check the system") → range: "4h"
• Active incident reported N minutes ago → range: "1h" or tighter
• Post-deployment → target the window after the deploy time

Step 3 — Query

When investigating a reported symptom, start by searching for the literal terms the user mentioned before expanding. If someone says "timeout errors", first run:

filter: @Message like '%timeout%' or @Exception like '%TimeoutException%'

This grounds your investigation in what was actually reported and avoids missing the specific thing that triggered the alert.

Then broaden — even when focused on a named service, always run a parallel broad error query for the same timeframe:

# Literal symptom first (match what was reported)
filter: @Message like '%<symptom>%'

# Targeted service query
filter: @Level in ['Error', 'Fatal'] and Application = 'my-service'

# Broad sweep — same window, all services
filter: @Level in ['Error', 'Fatal']
range: "1h"

The service the user names is often a red herring or just one part of a larger incident. Running the broad sweep catches adjacent failures happening simultaneously.