sumo-mcp

Minimal MCP server that exposes a single search_logs tool for Sumo Logic.

Build

npm install
npm run build

Related MCP server: Graylog MCP Server

Configure in Claude Code

API Key

In Sumo:

• Click on your username and select Personal Access Keys

• Click Add New Access Key

• Enter a name, e.g. Claude Local

• Select Custom under scope

• Check Run Log Search under the Log Search section

• Save the key

Install

The commands below prompt for the access ID and key interactively so the secrets never appear on the command line or in shell history.

SUMO_ENDPOINT must match https://api.*.sumologic.com. Pick the host for your Sumo deployment region (US2, EU, AU, etc.).

PowerShell

$accessId = Read-Host "Sumo Access ID"
$accessKey = [System.Net.NetworkCredential]::new('', (Read-Host "Sumo Access Key" -AsSecureString)).Password

claude mcp add --scope user sumo `
  --env SUMO_ACCESS_ID=$accessId `
  --env SUMO_ACCESS_KEY=$accessKey `
  --env SUMO_ENDPOINT=https://api.us2.sumologic.com `
  -- node C:\Source\SumoMcp\dist\index.js

Remove-Variable accessId, accessKey

Bash

read -r -p "Sumo Access ID: " SUMO_ACCESS_ID
read -r -s -p "Sumo Access Key: " SUMO_ACCESS_KEY
echo

SUMO_ACCESS_ID="$SUMO_ACCESS_ID" SUMO_ACCESS_KEY="$SUMO_ACCESS_KEY" \
  claude mcp add --scope user sumo \
    --env SUMO_ACCESS_ID="$SUMO_ACCESS_ID" \
    --env SUMO_ACCESS_KEY="$SUMO_ACCESS_KEY" \
    --env SUMO_ENDPOINT=https://api.us2.sumologic.com \
    -- node /path/to/sumo-mcp/dist/index.js

unset SUMO_ACCESS_ID SUMO_ACCESS_KEY

Tool

search_logs(query, from?, to?, max_results?, timezone?)

• query — Sumo search expression

• from / to — ISO 8601 without timezone designator (2026-05-07T10:00:00), epoch milliseconds, or relative shorthand now / -<N><unit> where unit is s|m|h|d|w (e.g. -15m, -1h, -7d). Relative values are translated to epoch milliseconds before being sent to Sumo. Default -15m / now

• max_results — default 100, capped at 1000

• timezone — IANA name, default UTC (used when from/to are ISO 8601 without an explicit offset)

Returns a JSON array of messages with _messageTime, _sourceCategory, _sourceHost, _sourceName, _raw.

Hard timeout 60s — narrow the time range or query if you hit it.

Design

See docs/superpowers/specs/2026-05-07-sumo-mcp-design.md.