RELATED 01
SonarQube MCP Server
OFFICIAL SERVERSonarQube Cloud or Server findings, quality gates and code analysis inside your coding assistant
680GitHub stars
712kDocker pulls
80popularity score
Sumo Logic MCP Server
Hosted Sumo Logic endpoint for log search, alerts, dashboards and Cloud SIEM insights and rules
Official · sumologic.com Remote (hosted) · Streamable HTTP DevOps and monitoringSecurity
Connect your client
Remote (hosted)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add --transport http sumo-logic https://mcp.sumologic.com/mcpClaude (desktop and web)Settings → Connectors → Add custom connector
https://mcp.sumologic.com/mcpChatGPTSettings → Apps → Advanced → Developer mode, then Create app
https://mcp.sumologic.com/mcpCursor~/.cursor/mcp.json
{
"mcpServers": {
"sumo-logic": {
"url": "https://mcp.sumologic.com/mcp"
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"sumo-logic": {
"type": "http",
"url": "https://mcp.sumologic.com/mcp"
}
}
}Codex~/.codex/config.toml
[mcp_servers.sumo-logic]
url = "https://mcp.sumologic.com/mcp"Gemini CLITerminal
gemini mcp add --scope user --transport http sumo-logic https://mcp.sumologic.com/mcpWhat it does
Sumo Logic runs this MCP server itself, one endpoint per deployment region (for example https://mcp.sumologic.com/mcp for US East and https://mcp.us2.sumologic.com/mcp for US West). There is nothing to install: an MCP client connects over HTTP and signs in to a Sumo Logic organization with OAuth 2.0.
Its 20 tools cover six areas: running log searches over a time range, listing custom fields, field extraction rules and partitions to narrow those searches, searching and reading alerts, reading, creating and updating dashboards, and working with Cloud SIEM, where it can read, assign and change the status of insights and read or create match and threshold detection rules. A utility tool, x_amz_bedrock_agentcore_search, filters the tool list by context.
Which tools a client sees depends on the scopes in its OAuth token, which follow the user's Sumo Logic role: a role without View Cloud SIEM Enterprise (viewCse) gets no Cloud SIEM tools. Filtering is by role, not by licence, so Cloud SIEM tools can appear for an organization that has not bought Cloud SIEM and then fail when called.
The docs page also adds things a quick look misses: a log search call times out after 2 minutes, and a query spanning more than 30 minutes is rejected unless it filters by _sourceCategory, _collector, _index or _view. Sumo Logic offers an optional sumo-investigator skill file for Claude Code that guides the order of tool calls.
What it needs
A Sumo Logic account in a supported deployment (every commercial one except Zurich and AWS European Sovereign Cloud), and the endpoint URL for that deployment, since tokens work only against one deployment. MCP Server access must be on in Feature Management (on by default). The recommended CIMD sign-in is off by default and an administrator must enable it under Policies; clients without CIMD need an administrator to create an OAuth client (client ID and secret). The MCP client must support HTTP transport and OAuth 2.0.
Limits
Rate limits: 4 requests per second per user and 10 concurrent requests per access key, shared with all other API use; over the limit it returns HTTP 429. A log search call stops after 2 minutes. Queries over 30 minutes with no _sourceCategory, _collector, _index or _view filter are rejected. It is not meant for bulk data extraction, model training or high-volume automated queries (use the Search Job API) and Sumo Logic warns agent loops and retries can raise costs, notably search scan costs on Flex pricing. Alerts are read-only; there are no tools for monitors, collectors or metrics queries. Recent VS Code releases do not work with explicit client credentials; the docs say to use CIMD there.
Who it suits
Suits Sumo Logic customers, especially security teams on Cloud SIEM, who want an assistant to search logs, triage insights and alerts, and draft detection rules or dashboards without running anything locally. Because it is hosted and signs in through the user's own role, access matches what that person can already do in Sumo Logic. It is a poor fit for bulk exports or automated high-volume jobs, which the vendor sends to its Search Job API, and for organizations in Zurich or the AWS European Sovereign Cloud, where it is not offered. Teams that need tools for monitors or metrics will not find them here.
Tools 20
x_amz_bedrock_agentcore_search- Filters the available tools by the context of the request
alertsReadById- Fetches one alert or alert folder by its ID
alertsSearch- Finds alerts by status, severity, monitor name, mute state and other filters
createDashboard- Makes a new dashboard
getDashboard- Fetches one dashboard by its ID
listDashboards- Lists every dashboard
updateDashboard- Changes an existing dashboard by its ID
getAllInsights- Pages through all Cloud SIEM insights with a token
getInsight- Fetches one insight with its signals, artifacts and entities
getInsights- Finds insights by severity, status, assignee, entity, confidence, tags and more
updateInsightAssignee- Changes who an insight is assigned to
updateInsightStatus- Changes the status of an insight
createTemplatedMatchRule- Adds a Cloud SIEM match rule
createThresholdRule- Adds a Cloud SIEM threshold rule
getRule- Fetches one detection rule, optionally with its tuning expressions
getRules- Finds detection rules by category, enabled state, source, score, severity, tags and more
runLogSearch- Runs a log query over a time range and returns aggregates or raw messages
listCustomFields- Lists the custom fields set up in the account
listExtractionRules- Lists field extraction rules
listPartitions- Lists partitions, filterable by analytics tier and active state