Install

Requires Node.js 20+. Package: log10x-mcp on npm. To add the server to your client (Claude, Cursor, VS Code, Codex, and more), use Get Started. This page covers what comes after the add: credentials, optional log-analyzer access, multiple environments, and helping your AI pick the tools.

What you'll see after install

The MCP registers the tools your environment supports. With a key (or after signing in) you get the full set; with no key it boots read-only against the public demo so you can try it immediately. Run log10x_doctor to see what it resolved. Tools return structured JSON; pass view: "markdown" on any tool for a human-readable rendering.

Credentials

Three ways to authenticate, in order of convenience:

GitHub sign-in (recommended): install with no LOG10X_API_KEY, then ask the LLM to "sign in to Log10x". log10x_signin runs the GitHub Device Flow, mints a key, and saves it to ~/.log10x/credentials (mode 0600), shared across every MCP host on the machine.
Paste a key: use one the workspace already holds (issued by a prior sign-in or an admin) and add it to the server's env block:
```
"env": { "LOG10X_API_KEY": "your-api-key" }
```
Demo mode: install with no key and skip sign-in, the MCP boots read-only against the public demo so you can try the tools without an account.

Your environments are autodiscovered from your account in all three cases, with no environment ID to configure.

Optional log-analyzer access

Setting log analyzer credentials in the MCP host's env block unlocks executed-mode behavior in tools that scan or analyze your log analyzer directly, most prominently Dependency check (returns the actual list of dashboards / alerts referencing a pattern instead of ready-to-run bash) and POC submit. When omitted, the affected tools fall back to copy-paste output. All scans are read-only.

Vendor	Env vars
Splunk	`SPLUNK_HOST` + `SPLUNK_TOKEN` (basic-auth and `~/.splunkrc` also accepted; `SPLUNK_WEB_URL` overrides the derived `:8000` web URL)
Datadog	`DD_API_KEY` + `DD_APP_KEY` (`DATADOG_*` aliases work; `DD_SITE` for site routing)
AWS / CloudWatch	Standard AWS credential chain (`AWS_PROFILE`, IAM role, etc.)
Elasticsearch (via Kibana)	`KIBANA_URL` + `KIBANA_API_KEY` (or `ELASTIC_API_KEY`)

vendor and destination arguments are auto-detected when exactly one set of log analyzer creds is present. With multiple, the tool returns a structured "ambiguous" response listing the candidates.

Multiple environments

No client-side multi-credential setup needed. Two patterns:

Same account owns multiple envs (prod / staging / dev): the MCP autodiscovers every env your account can reach. Pass environment: "<nickname>" on any tool call, or just say "check staging costs" and the LLM routes there. The chosen env sticks for follow-up calls until you switch again.
Multiple accounts (e.g. a consultant accessing customer envs): the backend supports per-env permission sharing (OWNER / WRITE / READ). Have the env owner grant your account READ from the console; it then shows up for you automatically. If you genuinely need parallel access from distinct API keys, register one MCP server per account in your host config with distinct server names.

Next: Test