Hosted MCP

Fluxtail hosts a remote MCP server at:

https://mcp.fluxtail.io/mcp

No local MCP server or copied API token is required. The client completes OAuth with PKCE, asks for account consent, and binds the connection to exactly one account.

Prerequisites

• A Fluxtail account you can sign in to through the browser.
• One of the supported MCP clients below, already installed and able to open a browser login.
• Permission to approve access to the account you intend to use.

Connect a client

Codex CLI

codex mcp add fluxtail --url https://mcp.fluxtail.io/mcp
codex mcp login fluxtail

Claude Code

claude mcp add --transport http fluxtail --scope user https://mcp.fluxtail.io/mcp
claude mcp login fluxtail

Gemini CLI

gemini mcp add --transport http --scope user fluxtail https://mcp.fluxtail.io/mcp

Then run /mcp auth fluxtail.

VS Code with Copilot

code --add-mcp '{"name":"fluxtail","type":"http","url":"https://mcp.fluxtail.io/mcp"}'

Open Copilot Chat and start using Fluxtail. The client opens the normal browser login and consent flow when needed.

Verify

Ask the client to run whoami, then list_streams. Confirm the returned account is the one you approved.

What the tools can do

Read tools identify the account, list streams, receivers and sources, query logs, return histograms and facets, find exceptions, summarize errors, diagnose missing logs, check receiver health, and suggest sender setup.

Source tools include list_sources, get_source, create_source, update_source, pause_source, and rescan_source. Reads require sources:read; writes require sources:write and owner/admin permission. Existing connections need fresh consent for these scopes. S3/ALB creation prepares an inactive source. Complete AWS credentials in Settings → Sources, never in an MCP request. See AWS ALB from S3.

For newer logs, pass the returned cursor as since_cursor; use cursor for older pages. Both use event time. Search historical S3 imports with explicit since_time and until_time bounds.

Operator tools can create, update, or delete streams and create, update, or retire receivers. Mutations propose first and require a short-lived confirmation token before apply.

Manage access

Open Settings → Integrations to list and revoke connections for the active account. Revocation removes that client’s access; it must authorize again before returning.

Caution

Review every proposed mutation before applying it. MCP sender guidance uses Fluxtail’s verified receiver setup and never invents endpoints or credentials.

Troubleshooting

• If login does not open, retry the client’s MCP login or authentication command in an interactive terminal.
• If whoami shows the wrong account, revoke the connection in Settings → Integrations, then authorize it again for the intended account.
• If tools disappear after revocation, reconnect before retrying; revoked access is not silently restored.
• If a mutation is not applied, confirm that you approved the current proposal with its unexpired confirmation token.

Next steps

Start with a read-only request such as listing receivers or diagnosing a missing test log. Before allowing changes, review streams and receivers so you can evaluate each proposal.

Most active client

Use get_facets with field: "client_address", top_k: 1, and explicit UTC start_time and end_time. For the last hour, set the start to 60 minutes before the current time and the end to the current time. Include your stream and other search filters. This requires analytics:read.

Fluxtail counts matching retained logs on the server and returns the address and count. It includes existing AWS ALB client addresses and skips logs without a known client address. Counts measure log events, not unique people. Empty results mean no matching clients in that period; older logs are not substituted. Do not download log pages to calculate rankings.

Traffic and error rankings

Use get_facets with one of these fields. Always set start_time and end_time for the period you want and retain your stream and search filters.

Question	Field
Most requested paths	request_path
Most requested paths, keeping sites separate	request_endpoint
Busiest request hostnames	request_host
Request methods	request_method
ALB response codes	aws_alb_elb_status_code
Target response codes	aws_alb_target_status_code
ALB error reasons	aws_alb_error_reason

For example, ask for request_path with top_k: 10 and labels: {"request_host": "shop.example.com", "aws_alb_elb_status_code": "502"} to find paths with ALB 502 responses on that site. These computed exact filters also work for log queries and histograms.

Paths exclude query strings and fragments: /products?id=1 and /products?id=2 count together. Case, encoded characters, repeated slashes and dot segments stay unchanged. Hostnames are lowercase, without scheme or port; request_endpoint combines hostname and path. Different schemes and ports on the same hostname are combined. IPv6 hostnames keep brackets.

Existing ALB logs work immediately from their parsed fields, including URLs too long for labels. Other parsers can supply explicit request_url, request_path, request_host and request_method labels. Unrecognized formats and missing values are excluded. ALB status and target status stay separate. Counts are logged requests, not unique visitors or successful page visits. Route-template grouping is not supported.

Duration and slowest paths

Use get_facets with metric: "request_duration_ms" and field: "all" for an overall summary, or field: "request_endpoint" for the slowest hostname/path combinations. Explicit start_time and end_time are required. All stream, search and label filters still apply.

Results include valid sample count, average_ms, approximate p95_ms and p99_ms, and maximum_ms. Groups sort by p95 descending. Missing, invalid and negative timings are excluded; zero is valid. Empty results mean no valid timings in that period. Percentiles from very few samples should be interpreted cautiously.

The generic metrics are request_duration_ms, upstream_duration_ms, request_processing_duration_ms and response_processing_duration_ms. Existing ALB logs support the last three through their corresponding parsed timing fields. ALB target timing measures time until the target starts responding; it is not total request duration. Fluxtail does not invent an ALB total by summing phases.

Other access-log sources

These analytics are not restricted to ALB. A parser or shipper for Nginx, Caddy or another server can emit canonical labels: client_address, request_url (or request_host and request_path), request_method, response_status, upstream_status, error_reason, and the duration fields above. Raw message text is not automatically interpreted as these fields.

Supply durations in milliseconds. For example, convert a seconds-valued Nginx request time or Caddy duration by multiplying by 1000. Preserve missing values; do not convert a missing timing to zero or silently combine multiple upstream attempts. Keep the original source fields for detail. Generic response/upstream status and error labels take precedence over the matching ALB compatibility fields.