Last9 MCP Server

{
  "mcp": {
    "servers": {
      "last9": {
        "type": "stdio",
        "command": "/opt/homebrew/bin/last9-mcp",
        "env": {
          "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
        }
      }
    }
  }
}

For NPM: use "command": "npx" and add "args": ["-y", "@last9/mcp-server@latest"].

After downloading from GitHub Releases, extract and point to the full path:

{
  "mcpServers": {
    "last9": {
      "command": "C:\\Users\\<user>\\AppData\\Local\\Programs\\last9-mcp-server.exe",
      "env": {
        "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
      }
    }
  }
}

The NPM route is easier on Windows — no path management.

export LAST9_REFRESH_TOKEN="your_refresh_token"
export LAST9_HTTP=true
export LAST9_PORT=8080
./last9-mcp-server

Server starts at http://localhost:8080/mcp.

The Streamable HTTP handler runs in stateless mode, so any request is served independently. An initialize handshake and an Mcp-Session-Id header are optional — clients that send them still work (the header is accepted and ignored), and clients can also skip straight to tools/list / tools/call. Every tool is an independent request/response query; the server issues no server→client notifications, so GET /mcp (the SSE stream) returns 405.

# List tools — a session handshake is optional in stateless mode
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}'

# Call a tool
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{
      "jsonrpc": "2.0",
      "id": 2,
      "method": "tools/call",
      "params": {
        "name": "get_service_logs",
        "arguments": {
          "service_name": "your-service-name",
          "lookback_minutes": 30,
          "limit": 10
        }
      }
    }'

git clone https://github.com/last9/last9-mcp-server.git
cd last9-mcp-server
go build -o last9-mcp-server
LAST9_HTTP=true ./last9-mcp-server

LAST9_HTTP=true is for local development. For actual usage, the hosted HTTP endpoint is easier.

• Absolute times (start_time_iso/end_time_iso, or time_iso) take precedence over lookback_minutes.
• For relative windows: use lookback_minutes.
• For absolute windows: use RFC3339/ISO8601 — 2026-02-09T15:04:05Z.
• Legacy YYYY-MM-DD HH:MM:SS is accepted for compatibility only.

• limit (integer, optional): Max exceptions. Default: 20.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional): Absolute time range.
• service_name (string, optional): Filter by service.
• span_name (string, optional): Filter by span name.
• env (string, optional): Filter by environment.

• start_time_iso / end_time_iso (string, optional)
• env (string, optional): PromQL regex. Defaults to .*. Exact match needs anchors (e.g. ^prod$).
• sort_by (string, optional): request_count (default), throughput_rpm, http_4xx_count, http_5xx_count, or grpc_error_count.
• limit (integer, optional): Max ranked rows. Omit or 0 means 10; values above 100 clamp to 100.

• start_time_iso / end_time_iso (string, optional)

All other APM tools require an env value. Use "" if this returns empty.

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• service_name (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• service_name (string, optional): Omit for fleet scope; provide for one service and its operation correlations.
• lookback_minutes (integer, optional): Current window. Default: 60.
• start_time_iso / end_time_iso (string, optional): Explicit current window.
• baseline_start_time_iso / baseline_end_time_iso (string, optional): Explicit baseline. Defaults to the immediately preceding equal-duration window.
• datasource (string, optional): Restrict the comparison to one datasource.
• env (string, optional): Defaults to prod.
• max_services / max_operations (integer, optional): Default 10, max 10 each.

• env (string, optional): Filter by environment. Accepts a regular expression. Default: all.
• lookback_minutes (integer, optional): Default: 60. Window may not exceed 7 days.
• start_time_iso / end_time_iso (string, optional)

• db_system (string, optional): e.g. postgresql, mysql, mongodb, redis.
• host (string, optional): Database host (net_peer_name).
• service_name (string, optional): Calling service name.
• env (string, optional)
• min_duration_ms (float, optional): Minimum query duration in ms.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

• db_system (string, optional)
• host (string, optional)
• service_name (string, optional)
• env (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

• db_system (string, required): e.g. postgresql, mysql, mongodb, redis, aerospike.
• host (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)

• query (string, required): The PromQL query.
• start_time_iso / end_time_iso (string, optional): Defaults to last 60 min.
• lookback_minutes (float, optional): Default: 60.

• query (string, required)
• time_iso (string, optional): Defaults to now.
• lookback_minutes (float, optional)

• match_query (string, optional): PromQL filter.
• label (string, required): Label name.
• start_time_iso / end_time_iso (string, optional)

• match_query (string, optional): PromQL filter.
• start_time_iso / end_time_iso (string, optional)

• logjson_query (array, required): JSON pipeline query.
• lookback_minutes (integer, optional): Default: 5.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Server default: 5000.
• index (string, optional): physical_index:<name> or rehydration_index:<block_name>.

For log-based service inventory, query physical_index_service_count first:

sum by (name, service_name, env) (physical_index_service_count{destination="logs"})

Use service_name as ServiceName, env as the environment when present, and name as the physical index name. If name="default", omit index; for a non-default physical index selected by the user, pass index: "physical_index:<name>". If the backend rejects explicit physical index filtering, retry without index and report that explicit physical index filtering is unavailable for that backend.

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 20.
• env (string, optional)
• severity_filters (array, optional): e.g. ["error", "warn"]. OR logic.
• body_filters (array, optional): e.g. ["timeout", "failed"]. OR logic.
• start_time_iso / end_time_iso (string, optional)
• index (string, optional)

Multiple filter types combine with AND. Each array uses OR internally. Use get_logs for broad aggregate counts first; use get_service_logs only after narrowing to a service/env/index and a small sample set.

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)
• index (string, optional)

• pipeline (array, required): Prior filter stages to scope discovery, e.g. [{"type":"filter","query":{"$eq":["ServiceName","<service>"]}}].
• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)
• index (string, optional)

No parameters. Lists drop rules via GET /otel_settings/drop?region=....

• name (string, required)
• filters (array, required): Each filter: key, value, operator (equals/not_equals), conjunction (and).
• Filter keys must use attributes["key_name"] or resource.attributes["key_name"] (required by the Last9 API).
• Creates the rule via POST /otel_settings/drop?region=...&cluster_id=....

Use for broad searches and aggregations. For exact trace ID lookup, use get_service_traces.

• tracejson_query (array, required)
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 5000.

Exactly one of trace_id or service_name is required.

• trace_id (string, optional): Default lookback: 72 hours.
• service_name (string, optional): Default lookback: 60 min.
• lookback_minutes (integer, optional)
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 10.
• env (string, optional)

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)

• pipeline (array, required): Prior filter stages to scope discovery, e.g. [{"type":"filter","query":{"$eq":["ServiceName","<service>"]}}].
• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)

• tag_name (string, required): Attribute name from get_trace_attributes (e.g. resource_department or attributes['http.method']).
• pipeline (array, optional): Prior filter stages to scope the values; omit for global values.
• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional): Historical RFC3339 bounds; take precedence over lookback_minutes.
• region (string, optional)

• comparison_mode (string, required): latency, errors, or time.
• service_name (string, required)
• environment (string, required): Exact deployment.environment value.
• operation (string, optional)
• filters (array, optional): Trace JSON filter conditions.
• candidate_attributes (array, optional): Maximum 8; omit for bounded discovery.
• latency_threshold_ms (number, optional): Required for latency mode; rejected for other modes.
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 15. Maximum: 15.
• baseline_start_time_iso / baseline_end_time_iso (string, optional): Required for time mode; non-overlapping and equal in duration to the target window.
• minimum_cohort_size (integer, optional): Default: 100. Minimum: 20.
• minimum_value_support (integer, optional): Default: 20. Minimum: 10.
• limit (integer, optional): Default: 10. Maximum: 10.

Requires the companion backend capability to be enabled.

• trace_id (string, required)
• environment (string, optional)
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 4320 (72 hours).
• selected_span_id (string, optional): Returns attributes, events, and links for that span only.
• max_spans (integer, optional): Default: 500. Maximum: 1000.

Returns an investigation-evidence/v1 envelope; the waterfall is under data.

• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• service_name (string, optional)
• env (string, optional)
• event_name (string, optional): Call without this first to get available_event_names.

Configured Compass alert-group inventory for changeboard / label-coverage audits. Includes groups with zero rules and groups that are not firing. Does not return PromQL.

• alert_group_name / alert_group_type / data_source_name (string, optional): Case-insensitive substring match.
• team / tier (string, optional): Exact case-insensitive match on configured metadata.
• label_key + label_value (string, optional): Must be set together. Exact case-insensitive match on one metadata.labels pair — both key and value.

Returns compact JSON {"count":N,"groups":[...]} with id, name, type, entity_class, team, tier, metadata.labels, and rule counts. Empty team / labels means unset.

• search_term (string, optional): Free-text search across name, group, data source, tags.
• rule_name (string, optional)
• severity (string, optional)
• rule_type (string, optional): static or anomaly.
• alert_group_name / alert_group_type / data_source_name (string, optional)
• tags (array, optional): All must match (AND logic).

• time_iso (string, optional): Evaluation time in RFC3339.
• window (integer, optional): Lookback in seconds. Default: 900. Range: 60–86400.
• lookback_minutes (integer, optional): Range: 1–1440.

• start_time (integer, required): Unix epoch start of the range (inclusive).
• end_time (integer, required): Unix epoch end of the range (inclusive).
• step (integer, required): Resolution in seconds between samples. The number of samples ((end_time - start_time) / step + 1) is capped at 100.
• alert_group_id (string, optional): Filter by alert group ID.
• rule_name (string, optional): Regex filter on rule name.
• alert_group_name (string, optional): Regex filter on alert group name.
• label_filters (string, optional): Comma-separated key=value label filters.
• state (string, optional): Filter by state (e.g. firing).

Returns a JSON map of rule_id -> [{timestamp, is_firing}]. A timestamp at which a rule is absent from the upstream response is reported as is_firing=0 — this means "not observed as firing", not a confirmed normal state.

No parameters. Returns all configured notification channels (Slack, PagerDuty, email, webhooks, etc.).

• query (string, required): The name to search for — partial, misspelled, or abbreviated.
• type (string, optional): Restrict to entity type: service, environment, host, database, k8s_deployment, k8s_namespace, job.

Returns up to 3 closest matches with similarity scores. Use this before any tool call where the entity name is uncertain. If a previous call returned empty results, try this before retrying.

• service_name (string, required): Service to derive a telemetry profile for.
• datasource (string, optional): Datasource name. Omit for the default.

Returns a short investigation brief followed by the full profile as raw JSON: signal presence (logs/traces/metrics as present, absent, or unknown), language and runtime, deployment environments, log signal_shape (log_format, severity_set, level_field), and a recommended ingest fix where one applies. Derived upstream and cached with a ~15 minute TTL.

Call it before any service-scoped investigation so tool selection matches the service's actual telemetry — skip trace tools when traces is absent, and when severity_set is none or partial parse severity from level_field in the log body rather than using severity_filters. metrics is always unknown and dependencies is unpopulated in v1. When logs and traces are both absent, confirm the name with did_you_mean before concluding the service is unmonitored.

No parameters. Returns all custom dashboards in the org as a JSON array with id, name, and metadata.

• id (string, required): Dashboard UUID.
• region (string, optional): Region for panel query population. Defaults to configured datasource region.

Read-only. Never creates or updates dashboards. Accept exactly one of dashboard_id or dashboard_definition.

• dashboard_id (string, optional): Saved dashboard UUID to validate.
• dashboard_definition (object, optional): Inline unsaved dashboard body (true dry run).
• start_time_iso / end_time_iso (string, optional): Validation window (RFC3339). Must be ≤ 24h.
• region (string, optional): Region for panel query execution.

Returns dashboard_validation/v1: per-panel lint + execute classification (data / no_data / invalid / error). Day-1 empty results classify as valid_no_data without diagnose probes.

Net-new only. After this call returns dashboard.id, refine with update_dashboard — do not create again to add, trim, or fix panels.

• dashboard (object, required): Dashboard definition with name and panels[]. Each panel requires name, version, layout (x, y, w, h), visualization.type, and queries[].
• metadata (object, optional): Dashboard metadata — _category and _type fields (e.g. {"_category":"custom","_type":"metrics"}).

Prefer this after create. Full replacement by id (same body as create).

• id (string, required): Dashboard UUID to update.
• dashboard (object, required): Full replacement dashboard body (same shape as create).
• metadata (object, optional): Replacement metadata. Readonly system dashboards return a 403 error.

• id (string, required): Dashboard UUID to delete. Readonly system dashboards cannot be deleted.

• dashboard_id (string, required): Dashboard UUID whose snapshots to list.

Returns metadata only (id, name, expires_at, etc.). Use get_dashboard_snapshot for frozen panel data.

• id (string, required): Snapshot UUID.

Returns the full frozen snapshot including dashboard_definition, panel_data, time_range, and variables.

• id (string, required): Snapshot UUID to delete.

• lookback_minutes / start_time_iso / end_time_iso (optional): Window; prefer lookback or explicit ISO bounds (default 60m).
• region (string, optional): Region override.

Returns services that have profiling data in the window. Call this before get_flamegraph / get_top_functions / get_profile_summary.

• service (string, required): Service name from get_profile_services.
• profile_type (string, optional): cpu (default), alloc, or wall. Pin a type when comparing windows.
• env / cluster / namespace / runtime (string, optional): Scope filters.
• limit (number, optional): Max aggregated stack rows (default 1000, max 10000).
• lookback_minutes / start_time_iso / end_time_iso / region (optional).

Returns a nested flamegraph tree (name / value / self / children). truncated: true means the API row limit was hit.

Same filters as get_flamegraph. Returns self-sample ranking of hottest functions. May be truncated; check truncated.

Same filters as get_flamegraph. Returns a short natural-language triage of the profile for the service.

• query (string, optional): Title substring. Empty lists broadly (subject to the 5,000-row cap).

Returns {"dashboards":[…], "truncated":bool} with uid, title, uri, url, type, tags. Use uid with grafana_get_dashboard.

• uid (string, required): Grafana dashboard uid.
• full_json (boolean, optional): When true, return raw Grafana JSON instead of the filtered summary.

Default summary: version, tags, templating variables, and each panel's type/datasource/gridPos/promQL targets. Unknown plugin panel types appear in unsupportedPanelTypes.

No parameters. Returns the folder tree.

• folder_uid (string, required): Grafana folder uid.

Returns {"dashboards":[…], "truncated":bool} for dashboards in that folder (paginated up to 5,000).

No parameters. Returns a safe projection of datasources (no credential fields).