CloudWatch Logs MCP server for AI agents

The CloudWatch Logs MCP server provides tools for accessing AWS CloudWatch logs through the Model Context Protocol (MCP). It enables AI assistants to list CloudWatch log groups and read log entries, making it easier to monitor and analyze your AWS logs.

Available Tools

list_groups

Lists available CloudWatch log groups.

Parameters:

prefix (optional): Log group name prefix
region (optional): AWS region
accessKeyId (optional): AWS access key ID
secretAccessKey (optional): AWS secret access key
sessionToken (optional): AWS session token

Returns: JSON string with the list of log groups, including logGroupName, creationTime, and storedBytes.

get_logs

Gets CloudWatch logs from a specific log group.

Parameters:

logGroupName (required): The name of the log group
logStreamName (optional): The name of the log stream
startTime (optional): Start time in ISO format or relative time (e.g., "5m", "1h", "1d")
endTime (optional): End time in ISO format
filterPattern (optional): Filter pattern for the logs
region (optional): AWS region
accessKeyId (optional): AWS access key ID
secretAccessKey (optional): AWS secret access key
sessionToken (optional): AWS session token

Returns: JSON string with the log events, including timestamp, message, and logStreamName.

Setup

AWS Credentials

Before using the server, ensure you have AWS credentials configured. You can set them up using the AWS CLI or by setting environment variables:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY

Configuration with Claude Desktop

To use this server with Claude Desktop, add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "cloudwatch-logs": {
      "command": "python3",
      "args": ["/path/to/cloudwatch-logs-mcp/main.py"],
      "env": {
        "AWS_ACCESS_KEY_ID": "<YOUR_ACCESS_KEY_ID>",
        "AWS_SECRET_ACCESS_KEY": "<YOUR_SECRET_ACCESS_KEY>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Docker Configuration

If you prefer to run the server in a Docker container:

{
  "mcpServers": {
    "cloudwatch-logs": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "AWS_ACCESS_KEY_ID",
        "-e",
        "AWS_SECRET_ACCESS_KEY",
        "mcp/cloudwatch-logs"
      ],
      "env": {
        "AWS_ACCESS_KEY_ID": "<YOUR_ACCESS_KEY_ID>",
        "AWS_SECRET_ACCESS_KEY": "<YOUR_SECRET_ACCESS_KEY>"
      }
    }
  }
}

Usage Examples

Listing Log Groups

To list all CloudWatch log groups:

# Example request to list all log groups
response = await list_groups()

To list log groups with a specific prefix in a particular region:

# Example request with prefix and region
response = await list_groups(
    prefix="/aws/lambda/",
    region="us-west-2"
)

Getting Log Entries

To retrieve logs from a specific log group:

# Basic example to get logs from a log group
logs = await get_logs(
    logGroupName="/aws/lambda/my-function"
)

Using additional filtering options:

# Advanced example with time range and filtering
logs = await get_logs(
    logGroupName="/aws/lambda/my-function",
    logStreamName="2023/04/01/[$LATEST]abcdef123456",
    startTime="1h",  # Get logs from the last hour
    filterPattern="ERROR",  # Only show error logs
    region="us-east-1"
)

How to install this MCP server

For Claude Code

To add this MCP server to Claude Code, run this command in your terminal:

claude mcp add-json "cloudwatch-logs" '{"command":"python3","args":["/path/to/cloudwatch-logs-mcp/main.py"],"env":{"AWS_ACCESS_KEY_ID":"<YOUR_ACCESS_KEY_ID>","AWS_SECRET_ACCESS_KEY":"<YOUR_SECRET_ACCESS_KEY>"},"disabled":false,"autoApprove":[]}'

See the official Claude Code MCP documentation for more details.

For Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > Tools & Integrations and click "New MCP Server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "cloudwatch-logs": {
            "command": "python3",
            "args": [
                "/path/to/cloudwatch-logs-mcp/main.py"
            ],
            "env": {
                "AWS_ACCESS_KEY_ID": "<YOUR_ACCESS_KEY_ID>",
                "AWS_SECRET_ACCESS_KEY": "<YOUR_SECRET_ACCESS_KEY>"
            },
            "disabled": false,
            "autoApprove": []
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explicitly ask the agent to use the tool by mentioning the tool name and describing what the function does.

For Claude Desktop

To add this MCP server to Claude Desktop:

1. Find your configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

2. Add this to your configuration file:

{
    "mcpServers": {
        "cloudwatch-logs": {
            "command": "python3",
            "args": [
                "/path/to/cloudwatch-logs-mcp/main.py"
            ],
            "env": {
                "AWS_ACCESS_KEY_ID": "<YOUR_ACCESS_KEY_ID>",
                "AWS_SECRET_ACCESS_KEY": "<YOUR_SECRET_ACCESS_KEY>"
            },
            "disabled": false,
            "autoApprove": []
        }
    }
}

3. Restart Claude Desktop for the changes to take effect