Superlog
An open-source agent that observes & fixes your application.
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeRead-only
What it can do
- Query Logs: Search OpenTelemetry logs. Targets the session's active project unless project_id is given. Error rows include flattened exception_type, exception_message, and exception_stacktrace fields
- Query Traces: Search OpenTelemetry spans. Targets the session's active project unless project_id is given. Spans with exception events include flattened exception_type, exception_message, and exceptio
- Query Metrics: Fetch recent metric points across gauge/sum/histogram/summary tables. Targets the session's active project unless project_id is given. Each point includes its data-point `attributes` (t
What data it sees
Do you need an account
No: the server works without sign-in
An open-source agent that observes & fixes your application. Query logs, traces, metrics, incidents.
Server tool list (48)
Raw names from tools/list. Only developers need these.
| query_logs | Search OpenTelemetry logs. Targets the session's active project unless project_id is given. Error rows include flattened exception_type, exception_message, and exception_stacktrace fields when present. |
| query_traces | Search OpenTelemetry spans. Targets the session's active project unless project_id is given. Spans with exception events include flattened exception_type, exception_message, and exception_stacktrace fields when present. |
| query_metrics | Fetch recent metric points across gauge/sum/histogram/summary tables. Targets the session's active project unless project_id is given. Each point includes its data-point `attributes` (the per-series dimensions like route/status/tenant) and `resource_attrs`. gauge/sum points carry a scalar `value`; histogram/summary points carry `count` and `sum` (plus `min`/`max` for histograms) instead, since they have no scalar value. |
| list_services | List distinct service.name values emitting telemetry in the given window. |
| list_projects | List every project the authenticated user can access, across all of their orgs. The active project is marked. |
| get_active_project | Return the project that tools default to when project_id is omitted. |
| set_active_project | Change the default project for subsequent tool calls in this session. Persists for the lifetime of the access token. |
| list_alerts | List all alerts in the active project (or the project_id you pass). |
| get_alert | Fetch a single alert plus its 50 most recent firings. |
| create_alert | Create an alert. For logs/traces sources aggregation must be 'count'; for metric source it must be 'sum' or 'avg' and metric_name is required. |
| update_alert | Patch an alert. Provide only the fields you want to change. Validation runs on the merged result. |
| delete_alert | Delete an alert by id. |
| preview_alert | Evaluate a draft alert spec against current data without saving. Returns whether it would breach right now. |
| test_alert | Re-evaluate a saved alert against current data and return the result. |
| get_home | Fetch the active project's shared home command center, including built-ins, data widgets, links, and grid layouts. |
| set_home_builtin | Show or hide one of the built-in home widgets: setup_todos, active_incidents, or service_map. |
| add_home_widget | Add a chart, table, or markdown widget directly to the shared project home. Uses the same widget config and 12-column layout as dashboards. |
| add_home_link | Add a shared link card to project home. URLs must be absolute and use http or https. |
| update_home_layout | Update positions and sizes for home items on the 12-column grid. Read get_home first and send the items that should move. |
| remove_home_item | Remove a built-in, data widget, or link from project home. Read get_home first to discover item ids. |
| list_dashboards | List dashboards in the active project (or project_id). |
| get_dashboard | Fetch a dashboard with its widgets. |
| create_dashboard | Create a dashboard. Slug is generated from the name. Optionally seed template variables (see `variables`) so widget filters can reference them with $name. |
| update_dashboard | Rename a dashboard. |
| set_dashboard_variables | Replace a dashboard's template-variable list. Pass the FULL set you want to keep — this overwrites the existing list (read the current one with get_dashboard first). Variables let one dropdown drive filters across many widgets: define a variable here, then point widget filters at it with value:"$name". Dashboard template variables — a named picklist that drives widget filters. Each entry is { name, options[], defaultValue?, label?, attributeKey? }. A widget filter references a variable by putting the token "$name" (or "${name}") in a filter value — e.g. resourceAttrs: [{ key: "deployment.environment", value: "$env" }]. At view time the dashboard shows a dropdown per variable and substitutes the selected option into every filter that references it, so one variable can drive filters across many widgets on any attribute key. `options` is the selectable list (empty = free-form); `defaultValue` must be one of `options` when `options` is non-empty; `attributeKey` is optional and only powers a one-click 'filter by this variable' shortcut in the web editor. Variable names must start with a letter and contain only letters, digits, or underscores. |
| delete_dashboard | Delete a dashboard and all its widgets. |
| add_dashboard_widget | Append a widget to a dashboard. Widget types: timeseries_count, timeseries_metric, trace_table, log_table, markdown. Omit `layout` to use the standard size for the type — recommended. The grid is 12 columns wide, so x is 0-11 and w is 1-12; the standard sizes are w:6 h:4 for timeseries charts (half-width), w:12 h:6 for trace_table/log_table (full-width), and w:4 h:5 for markdown. Only pass `layout` when you deliberately want a non-standard size or position. A filter value may reference a dashboard variable with the token "$name" (or "${name}") — e.g. config.filter.resourceAttrs: [{ key: "deployment.environment", value: "$env" }] — which is substituted with the viewer's selected option at view time. Define variables with set_dashboard_variables (or create_dashboard). |
| update_dashboard_widget | Patch a widget's title, config, or layout. As with add_dashboard_widget, a filter value may reference a dashboard variable with the token "$name" (or "${name}"). |
| delete_dashboard_widget | Remove a widget from a dashboard. |
| get_incident | Fetch one incident by its id — the uuid at the end of a superlog.sh/org/<org>/project/<project>/incidents/<id> link — and everything needed to explain it. No project_id is required; the project is resolved from the incident. Returns: the incident summary with the agent's findings (root_cause_text, agent_summary, estimated_impact_text) and its project_id; every linked issue with a stored telemetry `sample` (trace_id, span_id, stacktrace, span/log/resource attributes); and a pointer to the latest investigation run. To pull live telemetry, take a sample's trace_id and call query_traces, or filter query_logs/query_traces by the issue's service + exception type — passing the returned project_id. |
| search_incidents | Search incidents in the active project (or project_id). Incidents are auto-grouped error/anomaly investigations; each row carries the agent's findings (agent_summary, root_cause_text) when available. Filter by status, severity, service, a free-text substring over title/codename, and a last_seen time window. Results are newest-activity-first. By default agent-classified noise (status='autoresolved_noise') is hidden; pass status='all' to include it or status='autoresolved_noise' to inspect just the noise pile. Use get_incident to drill into a single incident's linked issues and telemetry. |
| list_agent_mcp_servers | List the custom MCP servers available to new investigation and Slack-agent sessions for this project. Credentials are always redacted. |
| add_agent_mcp_server | Add a trusted HTTPS Streamable HTTP MCP server to this project. Admin only. Authentication accepts none, bearer/API token, arbitrary API-key header, or OAuth. Credential inputs are write-only and never returned. |
| update_agent_mcp_server | Update a project MCP server. Admin only. Omit auth to preserve its credential; supplying auth replaces it. A changed URL must be explicitly trusted. |
| remove_agent_mcp_server | Remove a custom MCP server from this project. Admin only. |
| start_agent_mcp_oauth | Start OAuth authorization-code authentication with discovery, PKCE, resource binding, and dynamic client registration when needed. Admin only. Open the returned authorizationUrl in a browser. |
| connect_agent_mcp_client_credentials | Exchange the configured OAuth client ID and secret using client_credentials, but only when advertised by the authorization server. Admin only. |
| disconnect_agent_mcp_oauth | Erase stored OAuth tokens and disable this custom MCP server. Admin only. |
| test_agent_mcp_server | Connect to a configured MCP server, initialize the protocol, and list its tools. Admin only. Secrets are never returned. |
| get_issue_filter | Read the project's issue filter: per-kind include/exclude attribute clauses that decide which ERROR events become issues/incidents. Excludes win; a non-empty include list means an event must match at least one clause. |
| update_issue_filter | Update the issue filter. Each bucket you provide REPLACES that bucket; omit a bucket to leave it unchanged; pass [] to clear it. Use this to quiet recurring noise (add an exclude clause) or to scope investigations to specific services/routes (add an include clause). Call get_issue_filter first if you want to add to the existing rules rather than overwrite them. |
| preview_issue_filter | Preview which recent ERROR events (last 24h) would still become issues under a candidate filter, WITHOUT saving. Buckets you pass are merged over the project's current filter (same semantics as update_issue_filter); omit all buckets to preview the current saved filter. Returns sample matching events. |
| get_project_context | Read the project's freeform context — the human-written description of the system (architecture, conventions, key services) that the investigation agent reads on every run. |
| set_project_context | Overwrite the project's freeform context (max 8000 chars; longer input is truncated). This REPLACES the whole field — call get_project_context first and edit the returned text if you want to preserve existing content. Use for durable, system-level facts that apply to every investigation; for narrower learnings prefer create_agent_memory. |
| list_agent_memories | List the investigation agent's stored memories for the project — durable learnings (feedback, terminology, infra, project facts) that are injected into future investigations. |
| create_agent_memory | Record a durable, reusable learning so future investigations inherit it. Record a memory whenever you discover something worth remembering across investigations — a root-cause pattern, a piece of infra/architecture, a domain term, or a user correction about how to investigate. Keep the title a short handle and the body the specific, reusable fact (not a one-off incident narrative). |
| update_agent_memory | Patch a stored memory. Provide only the fields you want to change. Set status='archived' to retire a memory without deleting it (archived memories stop being injected into investigations). |
| delete_agent_memory | Permanently delete a stored memory by id. To retire one reversibly, prefer update_agent_memory with status='archived'. |