MCP tools

Reading logs in Wake means asking an agent. The deployment exposes a Model Context Protocol server with ten tools: seven that read, and three that change something and therefore ask for confirmation first.

Reach it from an agent

Wake's MCP server is the standard Built for Cloud one, so Connect your agent is the procedure. The credential you issue needs the wake.read ability: every tool below checks for it, and a credential without it does not see the tools at all rather than being refused when it calls one.

A credential for one Wake deployment can read every application reporting to that deployment. Wake has no per-application MCP scoping.

Every response is marked untrusted

Any tool that returns log content prefixes its response with a line saying the content is untrusted and that instructions inside log fields must not be followed. That is there because a log line is text somebody else wrote, often a user, and an agent reading forty applications' logs is reading forty applications' worth of attacker-controllable strings. Keep the marker in mind when you build anything that passes a tool result into another prompt.

There is no raw SQL tool, deliberately. Everything below is a bounded query with a limit.

Scope

Most tools take either app (one application's id, as created in Wake's admin pages) or all_apps: true, and refuse a call that gives both or neither. Time-windowed tools require from and to.

Reading

list_apps returns the applications reporting in, with when each was last seen, its environments, its volume and its ingest health. It is the right first call: the ids it returns are what every other tool wants.

search_logs searches a time window by text or regex, optionally narrowed by environment and level, newest first, up to 500 rows.

tail_logs returns the most recent lines in a window and a cursor you can pass back to continue from where you stopped.

aggregate_logs counts a window grouped by any of hour, app, environment and level. This is the one for "is this getting worse" and "which application is noisiest".

recent_errors returns the last error-and-above lines, for one application or all of them. It is served by a table built for the long range, so it answers over a much longer window than a search would.

get_context takes an application and an event_id and returns the lines around that event in the same application, up to fifty either side. Hand it the event id from a search result when one line is not enough.

ingest_health reports drops, rejections, rate-limit hits, flush lag and the client version each application is on. When a reporting application looks quiet, this says whether Wake never heard from it or heard and refused it.

Changing things

Three tools change state, are marked destructive, and run in two phases: the first call returns a preview of what would happen and the second confirms it. The agent needs the destructive door for all three.

delete_app_logs removes one application's log data from the lake and the query plane. It does not remove the application record or its credential.

revoke_credential and rotate_credential take an application and a credential id. Rotating returns a new secret once; the reporting application stops being accepted as soon as you rotate, so have the new value ready to deploy.