Last9

Bridges AI agents (Claude Desktop, Cursor, Windsurf) directly to Last9 observability platform using the Model Context Protocol, enabling LLMs to query live production logs, metrics, traces, and alerts without context switching. Implements a dual-transport architecture (HTTP for managed mode, STDIO for local/air-gapped) that translates natural language intent into structured Last9 API calls, with background attribute caching to optimize LLM token usage and reduce round-trip latency.

Exposes high-level service summaries and RED metrics (Rate, Error, Duration) through structured MCP tools that execute PromQL queries against Last9's metrics backend. Abstracts Prometheus query complexity by providing pre-built metric templates while allowing raw PromQL execution for advanced use cases, with automatic time-range normalization and result formatting for LLM consumption.

Generates contextual deep links to Last9 UI that preserve query parameters (service, time range, filters) enabling users to seamlessly transition from LLM-assisted analysis to manual investigation. Links include pre-filled filters, time ranges, and service selections, reducing manual re-entry of context. Supports links to logs, metrics, traces, and alerts views.

Manages two authentication modes: API Token for HTTP mode (long-lived, suitable for service accounts) and Refresh Token for STDIO mode (short-lived, suitable for user sessions). Implements token validation, expiration handling, and secure credential storage. Abstracts authentication differences between modes, allowing same tool implementations to work with either credential type.

Enables LLMs to query logs using Last9's JSON-pipeline filter syntax, with automatic attribute discovery that surfaces available log fields and their cardinality. Implements a chunking strategy to handle large result sets, manages drop-rule configuration for sensitive data filtering, and generates deep links to Last9 UI for manual log exploration. Abstracts complex log query DSL through structured tool parameters while exposing raw query capability for advanced filtering.

Retrieves distributed traces by trace ID or service name, with automatic exception aggregation across trace spans. Implements span-level filtering, service dependency visualization, and correlation of trace data with deployment events. Generates structured trace summaries optimized for LLM analysis, including root cause indicators and latency attribution across service boundaries.

Exposes firing alerts and system change events (deployments, configuration changes) through structured MCP tools, enabling LLMs to correlate alert triggers with recent infrastructure changes. Implements event timeline visualization and alert metadata enrichment, allowing agents to construct incident narratives by linking alerts to deployment events and metric anomalies.

Implements the Model Context Protocol tool registration system with a background attribute cache that discovers and maintains available log fields, metric labels, and service names. Dynamically updates tool schemas based on cached attributes, enabling LLMs to construct valid queries without prior knowledge of data structure. Handles tool lifecycle (registration, discovery, invocation) and maintains an internal state machine for cache synchronization.

Implements Model Context Protocol server with two transport modes: managed HTTP (connects to Last9's hosted endpoint via HTTPS) and local STDIO (runs as local process with stdin/stdout communication). Abstracts transport layer differences, allowing same tool implementations to work across both modes. Handles authentication differently per mode (API Token for HTTP, Refresh Token for STDIO) and manages connection lifecycle, error handling, and graceful shutdown.

Provides structured LLM prompt instructions that guide AI agents in constructing valid observability queries (logs, metrics, traces) without requiring deep domain expertise. Includes query syntax guidance, attribute discovery instructions, and examples of common query patterns. Optimizes prompts for token efficiency and includes instructions for handling chunked results and interpreting observability data.

Provides utility functions for normalizing time ranges (ISO 8601, relative like '1h', '24h', Unix timestamps) into Last9 API-compatible formats. Implements time-zone handling, relative-to-absolute time conversion, and query window alignment. Handles edge cases like daylight saving time and ensures consistent time semantics across logs, metrics, and traces queries.

Implements intelligent result chunking that breaks large observability datasets (logs, metrics, traces) into LLM-consumable chunks while preserving semantic context. Chunks are sized to fit within LLM context windows, with configurable chunk size and overlap strategy. Includes chunk metadata (sequence number, total chunks, context summary) to help LLMs reconstruct full results and understand data continuity.