Sumo Logic MCP Server (closed preview) by kimsauce · Pull Request #6027 · SumoLogic/sumologic-documentation

kimsauce · 2025-11-13T10:51:43Z

Purpose of this pull request

Pending SME approval from MCP team - do not merge.

External MCP server - Closed Beta. Est. publish: week of 2/23.

Select the type of change

Minor Changes - Typos, formatting, slight revisions
Update Content - Revisions, updating sections
New Content - New features, sections, pages, tutorials
Site and Tools - .clabot, version updates, maintenance, dependencies, new packages for the site (Docusaurus, Gatsby, React, etc.)

Ticket (if applicable)

https://sumologic.atlassian.net/browse/DOCS-1237

…ion into DOCS-1237

docs/platform-services/mcp-server.md

DDeC7 · 2026-03-02T23:39:16Z

Hi @kimsauce - Comments include the following:

Recommended removing "Platform Services" from titile
Recommend removing the following from cost section:
"

What to monitor

Track these metrics per request, per identity, and per tool:

Cost per request (not just request volume).
Tool calls per request.
Agent step count.
Retry frequency.
Retrieval scope (top-k values, cross-namespace queries).
Endpoints ranked by cost, not just traffic.

Recommended controls

Hard budgets. Set per-request, per-identity, per-tool, and per-tenant spending limits.
Validation gates. Implement authentication, input validation, size limits, and retrieval caps before LLM processing begins.
Progressive trust. Start with restricted capabilities for new or untrusted identities. Expand access based on usage patterns.
Per-tool quotas. Limit or disable expensive tools for untrusted traffic.
Kill switches. Maintain the ability to disable high-cost tools or operations within seconds.
Disconnect handling. Ensure workflows terminate when clients disconnect to prevent billing for abandoned requests."

kimsauce · 2026-03-03T00:02:44Z

hat to monitor

@DDeC7 done!

DDeC7 · 2026-03-03T12:52:37Z

@kimsauce - MCP is closed preview and will be followed by an open/public preview later.

jpipkin1 · 2026-03-03T15:27:31Z

blog-service/2026-02-25-mcp.md

+hide_table_of_contents: true    
+---
+
+The Sumo Logic MCP Server, now in closed beta, lets you use Sumo tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.


Suggested change

The Sumo Logic MCP Server, now in closed beta, lets you use Sumo tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.

The Sumo Logic MCP Server, now in closed beta, lets you use Sumo Logic tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.

jpipkin1 · 2026-03-03T15:28:05Z

blog-service/2026-02-25-mcp.md

+
+The Sumo Logic MCP Server, now in closed beta, lets you use Sumo tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.
+
+It enables external copilots and proprietary models to securely query logs, investigate SIEM insights, manage alerts and dashboards, and work with existing Dojo AI agents using natural language from IDEs and chat platforms.


Suggested change

It enables external copilots and proprietary models to securely query logs, investigate SIEM insights, manage alerts and dashboards, and work with existing Dojo AI agents using natural language from IDEs and chat platforms.

It enables external copilots and proprietary models to securely query logs, investigate Cloud SIEM insights, manage alerts and dashboards, and work with existing Dojo AI agents using natural language from IDEs and chat platforms.

jpipkin1 · 2026-03-03T15:30:06Z

docs/platform-services/mcp-server.md

+<head>
+ <meta name="robots" content="noindex" />
+</head>
+


Suggested change

<p><a href={useBaseUrl('docs/beta')}><span className="beta">Beta</span></a></p>

I recommend that you add the beta label.

jpipkin1 · 2026-03-03T16:28:02Z

docs/platform-services/mcp-server.md

+   cd /path/to/your/project
+   claude
+   ```
+1. In Claude Code, verify the Sumo Logic MCP server connection with `/mcp`.<br/><img src={useBaseUrl('img/platform-services/mcp/claude-mcp-connected.png')} alt="Claude Code CLI showing Sumo Logic MCP server connected" width="600"/>


This image is broken because the image is in the /platform-services folder and not in the /platform services/mcp subfolder.

jpipkin1 · 2026-03-03T16:38:44Z

docs/platform-services/mcp-server.md

+     ]
+   }
+   ```
+   If you've previously configured other MCP servers here, this should be an additive process (i.e., do not delete existing ones you still intend to use).


Suggested change

If you've previously configured other MCP servers here, this should be an additive process (i.e., do not delete existing ones you still intend to use).

If you've previously configured other MCP servers here, this should be an additive process (that is, do not delete existing ones you still intend to use).

jpipkin1 · 2026-03-03T16:41:04Z

docs/platform-services/mcp-server.md

+`Show me all active alerts from the last 24 hours`
+`Get the history for alert ID <id>`
+`Find alerts related to <id>`
+`Resolve alert <id>`


Suggested change

`Show me all active alerts from the last 24 hours`

`Get the history for alert ID <id>`

`Find alerts related to <id>`

`Resolve alert <id>`

* `Show me all active alerts from the last 24 hours`

* `Get the history for alert ID <id>`

* `Find alerts related to <id>`

* `Resolve alert <id>`

jpipkin1 · 2026-03-03T16:41:20Z

docs/platform-services/mcp-server.md

+`Create a new dashboard called "System Overview" that uses the previous query to power a dashboard panel called "Total Log Count Per Minute"`
+`Add a second panel called "Error Logs Count Per Minute" that is a similar query but only has logs in it that contain the keyword "error" in them`


Suggested change

`Create a new dashboard called "System Overview" that uses the previous query to power a dashboard panel called "Total Log Count Per Minute"`

`Add a second panel called "Error Logs Count Per Minute" that is a similar query but only has logs in it that contain the keyword "error" in them`

* `Create a new dashboard called "System Overview" that uses the previous query to power a dashboard panel called "Total Log Count Per Minute"`

* `Add a second panel called "Error Logs Count Per Minute" that is a similar query but only has logs in it that contain the keyword "error" in them`

jpipkin1 · 2026-03-03T16:41:47Z

docs/platform-services/mcp-server.md

+`Show triage details for INSIGHT-1234`
+`Retrieve the triage details`
+`What are all of the related entities?`
+`Add a comment to this insight: "This warrants deeper investigation"`
+`Show recommended next steps for INSIGHT-1234`
+`Update INSIGHT-1234 status to In Progress`


Suggested change

`Show triage details for INSIGHT-1234`

`Retrieve the triage details`

`What are all of the related entities?`

`Add a comment to this insight: "This warrants deeper investigation"`

`Show recommended next steps for INSIGHT-1234`

`Update INSIGHT-1234 status to In Progress`

* `Show triage details for INSIGHT-1234`

* `Retrieve the triage details`

* `What are all of the related entities?`

* `Add a comment to this insight: "This warrants deeper investigation"`

* `Show recommended next steps for INSIGHT-1234`

* `Update INSIGHT-1234 status to In Progress`

jpipkin1 · 2026-03-03T16:41:58Z

docs/platform-services/mcp-server.md

+`Run a log search for the last 5 minutes across all of my data that counts the data by 1-minute buckets and plots the result as a line graph`
+`Run a 2-day search on _sourcecategory=*proofpoint*, count by recipient and senderip`


Suggested change

`Run a log search for the last 5 minutes across all of my data that counts the data by 1-minute buckets and plots the result as a line graph`

`Run a 2-day search on _sourcecategory=*proofpoint*, count by recipient and senderip`

* `Run a log search for the last 5 minutes across all of my data that counts the data by 1-minute buckets and plots the result as a line graph`

* `Run a 2-day search on _sourcecategory=*proofpoint*, count by recipient and senderip`

jpipkin1 · 2026-03-03T16:42:18Z

docs/platform-services/mcp-server.md

+`List the users in my org and format as an ASCII table`
+`Show users who have never logged in`
+`Delete those users`
+`List all users and their roles`


Suggested change

`List the users in my org and format as an ASCII table`

`Show users who have never logged in`

`Delete those users`

`List all users and their roles`

* `List the users in my org and format as an ASCII table`

* `Show users who have never logged in`

* `Delete those users`

* `List all users and their roles`

jpipkin1

Wow, @kimsauce! This article is amazing! What an incredible amount of work you've put into it. I'm impressed. I have only a few minor suggestions.

External MCP (Beta)

194b16a

cla-bot bot added the cla-signed Contributor approved, listed in .clabot file label Nov 13, 2025

kimsauce self-assigned this Nov 13, 2025

kimsauce requested a review from margaret-selid November 13, 2025 11:15

kimsauce and others added 10 commits November 13, 2025 03:16

HITL notes

b159acc

Merge branch 'main' into DOCS-1237

6fcad19

Merge branch 'main' into DOCS-1237

6cfc486

Merge branch 'main' into DOCS-1237

3090461

integrate demo material

3de8ccc

Merge branch 'main' into DOCS-1237

66de8b6

Update doc and release notes

3048978

Merge branch 'main' into DOCS-1237

7ffb803

tools edits

606344e

Merge branch 'main' into DOCS-1237

f9fee6c

kimsauce requested review from vsinghal13 and wjakelee and removed request for margaret-selid January 12, 2026 22:55

kimsauce added the do-not-merge Pull requests that should not be merged label Jan 12, 2026

kimsauce and others added 9 commits January 13, 2026 00:05

example placeholders

106b68d

Merge branch 'DOCS-1237' of github.com:SumoLogic/sumologic-documentat…

cef7e52

…ion into DOCS-1237

Merge branch 'main' into DOCS-1237

094468d

token torching info

760ec1f

add TODOs

a3ed88a

Merge branch 'main' into DOCS-1237

c191eff

add images and instructions

ee0ec27

fix links

45e2402

update rn

111b7bc

kimsauce requested a review from ganano February 17, 2026 09:49

ganano reviewed Feb 17, 2026

View reviewed changes

docs/platform-services/mcp-server.md Outdated Show resolved Hide resolved

docs/platform-services/mcp-server.md Show resolved Hide resolved

Merge branch 'main' into DOCS-1237

634da79

kimsauce added 7 commits February 23, 2026 16:05

change rn date

98e7830

Merge branch 'main' into DOCS-1237

fbdb1f3

claude and vscode

1b6da72

input more API crosslinks

c89b5fe

1st round edits

ef77f81

more edits

8a89ee3

screenshots and consolidation

47a0054

edits

adf24ba

more prompts

8744eec

kimsauce marked this pull request as ready for review March 3, 2026 00:12

kimsauce requested review from JV0812, amee-sumo, jpipkin1 and mafsumo as code owners March 3, 2026 00:12

kimsauce requested a review from kjia6s March 3, 2026 00:13

jpipkin1 reviewed Mar 3, 2026

View reviewed changes

jpipkin1 approved these changes Mar 3, 2026

View reviewed changes

kimsauce changed the title ~~External MCP Server (Beta)~~ Sumo Logic MCP Server (closed preview) Mar 3, 2026

	The Sumo Logic MCP Server, now in closed beta, lets you use Sumo tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.
	The Sumo Logic MCP Server, now in closed beta, lets you use Sumo Logic tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.


		The Sumo Logic MCP Server, now in closed beta, lets you use Sumo tools for alerts, insights, dashboards, log searches and users in natural language in VS Code and Terminal.

		It enables external copilots and proprietary models to securely query logs, investigate SIEM insights, manage alerts and dashboards, and work with existing Dojo AI agents using natural language from IDEs and chat platforms.



	<p><a href={useBaseUrl('docs/beta')}><span className="beta">Beta</span></a></p>

	If you've previously configured other MCP servers here, this should be an additive process (i.e., do not delete existing ones you still intend to use).
	If you've previously configured other MCP servers here, this should be an additive process (that is, do not delete existing ones you still intend to use).

		`Create a new dashboard called "System Overview" that uses the previous query to power a dashboard panel called "Total Log Count Per Minute"`
		`Add a second panel called "Error Logs Count Per Minute" that is a similar query but only has logs in it that contain the keyword "error" in them`

		`Run a log search for the last 5 minutes across all of my data that counts the data by 1-minute buckets and plots the result as a line graph`
		`Run a 2-day search on _sourcecategory=proofpoint, count by recipient and senderip`

Conversation

kimsauce commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose of this pull request

Select the type of change

Ticket (if applicable)

Uh oh!

Uh oh!

Uh oh!

DDeC7 commented Mar 2, 2026

What to monitor

Recommended controls

Uh oh!

kimsauce commented Mar 3, 2026

Uh oh!

DDeC7 commented Mar 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpipkin1 Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpipkin1 Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpipkin1 Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpipkin1 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kimsauce commented Nov 13, 2025 •

edited

Loading

jpipkin1 Mar 3, 2026 •

edited

Loading

jpipkin1 Mar 3, 2026 •

edited

Loading

jpipkin1 Mar 3, 2026 •

edited

Loading