{
  "mcp": {
    "servers": {
      "last9": {
        "type": "stdio",
        "command": "/opt/homebrew/bin/last9-mcp",
        "env": {
          "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
        }
      }
    }
  }
}

For NPM: use "command": "npx" and add "args": ["-y", "@last9/mcp-server@latest"].

After downloading from GitHub Releases, extract and point to the full path:

{
  "mcpServers": {
    "last9": {
      "command": "C:\\Users\\<user>\\AppData\\Local\\Programs\\last9-mcp-server.exe",
      "env": {
        "LAST9_REFRESH_TOKEN": "<your_refresh_token>"
      }
    }
  }
}

The NPM route is easier on Windows — no path management.

export LAST9_REFRESH_TOKEN="your_refresh_token"
export LAST9_HTTP=true
export LAST9_PORT=8080
./last9-mcp-server

Server starts at http://localhost:8080/mcp.

MCP Streamable HTTP requires an initialize handshake first. Don't set Mcp-Session-Id on the first request.

# Step 1: Initialize
SESSION_ID=$(curl -si -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -d '{
      "jsonrpc": "2.0",
      "id": 1,
      "method": "initialize",
      "params": {
        "protocolVersion": "2024-11-05",
        "capabilities": {},
        "clientInfo": {"name": "curl-test", "version": "1.0"}
      }
    }' | grep -i "^Mcp-Session-Id:" | awk '{print $2}' | tr -d '\r')
echo "Session: $SESSION_ID"

# Step 2: Send initialized notification
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Mcp-Session-Id: $SESSION_ID" \
    -d '{"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}'

# Step 3: List tools
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Mcp-Session-Id: $SESSION_ID" \
    -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}}'

# Step 4: Call a tool
curl -s -X POST http://localhost:8080/mcp \
    -H "Content-Type: application/json" \
    -H "Mcp-Session-Id: $SESSION_ID" \
    -d '{
      "jsonrpc": "2.0",
      "id": 3,
      "method": "tools/call",
      "params": {
        "name": "get_service_logs",
        "arguments": {
          "service": "your-service-name",
          "lookback_minutes": 30,
          "limit": 10
        }
      }
    }'

git clone https://github.com/last9/last9-mcp-server.git
cd last9-mcp-server
go build -o last9-mcp-server
LAST9_HTTP=true ./last9-mcp-server

LAST9_HTTP=true is for local development. For actual usage, the hosted HTTP endpoint is easier.

• Absolute times (start_time_iso/end_time_iso, or time_iso) take precedence over lookback_minutes.
• For relative windows: use lookback_minutes.
• For absolute windows: use RFC3339/ISO8601 — 2026-02-09T15:04:05Z.
• Legacy YYYY-MM-DD HH:MM:SS is accepted for compatibility only.

• limit (integer, optional): Max exceptions. Default: 20.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional): Absolute time range.
• service_name (string, optional): Filter by service.
• span_name (string, optional): Filter by span name.
• deployment_environment (string, optional): Filter by environment.

• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• start_time_iso / end_time_iso (string, optional)

All other APM tools require an env value. Use "" if this returns empty.

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• service_name (string, required)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• service_name (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• env (string, optional): Defaults to prod.

• env (string, optional): Filter by environment. Default: all.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)

• db_system (string, optional): e.g. postgresql, mysql, mongodb, redis.
• host (string, optional): Database host (net_peer_name).
• service_name (string, optional): Calling service name.
• env (string, optional)
• min_duration_ms (float, optional): Minimum query duration in ms.
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

• db_system (string, optional)
• host (string, optional)
• service_name (string, optional)
• env (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 20.

• db_system (string, required): e.g. postgresql, mysql, mongodb, redis, aerospike.
• host (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• start_time_iso / end_time_iso (string, optional)

• query (string, required): The PromQL query.
• start_time_iso / end_time_iso (string, optional): Defaults to last 60 min.
• lookback_minutes (float, optional): Default: 60.

• query (string, required)
• time_iso (string, optional): Defaults to now.
• lookback_minutes (float, optional)

• match_query (string, optional): PromQL filter.
• label (string, required): Label name.
• start_time_iso / end_time_iso (string, optional)

• match_query (string, optional): PromQL filter.
• start_time_iso / end_time_iso (string, optional)

• logjson_query (array, required): JSON pipeline query.
• lookback_minutes (integer, optional): Default: 5.
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Server default: 5000.
• index (string, optional): physical_index:<name> or rehydration_index:<block_name>.

• service (string, required)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 20.
• env (string, optional)
• severity_filters (array, optional): e.g. ["error", "warn"]. OR logic.
• body_filters (array, optional): e.g. ["timeout", "failed"]. OR logic.
• start_time_iso / end_time_iso (string, optional)
• index (string, optional)

Multiple filter types combine with AND. Each array uses OR internally.

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)
• index (string, optional)

No parameters.

• name (string, required)
• filters (array, required): Each filter: key, value, operator (equals/not_equals), conjunction (and).

Use for broad searches and aggregations. For exact trace ID lookup, use get_service_traces.

• tracejson_query (array, required)
• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• limit (integer, optional): Default: 5000.

Exactly one of trace_id or service_name is required.

• trace_id (string, optional): Default lookback: 72 hours.
• service_name (string, optional): Default lookback: 60 min.
• lookback_minutes (integer, optional)
• start_time_iso / end_time_iso (string, optional)
• limit (integer, optional): Default: 10.
• env (string, optional)

• lookback_minutes (integer, optional): Default: 15.
• start_time_iso / end_time_iso (string, optional)
• region (string, optional)

• start_time_iso / end_time_iso (string, optional)
• lookback_minutes (integer, optional): Default: 60.
• service (string, optional)
• environment (string, optional)
• event_name (string, optional): Call without this first to get available_event_names.

• search_term (string, optional): Free-text search across name, group, data source, tags.
• rule_name (string, optional)
• severity (string, optional)
• rule_type (string, optional): static or anomaly.
• alert_group_name / alert_group_type / data_source_name (string, optional)
• tags (array, optional): All must match (AND logic).

• time_iso (string, optional): Evaluation time in RFC3339.
• window (integer, optional): Lookback in seconds. Default: 900. Range: 60–86400.
• lookback_minutes (integer, optional): Range: 1–1440.

No parameters. Returns all configured notification channels (Slack, PagerDuty, email, webhooks, etc.).

• query (string, required): The name to search for — partial, misspelled, or abbreviated.
• type (string, optional): Restrict to entity type: service, environment, host, database, k8s_deployment, k8s_namespace, job.

Returns up to 3 closest matches with similarity scores. Use this before any tool call where the entity name is uncertain. If a previous call returned empty results, try this before retrying.