[{"_1":2,"_194":-5,"_195":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_170":171},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":84,"_106":107,"_163":-5,"_164":11,"_165":17,"_166":11,"_167":-5,"_168":169},"canonicalUrl","https://hub.docker.com/r/cribl/cribl-mcp-server/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","cribl","reponame","cribl-mcp-server","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":-5,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2025-09-17T21:10:38.543267Z","description","","is_private","last_updated","2026-07-31T20:15:02.186142Z","last_modified","2026-03-10T23:41:06.729113Z","media_types",[51],"application/vnd.oci.image.index.v1+json","name","pull_count",3807,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Cribl MCP Server\n\n### Work with the Cribl MCP Server\n\nLearn how to configure and use the Cribl MCP server, an AI-native way to interact with your [Cribl.Cloud](https://cribl.cloud) or [On-Prem](https://docs.cribl.io/stream/deploy-types/) Cribl environment.\n\n---\n\n#### Overview\n\nThe Cribl MCP server can help you gain insight into your [Cribl.Cloud](https://cribl.cloud) or [On-Prem](https://docs.cribl.io/stream/deploy-types/) environment by investigating your Sources, Destinations, Worker Groups, and system health through an [MCP client](https://modelcontextprotocol.io/) of your choice. The Cribl MCP server is self-hosted and can run locally or in the cloud, depending on the needs of your organization.\n\n#### Prerequisites\n\n* Cribl environment ([On-Prem](https://docs.cribl.io/stream/deploy-types/), [cloud](https://docs.cribl.io/cribl-cloud/) or [hybrid](https://docs.cribl.io/stream/hybrid-deployment/))\n* MCP client (such as Cursor, Claude Desktop, GitHub Copilot, Windsurf, or LibreChat)\n* Docker container (if you want to host locally)\n* AWS account (if you want to host in AWS)\n* Amazon ECS or Amazon ECS Anywhere (if you want to host in AWS)\n* Access to port 3030\n\n#### Set Up Your Target Environment and MCP Clients\n\nFor demonstration purposes, this guide will use a Cribl MCP server hosted locally through Docker, with Cursor as the MCP client.\n\nStart by downloading the Cribl MCP server image. Depending on where you want to host your server, you can get the container image from Docker Hub or the AWS Marketplace.\n\n* [Docker Hub](https://hub.docker.com/r/cribl/cribl-mcp-server)\n* [AWS Marketplace](https://aws.amazon.com/marketplace)\n\nRun the image in a container on your platform of choice. The Cribl MCP server requires certain environment variables to be set for the container, as described in the following table.\n\n| Variable Name | Required | Description | Information Source |\n| --------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |\n| CRIBL_BASE_URL | Yes | The base URL for your target Cribl environment. | [Cribl](https://docs.cribl.io/cribl-as-code/api/#base-urls) |\n| CRIBL_CLIENT_ID | Yes | The first component of the Cribl API credential. Must be created by an admin or owner. | [Cribl API Auth](https://docs.cribl.io/cribl-as-code/api-auth/) |\n| CRIBL_CLIENT_SECRET | Yes | The first component of the Cribl API credential. Must be created by an admin or owner. | [Cribl API Auth](https://docs.cribl.io/cribl-as-code/api-auth/) |\n| MCP_API_KEY | No | A self-created API key to restrict access to your MCP server. Recommended if hosting in AWS or shared environments. | User created and managed |\n| aws_account_id | Yes (for AWS) | Your target AWS account ID if hosting in AWS | [AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html) |\n| aws_region | Yes (for AWS) | Your target AWS region if hosting in AWS. | [AWS ECS](https://docs.aws.amazon.com/general/latest/gr/ecs-service.html) |\n\nWhen you have the information needed to populate the necessary environment variables, run your Cribl MCP server in your chosen container using one of the following terminal commands:\n\n##### Docker (local)\n\n```bash\ndocker run -p 3030:3030 \\\n -e CRIBL_BASE_URL= \\\n -e CRIBL_CLIENT_ID= \\\n -e CRIBL_CLIENT_SECRET= \\\n -e MCP_API_KEY= \\\n cribl/cribl-mcp-server\n\n```\n\n##### AWS ECS\n\n```bash\ndocker run -p 3030:3030 .dkr.ecs..amazonaws.com/cribl/cribl-mcp-server\n-e CRIBL_BASE_URL= \n-e CRIBL_CLIENT_ID=\n-e CRIBL_CLIENT_SECRET=\n-e MCP_API_KEY= \ncribl-mcp\n\n```\n\nYou should see the following responses from your container hosting platform, confirming that your Cribl MCP server is successfully running:\n\n```bash\n[2025-11-04T17:00:45.965Z] INFO Configuration validated successfully {\"baseUrl\":\"\"}\n[2025-11-04T17:00:45.966Z] INFO Registering MCP tools...\n[2025-11-04T17:00:45.966Z] INFO MCP tools registered successfully\n[2025-11-04T17:00:45.969Z] INFO MCP Stateless Streamable HTTP Server listening on port 3030\n\n```\n\n#### Configure Your MCP Client\n\nThe Cribl MCP server is treated as a local MCP server, even if it is running in an ECS instance. For your chosen MCP client, add the following Cribl MCP server details to the client's mcp.json file:\n\n```bash\n{\n \"mcpServers\": { \n \"cribl-mcp-remote\": { \n \"command\": \"npx\", \n \"args\": [ \"-y\", \"mcp-remote\", \"http://localhost:3030/mcp\", \"--transport\", \"http\" ] \n } \n }\n}\n\n```\n\nAfter successful configuration, your client should surface the following tools for the Cribl MCP Server:\n\n| Tool | Description |\n| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| cribl_getSystemMetrics | Retrieve system metrics with optional filtering. |\n| cribl_listWorkerGroups | List all Worker Groups in the deployment. |\n| cribl_getSources | Get Source configurations for a Worker Group. |\n| cribl_getDestinations | Get Destination configurations for a Worker Group. |\n| cribl_listDatasets | List all available Search Datasets in the deployment. |\n| cribl_getSavedSearches | Get all saved searches from the deployment. |\n| cribl_runSearchQuery | Execute a search query from a natural language description. Automatically generates the appropriate KQL query, executes it, and returns results with the generated query included for transparency. |\n| cribl_getSearchJobResults | Retrieve results for a specific search job by job ID. |\n| cribl_getSearchJobs | Get a list of search jobs (default: 25). |\n| cribl_getSearchNotebooks | Get all Search Notebooks from the deployment. |\n| cribl_addToSearchNotebook | Add a search query to a Search Notebook (creates new Notebook or updates existing one). |\n| cribl_getAlerts | Get alerts and system messages with filtering and pagination support. |\n\nYou can access each of these tools through your MCP client to gain insights on and interact with your Cribl environment.\n\n#### Use Case Examples\n\nThe Cribl MCP server provides an AI-native approach to interacting with your Cribl environment. When evaluating how to best use your Cribl MCP, consider the following use cases as a reference.\n\n| Use Case | Sample Prompt | Value |\n| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |\n| Cribl environment health | \"What's the current health of my Cribl environment? Highlight any areas of concern or action items I need to consider.\" | Coalesces health information across your Cribl environment into a digestible summary with clear action items. |\n| Cribl Source and Destination overview | \"What Sources and Destinations do I have in my environment? Are there any I should pay specific attention to?\" | Provides a comprehensive overview of active and unused Sources and Destinations across your environment. |\n| Cribl Worker Group overview | \"What's the processing status of my Worker Groups?\" | Provides cross-worker group visibility into key items like throughput, health, and configuration settings, with improvement recommendations. |","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",743289519,"orgData",{"_85":86,"_87":88,"_89":90,"_91":28,"_92":28,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":43,"_104":43,"_105":17},"id","bd3d3897676848c3802d8b79b17f6dce","uuid","bd3d3897-6768-48c3-802d-8b79b17f6dce","type","organization","orgname","full_name","location","San Francisco","company","cribl.io","profile_url","https://www.cribl.io/","date_joined","2018-07-30T21:49:20.636067Z","gravatar_url","https://www.gravatar.com/avatar/1af1dca108f335b65b0541112e9eba06?s=80&r=g&d=mm","gravatar_email","badge","is_active","recentTags",[108],{"_109":39,"_110":111,"_112":113,"_114":115,"_85":116,"_117":118,"_45":150,"_151":111,"_152":153,"_154":51,"_52":155,"_156":157,"_158":159,"_160":150,"_161":61,"_162":17},"content_type","creator",3655990,"digest","sha256:8e6b48ac8db2a1a20ea56c4f211bdd24ac18ffdc71d76ff177344724f240b7be","full_size",58907955,974944213,"images",[119,134,140,146],{"_120":121,"_112":122,"_123":43,"_124":125,"_126":127,"_128":129,"_130":43,"_131":-5,"_132":115,"_58":61,"_133":-5},"architecture","amd64","sha256:b0fedff76d203207127d6955b9dab15e79ba0d0b0196322607064df4f9ad165c","features","last_pulled","2026-09-16T09:05:23.32775765Z","last_pushed","2026-07-31T20:14:59.671626117Z","os","linux","os_features","os_version","size","variant",{"_120":135,"_112":136,"_123":43,"_124":137,"_126":138,"_128":129,"_130":43,"_131":-5,"_132":139,"_58":61,"_133":-5},"arm64","sha256:71b9bf4fdeeb0927d297f1069093912a4c82cbbe9b6239c05f788da7d4d6efc6","2026-09-16T00:55:36.799171126Z","2026-07-31T20:14:59.056382995Z",59058851,{"_120":141,"_112":142,"_123":43,"_124":143,"_126":144,"_128":141,"_130":43,"_131":-5,"_132":145,"_58":61,"_133":-5},"unknown","sha256:0ad626c135e1beba4f599cd776ec4a3449f8610e1dacf03d2706e5ad4d5b36cb","2026-09-14T08:02:47.618478813Z","2026-07-31T20:15:00.24824691Z",1286,{"_120":141,"_112":147,"_123":43,"_124":148,"_126":149,"_128":141,"_130":43,"_131":-5,"_132":145,"_58":61,"_133":-5},"sha256:a36d607c83131baa0c143efb8b8282ddf770b91c9282ad0c3256ad23c6d1f329","2026-09-14T20:26:36.91822794Z","2026-07-31T20:15:00.669177036Z","2026-07-31T20:15:01.380848Z","last_updater","last_updater_username","criblci","media_type","latest","repository",28599061,"tag_last_pulled","2026-09-16T11:41:11.215629161Z","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":172,"_179":180,"_168":192,"_193":11},{"_35":173,"_37":174,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":175,"_52":30,"_27":28,"_53":54,"_55":-5,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":176,"_74":11,"_75":178,"_80":28,"_81":82},[],[39],[51],{"_70":11,"_71":177},[73],{"_77":17,"_78":11,"_79":11},"tags",{"_181":59,"_182":-5,"_183":-5,"_184":185},"count","next","previous","results",[186],{"_109":39,"_110":111,"_112":113,"_114":115,"_85":116,"_117":187,"_45":150,"_151":111,"_152":153,"_154":51,"_52":155,"_156":157,"_158":159,"_160":150,"_161":61,"_162":17},[188,189,190,191],{"_120":121,"_112":122,"_123":43,"_124":125,"_126":127,"_128":129,"_130":43,"_131":-5,"_132":115,"_58":61,"_133":-5},{"_120":135,"_112":136,"_123":43,"_124":137,"_126":138,"_128":129,"_130":43,"_131":-5,"_132":139,"_58":61,"_133":-5},{"_120":141,"_112":142,"_123":43,"_124":143,"_126":144,"_128":141,"_130":43,"_131":-5,"_132":145,"_58":61,"_133":-5},{"_120":141,"_112":147,"_123":43,"_124":148,"_126":149,"_128":141,"_130":43,"_131":-5,"_132":145,"_58":61,"_133":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
b0fedff76d20	linux/amd64	56.18 MB
71b9bf4fdeeb	linux/arm64	56.32 MB

cribl/cribl-mcp-server

Tags for cribl/cribl-mcp-server