Coding agents (MCP)

Connecting to the MCP server

A coding agent can read the account's logs through SaneLog's MCP server at https://app.sanelog.com/mcp. That covers Claude Code, Codex CLI, Cursor, VS Code, Gemini CLI, Windsurf, Claude Desktop, claude.ai, and any other client that speaks Streamable HTTP.

Once connected, the agent can read every source and every event within retention, as you can on screen. The server also tells the agent how to investigate: what to look at first, how to narrow down and when to widen.

No token is needed:

1. You give the agent the server's address.
2. The agent opens an approval page in your browser, once.
3. You approve it, and the agent reads as you from then on.

Open Agents in the sidebar to see the address, the setup for each client with a Copy button on every snippet, and a few prompts to try once the agent is connected.

A script, a pipeline or a headless agent cannot approve a connection in a browser, so it reads through the API with a token instead. See the API reference.

Setup by client

Every client ends at the same approval page, so the entries differ only in how the address is handed over.

Claude Code

In a terminal, in the project the agent works on:

claude mcp add --transport http sanelog https://app.sanelog.com/mcp

Then /mcp inside Claude Code opens the approval page in the browser. Approving connects the agent, and its tools appear on the next prompt.

Codex CLI

In a terminal, add the server and then sign in to it:

codex mcp add sanelog --url https://app.sanelog.com/mcp
codex mcp login sanelog

The login command opens the approval page in the browser. Approving connects the agent.

Cursor

In ~/.cursor/mcp.json for every project, or .cursor/mcp.json inside one project:

{
  "mcpServers": {
    "sanelog": {
      "url": "https://app.sanelog.com/mcp"
    }
  }
}

Cursor opens the approval page in the browser when the server is first used. Approving connects the agent.

VS Code

In .vscode/mcp.json inside the project (the top-level key is servers, and the type is named):

{
  "servers": {
    "sanelog": {
      "type": "http",
      "url": "https://app.sanelog.com/mcp"
    }
  }
}

Starting the server from the file opens the approval page in the browser. Approving connects the agent.

Gemini CLI

In a terminal:

gemini mcp add --transport http sanelog https://app.sanelog.com/mcp

Gemini CLI opens the approval page in the browser on its first call. Approving connects the agent.

Windsurf

In ~/.codeium/windsurf/mcp_config.json (the URL key is serverUrl):

{
  "mcpServers": {
    "sanelog": {
      "serverUrl": "https://app.sanelog.com/mcp"
    }
  }
}

Windsurf opens the approval page in the browser when the server is first used. Approving connects the agent.

Claude Desktop and claude.ai

Under Settings > Connectors, choose Add custom connector, name it SaneLog and paste the server URL:

https://app.sanelog.com/mcp

Connecting opens the approval page in the browser. Approving connects the agent, and the connector is available in every chat.

Other clients

Any MCP client that speaks Streamable HTTP with OAuth can connect with the URL alone. Most clients take it as JSON:

{
  "mcpServers": {
    "sanelog": {
      "url": "https://app.sanelog.com/mcp"
    }
  }
}

The client discovers the authorization server from the first response and opens the approval page in the browser. Approving connects the agent.

Prompts to try

Each of these runs a whole investigation, so you see what the connection does:

• What started going wrong in production in the last hour?
• Which sources have gone quiet today, and when did each fall silent?
• What triggered the alerts overnight, and what was happening around each one?
• Find the top error of the last 6 hours, show its first occurrences and what else happened around them.

What a connected agent can do

The agent's tools are the read API's endpoints, one tool each and with the same parameter names:

• the account's sources, saved filters and attribute fields
• a search over events, and one event with its attributes
• the context around an event or a moment
• histograms, facets, and a summary of what is being logged and what changed
• the alerts and incidents

The API reference describes each one.

The agent can only read. Filters, alerts, sources and tokens are changed by a person in SaneLog.

An agent that has never seen SaneLog can start from https://app.sanelog.com/llms.txt. It introduces SaneLog - what it holds, how an agent reads it and the ground rules - and links to every page of this documentation as Markdown. What a pasted Copy for agent block contains is under Agent handoffs. Adding .md to a documentation page's address gives the Markdown, such as https://app.sanelog.com/docs/alerts.md. The documentation is public, so an agent can read it without logging in.

Handing an event or an incident to an agent

Copy for agent in the Log Explorer and on every incident page copies an event or an incident with what happened around it, ready to paste into the agent's chat. Agent handoffs describes what the block holds.

An alert email names its incident by uuid, so a connected agent can be asked to look into that incident straight from the inbox. The email links to this page for an agent that is not connected yet.

A connected agent can then look further on its own: fetch more context, check other sources, compare with yesterday.

Managing connected agents

Under Your connected agents, the Agents page lists every agent connected as you, with when it connected and when it last read. Removing an agent there stops it on its next call. The same list is under User settings > Connected agents.

Account Admins also see the agents connected by every user of the account, under Across the account.

A deactivated user's agents stop on their next call. Connections, removals, handoffs and token changes are recorded in the audit log.

Until an agent is connected, the dashboard shows a callout that leads to the Agents page. The callout can be closed.