Query CLS Logs from an LLM with CLS MCP Server

When log troubleshooting depends on complex query syntax, the slowest step is often turning an operational question into the right query. The source article introduces the Tencent Cloud Log Service (CLS) MCP Server as a way to connect a large language model to CLS log data through the Model Context Protocol.

The practical goal is simple: let an operator ask a natural-language question, have the MCP Server generate or assist with the query, and then use CLS log topics as the data source.

What the CLS MCP Server is

A Model Context Protocol (MCP) Server is described in the source as a lightweight service program based on the MCP protocol. It connects an LLM with external resources such as databases, APIs, or files through a standardized interface.

For CLS, that external resource is log data stored in CLS log topics.

Core capabilities

The CLS MCP Server in the source article provides three capabilities:

Capability	What it does
Log querying	Queries log data stored in a CLS log topic according to a query statement.
Natural-language query generation	Turns everyday language into a CLS log query statement.
Context-aware helpers	Looks up log topic IDs by topic name, maps region names to region abbreviations, and gets the current timestamp to reduce LLM hallucination during log troubleshooting.

Typical operations scenarios

The article gives three common use cases:

Scenario	Example operator question or workflow
Incident troubleshooting	Analyze current error logs when a system becomes abnormal, then locate the issue faster.
Business insight	Ask questions such as "today's failed user login count" to understand business state in real time.
Security analysis	Ask for suspicious IP access records from the past 24 hours to support security auditing.

Setup prerequisites

The source setup starts with two requirements:

1. Install a Node.js runtime.
2. Create a Tencent Cloud sub-account, grant the required CLS permissions, and obtain SecretId and SecretKey.

Use the following permission policy from the source article:

{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cls:SearchLog",
                "cls:DescribeTopics",
                "cls:ChatCompletions"
            ],
            "resource": ["*"]
        }
    ]
}

Add the MCP configuration

The article uses Cherry Studio as the configuration example.

Use this MCP server configuration and replace the placeholder credentials with your own values:

{
   "mcpServers": {
      "cls-mcp-server": {
          "isActive": true,
          "name": "cls-mcp-server",
          "type": "stdio",
          "registryUrl": "",
          "command": "npx",
          "args": [
              "-y",
              "cls-mcp-server"
           ],
          "env": {
              "TENCENTCLOUD_SECRET_ID": "YOUR_TENCENT_SECRET_ID",
              "TENCENTCLOUD_SECRET_KEY": "YOUR_TENCENT_SECRET_KEY",
              "TENCENTCLOUD_API_BASE_HOST": "tencentcloudapi.com",
              "TENCENTCLOUD_REGION": "ap-guangzhou",
              "MAX_LENGTH": "15000"
            }
        }
    }
}

The important operational detail is that the LLM is not only receiving a static prompt. The MCP Server can also call CLS-related helper functions, such as topic lookup and region lookup, before it runs a log query.

Dify Tool vs MCP Server

The source article also compares the existing CLS Dify Tool with the CLS MCP Server.

Function	Dify Tool	MCP Server
Query logs	Supported	Supported
Generate log query statements from natural language	Not supported. The article says it depends on prompt-based generation by the LLM, with lower accuracy.	Supported
Query log topic ID by log topic name	Not supported	Supported
Query region abbreviation by region name	Not supported	Supported
Get current timestamp	Not supported	Supported

Reusable implementation checklist

Use this checklist when you adapt the setup:

1. Confirm the target CLS log topic and region.
2. Create or select a Tencent Cloud sub-account.
3. Grant only the actions shown in the source policy: cls:SearchLog, cls:DescribeTopics, and cls:ChatCompletions.
4. Add the MCP server configuration to the LLM client.
5. Replace TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY, and TENCENTCLOUD_REGION.
6. Ask a narrow operational question first, such as an error-log query or a failed-login query.
7. Check whether the generated query and returned log topic context match the intended target.

FAQ

What problem does the CLS MCP Server solve?

It helps an LLM understand operational log-analysis requests by connecting the model to CLS log query capability and CLS context helpers.

Which CLS permissions are required in the source article?

The source policy grants cls:SearchLog, cls:DescribeTopics, and cls:ChatCompletions.

Why is topic and region lookup useful?

The source article says these helpers make it faster to locate the required log topic and reduce LLM hallucination when generating or running log queries.