Cribl MCP

Cribl's MCP server exposes a telemetry pipeline deployment to an AI client, so an engineer can ask about routing and health in natural language rather than reading through configuration screens. It surfaces the core objects of a Cribl deployment: sources, destinations, worker groups and pipelines, along with metrics, alerts and system configuration. That lets an agent trace how a given event stream is collected, transformed and delivered, and where volume is being added or dropped. Beyond configuration inspection, it reaches Cribl Search, so an agent can build and refine queries, run them, and create or update search notebooks that keep an investigation reproducible for the next person. That combination covers the two questions that dominate observability pipeline work: where is this data going, and why did the volume or the shape of it change. Authentication uses a Cribl bearer token, and each tool call executes with the identity and role-based permissions of the connected user, so the existing Cribl access model governs what an agent can see rather than a separate permission system layered on top. The server is built into the Cribl Leader and supports cloud, on-premises and hybrid deployments. It fits observability and security engineering teams who own log routing, data reduction and telemetry cost control across large estates.