Sumo Logic MCP

Sumo Logic MCP is the vendor built Model Context Protocol server for the Sumo Logic observability and security platform. It gives an AI client a structured way to run log searches across time ranges using the same aggregation and filtering syntax analysts use in the product, and to discover what is actually searchable by listing custom fields, field extraction rules and partitions before a query gets written. Beyond search, the server covers the alerting and reporting surface. An agent can look up alerts filtered by status, severity, monitor name or mute state, pull alert and folder details by ID, and create, read, update or list dashboards including panels backed by log search queries. A separate Cloud SIEM tool group handles security work: filtering insights by severity, status, assignee or entity, updating insight status and assignment, and creating or retrieving match and threshold detection rules. Authentication runs over OAuth 2.0, with Client ID Metadata Document support for clients that handle it and authorization code or client credentials flows for everything else. Every tool call stays bound by the role based access controls the account already enforces, so an assistant cannot read or change anything the connected user could not reach in the console. It fits SREs, detection engineers and incident responders who want conversational triage and dashboard building without leaving the assistant.