LogTriage
Security log tools: Windows/Entra error codes, log explainer, IP blocklists, attack scans
What it does
LogTriage is an MCP server, a connector that lets an AI assistant use it as a tool. It is hosted: an assistant connects to it over the internet, nothing to install.
No capability identified yet from its description.
Facts come from the Official MCP Registry, as declared by the publisher. Capabilities are matched automatically (low confidence). None of this is a test of the tool.
At a glance
How to connect
As declared in the Official MCP Registry · hosted endpoint tested by Electra Index 13h ago (live check)Hosted endpoint
https://api.logtriage.app/mcpstreamable-http
In Claude Code: claude mcp add --transport http logtriage https://api.logtriage.app/mcp
MCP settings (Claude Desktop, Cursor and other MCP clients)
{
"mcpServers": {
"logtriage": {
"url": "https://api.logtriage.app/mcp"
}
}
}Live check
Electra Index connected to the hosted endpoint 13h agoONLINE LogTriage answered an MCP connection on 05 Nov 2026 and introduced itself as logtriage 1.0.0 (MCP protocol 2025-06-18).
7 tools offered to AI assistants
lookup_error_code· Explains Microsoft authentication error codes from Microsoft's official tables: Entra ID sign-in errors (AADSTS50126, or the bare 50126), Windows NTSTATUS codes as logged in events 4625/4776 (0xC000006A, C000006A, or decimal 3221225578 / -1explain_log_record· Identifies the format of one log record (access-log line, syslog/auth.log line, Windows event XML, CloudTrail, Entra ID, CrowdStrike, firewall, CEF/LEEF and more) and lists every field with what it means and where that meaning comes from (Lcheck_ip_blocklists· Checks IPv4 addresses against 12 free public blocklists (IPsum, FireHOL levels 1-3, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, ET compromised, Tor exits), the same lists as logtriage.app's IP blocklist checker. Accepts a liscan_log_for_attacks· Detects the log format (50+ formats: web access logs, auth.log, Windows events, Sysmon, CloudTrail, Entra ID, Okta, Kubernetes audit, firewalls, EDR exports and more) and runs LogTriage's deterministic attack checks: brute force and passworsearch_reference· Finds LogTriage's reference pages for an investigation: Windows Security event IDs, Entra AADSTS, NTSTATUS and Kerberos codes, AWS CloudTrail events (ConsoleLogin, AssumeRole...), CrowdStrike Falcon events (ProcessRollup2...), sshd/PAM loganalyze_log_file· Runs LogTriage's full analysis on a log: parsing (50+ formats), threat-intelligence enrichment of addresses, user agents and hashes, risk scoring, attack-pattern detection and an AI-written incident report with indicators, MITRE ATT&CK mappget_analysis· Returns the status and, once complete, the incident report of an analysis started with analyze_log_file: severity, attack pattern, executive summary, detected patterns, indicators, MITRE ATT&CK techniques, remediation steps and a link to th
What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method
Is this your server? Monitoring Pro: a check every 30 minutes and an email within the hour when it stops answering. Launch offer: $39.99 once, for life.
Facts & evidence
Each fact shows where it was seen and when.| Fact | Value | Evidence | Source | Last confirmed |
|---|---|---|---|---|
| Hosted endpoint | https://api.logtriage.app/mcp | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| Local install (package) | no | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| Remote access (hosted) | yes | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| Website | https://logtriage.app/tools/mcp-server/ | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| Registry status | active | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| Version | 1.0.0 | DECLARED | SRC-001 Official MCP Registry | 13h ago |
| MCP server | yes | DECLARED | SRC-001 Official MCP Registry | 13h ago |
Change history
- NEW05 Nov 2026first seen in the index
Is this page accurate?
Flag it and our robot re-checks the official source. Reports never change a score.Is LogTriage still online?
Free alerts · no account▲ 0Do you run LogTriage? Know when it stops answering
For publishers · optionalIts hosted endpoint can be monitored. Monitoring Pro connects every 30 minutes like an AI assistant, emails you within the hour when it stops answering, keeps a 90-day availability history and adds your answer rate to your badge.
Monitoring never changes a score or a rank.
Are you the publisher of LogTriage?
Free · show your listingAn independent listing builds trust with your buyers. Announce it, and add the badge to your website or README.
<a href="https://electraindex.com/mcp/logtriage?utm_source=badge&utm_medium=share&utm_campaign=listing"><img src="https://electraindex.com/api/badge/logtriage" alt="Listed on Electra Index"></a>Questions about LogTriage
How do I connect LogTriage?
Use the hosted endpoint https://api.logtriage.app/mcp in your assistant's MCP settings. The exact settings are in "How to connect" above, as declared in the Official MCP Registry.
What tools does LogTriage offer?
When Electra Index connected on 05 Nov 2026, it listed 7 tools: lookup_error_code, explain_log_record, check_ip_blocklists, scan_log_for_attacks, search_reference, analyze_log_file, get_analysis. The full list is in "Live check" above.
Is LogTriage online?
Yes. Its hosted endpoint answered an MCP connection from Electra Index 13h ago.