@mgcrea/mcp-loki 0.0.0 → 0.1.0

package/dist/server-B2TOeJ3P.js

@@ -0,0 +1,1593 @@
+import { McpServer } from "@modelcontextprotocol/server";
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+// src/build-info.ts
+const readPackageJson = () => {
+	try {
+		const pkgUrl = new URL("../package.json", import.meta.url);
+		return JSON.parse(readFileSync(pkgUrl, "utf8"));
+	} catch {
+		return {
+			name: "@mgcrea/mcp-loki",
+			version: "0.0.0"
+		};
+	}
+};
+const pkg = readPackageJson();
+const BUILD_INFO = {
+	name: pkg.name,
+	version: pkg.version,
+	gitCommit: "24221ba",
+	gitCommitDate: "2026-11-04T10:22:14+01:00"
+};
+// src/config.ts
+const ConfigSchema = z.object({
+	/**
+	* The Loki base URL: the gateway, query-frontend or single binary, including
+	* any path prefix it is mounted under. API paths are appended to it, so
+	* `https://host/loki-prefix` reaches `https://host/loki-prefix/loki/api/v1/query`.
+	*/
+	url: z.url().optional(),
+	username: z.string().min(1).optional(),
+	password: z.string().min(1).optional(),
+	token: z.string().min(1).optional(),
+	/**
+	* Sent as `X-Scope-OrgID`. Needed when talking to Loki directly with
+	* `auth_enabled: true`; behind the Loki chart's nginx gateway with basic
+	* auth it is NOT needed, because the gateway sets it from the username.
+	*/
+	tenantId: z.string().min(1).optional(),
+	/** Extra request headers, e.g. a Cloudflare Access service token. */
+	headers: z.record(z.string(), z.string()).default({}),
+	/** Seconds. Bounds every HTTP request; Loki's own query_timeout applies server-side. */
+	timeoutSeconds: z.number().positive().max(600).default(60),
+	maxRetries: z.number().int().nonnegative().max(10).default(2),
+	/**
+	* Problems found while reading the environment. Deliberately data, not a
+	* thrown error: an MCP server that exits on startup shows up in the client
+	* as a bare "Connection closed", with stderr swallowed, so the one message
+	* that would have explained the problem never reaches anyone. These are
+	* reported through loki_auth_status instead.
+	*/
+	problems: z.array(z.string()).default([])
+}).strict();
+const parseNumber = (value) => {
+	const t = trimmed(value);
+	if (t === void 0) return void 0;
+	const n = Number(t);
+	return Number.isFinite(n) ? n : void 0;
+};
+/** Maps "" to undefined, so an empty env var means "unset" rather than "empty". */
+const trimmed = (value) => {
+	const t = value?.trim();
+	return t ? t : void 0;
+};
+const parseHeaders = (value, problems) => {
+	const t = trimmed(value);
+	if (t === void 0) return void 0;
+	try {
+		const parsed = JSON.parse(t);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && Object.values(parsed).every((v) => typeof v === "string")) return parsed;
+	} catch {}
+	problems.push("LOKI_HEADERS must be a JSON object of string values, e.g. {\"CF-Access-Client-Id\":\"...\"}.");
+};
+/**
+* Environment only: the server persists nothing of its own, so there is no
+* config file to merge with.
+*/
+const loadConfig = (env = process.env) => {
+	const problems = [];
+	let url = trimmed(env.LOKI_URL);
+	if (url !== void 0) try {
+		const parsed = new URL(url);
+		if (parsed.username || parsed.password) {
+			problems.push("LOKI_URL contains credentials. Move them to LOKI_USERNAME and LOKI_PASSWORD, which are never echoed back.");
+			url = void 0;
+		} else if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+			problems.push(`LOKI_URL must be http(s), got ${parsed.protocol}`);
+			url = void 0;
+		}
+	} catch {
+		problems.push("LOKI_URL is not a valid URL, e.g. https://loki.example.com");
+		url = void 0;
+	}
+	const username = trimmed(env.LOKI_USERNAME);
+	const password = trimmed(env.LOKI_PASSWORD);
+	const token = trimmed(env.LOKI_TOKEN);
+	if (username === void 0 !== (password === void 0)) problems.push("Set both LOKI_USERNAME and LOKI_PASSWORD for basic auth, or neither.");
+	if (token !== void 0 && (username !== void 0 || password !== void 0)) problems.push("LOKI_TOKEN and LOKI_USERNAME/PASSWORD are both set; keep only one.");
+	const timeoutSeconds = parseNumber(env.LOKI_TIMEOUT);
+	const maxRetries = parseNumber(env.LOKI_MAX_RETRIES);
+	return ConfigSchema.parse({
+		url,
+		username,
+		password,
+		token,
+		tenantId: trimmed(env.LOKI_TENANT_ID),
+		headers: parseHeaders(env.LOKI_HEADERS, problems),
+		timeoutSeconds: timeoutSeconds !== void 0 && timeoutSeconds > 0 && timeoutSeconds <= 600 ? timeoutSeconds : void 0,
+		maxRetries: maxRetries !== void 0 && Number.isInteger(maxRetries) && maxRetries >= 0 && maxRetries <= 10 ? maxRetries : void 0,
+		problems
+	});
+};
+const authMode = (config) => config.token ? "bearer" : config.username && config.password ? "basic" : "none";
+/** A URL and no contradictions. A local Loki needs no auth, so none is required. */
+const isConfigured = (config) => Boolean(config.url) && config.problems.length === 0;
+/**
+* Which tenant's logs every answer comes from. Loki never echoes it back — no
+* endpoint says "you are tenant X" — so this is what the server sends or what
+* the gateway is known to derive, and it is labelled as such.
+*
+* The Loki chart's nginx gateway with basicAuth sets `X-Scope-OrgID` from the
+* basic-auth username and overwrites any header the client sent (observed on
+* Loki 3.7.9 / chart 20.2.1: a bogus X-Scope-OrgID still answered with the
+* user's tenant). So with basic auth the username is the tenant, and a
+* LOKI_TENANT_ID beside it is probably ignored.
+*/
+const resolveTenant = (config) => {
+	if (config.tenantId) return {
+		tenant: config.tenantId,
+		source: authMode(config) === "basic" ? "LOKI_TENANT_ID (sent as X-Scope-OrgID; a gateway that maps the basic-auth username may override it)" : "LOKI_TENANT_ID (sent as X-Scope-OrgID)"
+	};
+	if (authMode(config) === "basic" && config.username) return {
+		tenant: config.username,
+		source: "basic-auth username (the Loki chart gateway sets X-Scope-OrgID from it)"
+	};
+};
+/** Returned by loki_auth_status and printed to stderr at startup. */
+const setupInstructions = (config) => [...config.problems, ...config.url || config.problems.some((p) => p.startsWith("LOKI_URL")) ? [] : ["Set LOKI_URL to the Loki base URL (e.g. https://loki.example.com, the gateway or query-frontend, including any path prefix), then restart the server. Add LOKI_USERNAME and LOKI_PASSWORD for basic auth (behind the Loki chart's gateway the username is the tenant), or LOKI_TOKEN for a bearer token. Set LOKI_TENANT_ID when talking to a multi-tenant Loki directly."]];
+// src/client/auth.ts
+/**
+* The headers every request carries. Loki has no login of its own: basic or
+* bearer auth satisfies whatever sits in front of it (the chart's nginx
+* gateway, an ingress, Grafana Cloud), and `X-Scope-OrgID` picks the tenant
+* when Loki runs with `auth_enabled: true`. Nothing to refresh, so a 401 is
+* always final.
+*/
+const authHeaders = (config) => {
+	const mode = authMode(config);
+	const auth = mode === "bearer" ? { Authorization: `Bearer ${config.token}` } : mode === "basic" ? { Authorization: `Basic ${Buffer.from(`${config.username}:${config.password}`).toString("base64")}` } : {};
+	const tenant = config.tenantId ? { "X-Scope-OrgID": config.tenantId } : {};
+	return {
+		...auth,
+		...tenant,
+		...config.headers
+	};
+};
+// src/client/errors.ts
+var LokiApiError = class extends Error {
+	name = "LokiApiError";
+	/** HTTP status, or 0 when no response arrived at all (DNS, TLS, timeout). */
+	status;
+	/**
+	* What to do about it, kept separate from `message`: the message says what
+	* happened, the remedy is the half a model should act on, and fail() lifts it
+	* to a top-level field so it is not buried inside the upstream text.
+	*/
+	remedy;
+	errors;
+	constructor(message, opts) {
+		super(message);
+		this.status = opts.status;
+		this.remedy = opts.remedy;
+		this.errors = opts.errors;
+	}
+};
+// src/client/loki.ts
+const LONG_URL = 4e3;
+const backoffMs = (attempt) => Math.min(500 * 2 ** attempt, 4e3);
+const retryAfterMs = (res) => {
+	const header = res.headers.get("Retry-After");
+	if (header === null) return void 0;
+	const seconds = Number(header);
+	return Number.isFinite(seconds) ? Math.min(Math.max(seconds, 0), 30) * 1e3 : void 0;
+};
+const encodeParams = (params = {}) => {
+	const search = new URLSearchParams();
+	for (const [k, v] of Object.entries(params)) {
+		if (v === void 0) continue;
+		for (const item of Array.isArray(v) ? v : [v]) search.append(k, String(item));
+	}
+	return search;
+};
+const isHtml = (value) => /^\s*</.test(value);
+const isEnvelope = (value) => typeof value === "object" && value !== null && "status" in value && (value.status === "success" || value.status === "error");
+/**
+* What to do about a failed request — the half of an error a model acts on.
+* Loki's error text is specific, so it is read before the status.
+*/
+const remedyFor = (status, text = "") => {
+	if (/at least one (regexp or )?equality matcher|empty-compatible value/.test(text)) return "Every selector needs one matcher that cannot match the empty string: `{app=~\".+\"}`, not `{app=~\".*\"}` or `{}`. Use loki_list_labels / loki_list_label_values to find one.";
+	if (/parse error/.test(text)) return "The LogQL does not parse; the position is line:col into the expression. String values need double quotes or backticks (`{app=\"api\"}`), and a metric query wraps a range: `count_over_time({app=\"api\"} |= \"error\" [5m])`. Fix it rather than retrying.";
+	if (/not supported as an instant query/.test(text)) return "That is a log query, not a metric query. Use loki_query_logs for log lines.";
+	if (/query time range exceeds the limit|max_query_length/.test(text)) return "The range is longer than this Loki allows (see limits in loki_auth_status). Shorten start..end.";
+	if (/max entries limit|max_entries_limit/.test(text)) return "Lower limit, and page with the `next` cursor instead of asking for everything at once.";
+	if (/maximum (number )?of series|max_query_series/.test(text)) return "The query produces more series than allowed. Aggregate (`sum by (namespace) (...)`), add label matchers, or drop high-cardinality labels with `without(pod)`.";
+	if (/max_query_bytes_read|bytes read/.test(text)) return "The query would read more data than allowed. Narrow the selector or shorten the range.";
+	if (/context deadline exceeded|timeout|timed out/i.test(text) || status === 504) return "The query ran out of time. Narrow the stream selector with more label matchers, shorten the range, and put line filters (|= \"...\") before parsers (| json).";
+	if (status === 401) return "The credentials were rejected. Check LOKI_USERNAME / LOKI_PASSWORD (basic auth; behind the Loki chart gateway the username is the tenant) or LOKI_TOKEN (bearer).";
+	if (/no org id|X-Scope-OrgID/i.test(text)) return "This Loki is multi-tenant and no tenant was sent. Set LOKI_TENANT_ID.";
+	if (status === 403) return "Authenticated, but not allowed to reach this endpoint.";
+	if (status === 404) return "Not found. Check that LOKI_URL includes any path prefix. Some endpoints only exist when their component is enabled (the ruler, the pattern ingester, volume_enabled), and a gateway may not route every path.";
+	if (status === 429) return "Rate limited or too many outstanding requests. Wait a moment before calling again.";
+};
+/**
+* Only failures a retry can fix: 429 and a proxy's 502/503. Never a 504 — on
+* Loki that is almost always a slow query, and retrying it triples the load
+* that caused it.
+*/
+const retryable = (status) => status === 429 || status === 502 || status === 503;
+var LokiClient = class {
+	baseUrl;
+	timeoutSeconds;
+	headers;
+	maxRetries;
+	userAgent;
+	fetchImpl;
+	logger;
+	constructor(opts) {
+		this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+		this.headers = opts.headers;
+		this.timeoutSeconds = opts.timeoutSeconds;
+		this.maxRetries = opts.maxRetries;
+		this.userAgent = opts.userAgent;
+		this.fetchImpl = opts.fetch ?? fetch;
+		this.logger = opts.logger;
+	}
+	async get(path, params, headers) {
+		return this.request("GET", path, {
+			params,
+			...headers ? { headers } : {}
+		});
+	}
+	/** A read on an endpoint that also takes a form POST: GET unless the URL would be too long. */
+	async read(path, params, headers) {
+		const search = encodeParams(params);
+		const extra = headers ? { headers } : {};
+		return this.baseUrl.length + path.length + search.toString().length > LONG_URL ? this.request("POST", path, {
+			form: params,
+			...extra
+		}) : this.request("GET", path, {
+			params,
+			...extra
+		});
+	}
+	async request(method, path, opts = {}) {
+		const url = new URL(`${this.baseUrl}${path}`);
+		url.search = encodeParams(opts.params).toString();
+		const body = opts.form ? encodeParams(opts.form).toString() : void 0;
+		let attempt = 0;
+		for (;;) {
+			this.logger?.debug?.(`${method} ${url.pathname} (attempt ${attempt + 1})`);
+			let res;
+			try {
+				res = await this.fetchImpl(url, {
+					method,
+					headers: {
+						"User-Agent": this.userAgent,
+						Accept: "application/json",
+						...body !== void 0 ? { "Content-Type": "application/x-www-form-urlencoded" } : {},
+						...opts.headers,
+						...this.headers
+					},
+					...body !== void 0 ? { body } : {},
+					signal: AbortSignal.timeout(this.timeoutSeconds * 1e3)
+				});
+			} catch (err) {
+				throw networkError(method, path, err);
+			}
+			const text = await res.text();
+			if (!res.ok && retryable(res.status) && attempt < this.maxRetries) {
+				const delay = retryAfterMs(res) ?? backoffMs(attempt);
+				this.logger?.warn?.(`HTTP ${res.status} on ${path} — retrying in ${delay}ms`);
+				await new Promise((r) => setTimeout(r, delay));
+				attempt += 1;
+				continue;
+			}
+			let parsed = void 0;
+			let isJson = false;
+			if (text) try {
+				parsed = JSON.parse(text);
+				isJson = true;
+			} catch {
+				parsed = text;
+			}
+			const envelope = isEnvelope(parsed) ? parsed : void 0;
+			if (!res.ok || envelope?.status === "error") {
+				const upstream = envelope?.error ?? (typeof parsed === "string" && !isHtml(parsed) ? parsed.trim().slice(0, 1e3) : void 0);
+				const remedy = remedyFor(res.status, upstream);
+				throw new LokiApiError(upstream ? `HTTP ${res.status}: ${upstream}` : `${method} ${path} failed: HTTP ${res.status} ${res.statusText}`.trim(), {
+					status: res.status,
+					...remedy ? { remedy } : {},
+					...isJson && !envelope ? { errors: parsed } : {}
+				});
+			}
+			if (!envelope) return { data: parsed };
+			return {
+				data: envelope.data,
+				...envelope.warnings?.length ? { warnings: envelope.warnings } : {}
+			};
+		}
+	}
+};
+const networkError = (method, path, err) => {
+	const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+	const cause = err instanceof Error && err.cause instanceof Error ? err.cause.message : void 0;
+	return new LokiApiError(`${method} ${path} failed: ${timedOut ? "timed out" : cause ?? (err instanceof Error ? err.message : String(err))}`, {
+		status: 0,
+		remedy: timedOut ? "No answer before LOKI_TIMEOUT. Narrow the selector or the range, or raise LOKI_TIMEOUT." : "Loki could not be reached. Check LOKI_URL, DNS and VPN; a self-signed certificate needs NODE_EXTRA_CA_CERTS."
+	});
+};
+// src/client/identity.ts
+/** "0s" and "0B" mean "no limit" in Loki's config; leaving them out says the same thing. */
+const limitString = (v) => typeof v === "string" && v !== "0s" && v !== "0B" && v !== "0" ? v : void 0;
+const limitNumber = (v) => typeof v === "number" && v > 0 ? v : void 0;
+const bool = (v) => typeof v === "boolean" ? v : void 0;
+const shapeLimits = (d) => {
+	const l = d.limits ?? {};
+	const out = {
+		retention: limitString(l.retention_period),
+		maxQueryLength: limitString(l.max_query_length),
+		maxQueryRange: limitString(l.max_query_range),
+		maxQueryLookback: limitString(l.max_query_lookback),
+		maxEntriesPerQuery: limitNumber(l.max_entries_limit_per_query),
+		maxQuerySeries: limitNumber(l.max_query_series),
+		maxQueryBytesRead: limitString(l.max_query_bytes_read),
+		queryTimeout: limitString(l.query_timeout),
+		volumeEnabled: bool(l.volume_enabled),
+		patternIngesterEnabled: bool(d.pattern_ingester_enabled),
+		discoverLogLevels: bool(l.discover_log_levels)
+	};
+	return Object.fromEntries(Object.entries(out).filter(([, v]) => v !== void 0));
+};
+const fetchIdentity = async (client) => {
+	const [build, limits] = await Promise.allSettled([client.get("/loki/api/v1/status/buildinfo"), client.get("/loki/api/v1/drilldown-limits")]);
+	if (build.status === "rejected" && limits.status === "rejected") throw build.reason;
+	const unavailable = [];
+	const b = build.status === "fulfilled" ? build.value.data : (unavailable.push("buildinfo"), void 0);
+	const l = limits.status === "fulfilled" ? limits.value.data : (unavailable.push("drilldown-limits"), void 0);
+	const version = b?.version ?? l?.version;
+	return {
+		...version ? { version } : {},
+		...b?.revision ? { revision: b.revision } : {},
+		...l ? { limits: shapeLimits(l) } : {},
+		...unavailable.length ? { unavailable } : {}
+	};
+};
+// src/client/time.ts
+const UNITS = {
+	ms: .001,
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800,
+	y: 31536e3
+};
+const DURATION_RE = /^(?:\d+(?:ms|[smhdwy]))+$/;
+/** `1h30m` → 5400. Undefined when the string is not a Prometheus duration. */
+const parseDuration = (value) => {
+	const t = value.trim();
+	if (/^\d+(\.\d+)?$/.test(t)) return Number(t);
+	if (!DURATION_RE.test(t)) return void 0;
+	let total = 0;
+	for (const [, n, unit] of t.matchAll(/(\d+)(ms|[smhdwy])/g)) total += Number(n) * UNITS[unit];
+	return total;
+};
+/** 5400 → `1h30m`; the inverse of parseDuration for whole seconds. */
+const formatDuration = (seconds) => {
+	if (seconds <= 0) return "0s";
+	if (!Number.isInteger(seconds)) return `${Math.round(seconds * 1e3)}ms`;
+	let rest = seconds;
+	let out = "";
+	for (const [unit, size] of [
+		["d", 86400],
+		["h", 3600],
+		["m", 60],
+		["s", 1]
+	]) if (rest >= size) {
+		out += `${Math.floor(rest / size)}${unit}`;
+		rest %= size;
+	}
+	return out;
+};
+var TimeArgError = class extends Error {
+	name = "TimeArgError";
+};
+/**
+* Resolve a time argument to unix seconds. Accepts `now`, `now-1h`, `now+5m`,
+* a bare `-1h` (read as now-1h), RFC3339 / ISO 8601, and unix seconds.
+*/
+const parseTime = (value, nowSeconds) => {
+	const t = value.trim();
+	if (t === "now") return nowSeconds;
+	const relative = /^(?:now)?\s*([+-])\s*(.+)$/.exec(t);
+	if (relative) {
+		const seconds = parseDuration(relative[2]);
+		if (seconds !== void 0) return relative[1] === "-" ? nowSeconds - seconds : nowSeconds + seconds;
+	}
+	if (/^\d+(\.\d+)?$/.test(t)) {
+		const n = Number(t);
+		if (n > 0x16345785d8a0000) return n / 1e9;
+		if (n > 0x5af3107a4000) return n / 1e6;
+		return n > 1e11 ? n / 1e3 : n;
+	}
+	const ms = Date.parse(t);
+	if (Number.isFinite(ms)) return ms / 1e3;
+	throw new TimeArgError(`Cannot read "${value}" as a time. Use now, now-1h, an RFC3339 timestamp (2026-01-31T12:00:00Z) or unix seconds.`);
+};
+/** Unix seconds → RFC3339 in UTC, without the milliseconds when there are none. */
+const isoTime = (seconds) => (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString().replace(".000Z", "Z");
+const NICE_STEPS = [
+	1,
+	5,
+	10,
+	15,
+	30,
+	60,
+	120,
+	300,
+	600,
+	900,
+	1800,
+	3600,
+	7200,
+	10800,
+	21600,
+	43200,
+	86400,
+	172800,
+	604800
+];
+/**
+* The smallest round step that keeps a range at or under `targetPoints`.
+* Round steps matter beyond looks: they line up with how people read time, and
+* with the evaluation grid recording rules already use.
+*/
+const autoStep = (rangeSeconds, targetPoints) => {
+	const raw = rangeSeconds / targetPoints;
+	return NICE_STEPS.find((s) => s >= raw) ?? Math.ceil(raw / 86400) * 86400;
+};
+const NS_PER_S$1 = 1000000000n;
+/** Unix seconds (float) → integer nanoseconds. Millisecond precision is all a double carries here. */
+const secondsToNs = (seconds) => BigInt(Math.round(seconds * 1e3)) * 1000000n;
+/**
+* Resolve a time argument to exact nanoseconds. On top of everything
+* parseTime accepts, a 19-digit integer is taken as nanoseconds verbatim, and
+* an RFC3339 timestamp keeps all nine fractional digits — which is how the
+* `ts` of a returned log line and a `next` cursor round-trip without loss.
+*/
+const parseTimeNs = (value, nowSeconds) => {
+	const t = value.trim();
+	if (/^\d{19}$/.test(t)) return BigInt(t);
+	const iso = /^(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d)\.(\d{4,9})(Z|[+-]\d\d:\d\d)$/.exec(t);
+	if (iso) {
+		const whole = Date.parse(`${iso[1]}${iso[3]}`);
+		if (Number.isFinite(whole)) {
+			const frac = BigInt(iso[2].padEnd(9, "0"));
+			return BigInt(whole) / 1000n * NS_PER_S$1 + frac;
+		}
+	}
+	return secondsToNs(parseTime(t, nowSeconds));
+};
+/**
+* Nanoseconds → RFC3339 in UTC with as many fractional digits as are not
+* zero, e.g. `2026-11-03T22:13:37.968458546Z`. Exact: parseTimeNs reads it
+* back to the same nanosecond.
+*/
+const nsToIso = (ns) => {
+	const n = typeof ns === "bigint" ? ns : BigInt(ns);
+	const seconds = n / NS_PER_S$1;
+	const frac = (n % NS_PER_S$1).toString().padStart(9, "0").replace(/0+$/, "");
+	const base = (/* @__PURE__ */ new Date(Number(seconds) * 1e3)).toISOString().replace(".000Z", "");
+	return frac ? `${base}.${frac}Z` : `${base}Z`;
+};
+/** The usual query window: `start`/`end` (or `since`) resolved against one `now`, in nanoseconds. */
+const resolveRange = (args, nowSeconds, defaultSpanSeconds = 3600) => {
+	const end = args.end !== void 0 ? parseTimeNs(args.end, nowSeconds) : secondsToNs(nowSeconds);
+	const start = args.start !== void 0 ? parseTimeNs(args.start, nowSeconds) : end - BigInt(defaultSpanSeconds) * NS_PER_S$1;
+	if (start >= end) throw new TimeArgError("start must be before end.");
+	return {
+		start,
+		end
+	};
+};
+// src/tools/util.ts
+/** Compact, not pretty-printed: indentation adds 19-41% to every row and no model needs it. */
+const ok = (data) => ({ content: [{
+	type: "text",
+	text: JSON.stringify(data ?? { ok: true })
+}] });
+/**
+* `extra` is spread at the top level, so a `remedy` lands beside the error
+* rather than inside the upstream text, where it gets skimmed past.
+*/
+const fail = (message, extra) => ({
+	content: [{
+		type: "text",
+		text: JSON.stringify({
+			error: message,
+			...extra
+		})
+	}],
+	isError: true
+});
+/** A thrown value as `{error, remedy?, status?, details?}`, for a tool error or a status field. */
+const describeError = (err) => {
+	if (err instanceof LokiApiError) return {
+		error: err.message,
+		...err.remedy ? { remedy: err.remedy } : {},
+		status: err.status,
+		...err.errors !== void 0 ? { details: err.errors } : {}
+	};
+	if (err instanceof TimeArgError) return { error: err.message };
+	if (err instanceof Error) return { error: err.message };
+	return {
+		error: "Unknown error",
+		details: err
+	};
+};
+/** Render a thrown value as a tool error, preserving upstream detail. */
+const toFailure = (err) => {
+	const { error, ...extra } = describeError(err);
+	return fail(error, extra);
+};
+/** Run a tool body, JSON-formatting the result and turning errors into a tool error. */
+const wrap = async (fn) => {
+	try {
+		return ok(await fn());
+	} catch (err) {
+		return toFailure(err);
+	}
+};
+/** Carry Loki's warnings onto a shaped result: they are the part of a success most worth reading. */
+const withNotes = (shaped, res) => ({
+	...shaped,
+	...res.warnings ? { warnings: res.warnings } : {}
+});
+/** Case-insensitive substring match, the filter every list tool offers. */
+const matches = (needle, ...haystack) => {
+	if (!needle) return true;
+	const n = needle.toLowerCase();
+	return haystack.some((h) => h?.toLowerCase().includes(n));
+};
+const TIME_FORMS = "now, now-1h, -30m, an RFC3339 timestamp (2026-01-31T12:00:00Z, nanosecond fractions kept) or unix seconds/nanoseconds";
+const timeArg = (what, fallback) => z.string().optional().describe(`${what}: ${TIME_FORMS}.${fallback ? ` Defaults to ${fallback}.` : ""}`);
+const MATCHER_RULE = "At least one matcher must not match the empty string: `{app=~\".+\"}` works, `{app=~\".*\"}` and `{}` are rejected.";
+/** A stream selector only — what /series, /labels, /index/* and /patterns take. */
+const selectorArg = (required) => {
+	const base = z.string().min(1).describe(`A stream selector, e.g. \`{namespace="payments", app="api"}\`. Label matchers only: no line filters or parsers. ${MATCHER_RULE}`);
+	return required ? base : base.optional();
+};
+const logQueryArg = z.string().min(1).describe(`A LogQL log query: a stream selector, then filters and parsers, e.g. \`{namespace="payments", app="api"} |= "error" != "healthcheck" | json | status >= 500\`. Put the cheap parts first: label matchers decide how much is read at all, then line filters (|=, !=, |~), and only then parsers (| json, | logfmt). ${MATCHER_RULE}`);
+const metricQueryArg = z.string().min(1).describe("A LogQL metric query: a range aggregation over a log query, usually aggregated by a label, e.g. `sum by (namespace) (count_over_time({namespace=~\".+\"} |= \"error\" [5m]))` or `sum by (status) (rate({app=\"nginx\"} | json [1m]))`. Unwrapped values: `avg_over_time({app=\"api\"} | json | unwrap duration_ms [5m])`. Always aggregate (sum by) unless you want one series per stream.");
+const precisionArg = z.number().int().min(0).max(17).default(4).describe("Significant digits to round fractional values to (whole numbers are never rounded). Defaults to 4; 0 returns the exact value.");
+const searchArg = z.string().min(1).optional().describe("Case-insensitive substring to filter by, e.g. `api`.");
+// src/tools/auth.ts
+/**
+* Registered first and unconditionally, so an unconfigured server is still a
+* useful one rather than a connection that closes.
+*/
+const registerAuthTools = (server, ctx) => {
+	server.registerTool("loki_auth_status", {
+		title: "Loki: Auth Status",
+		description: "Report which Loki this server reads and whether it answers: the URL, auth mode, the tenant (and where that comes from), the Loki version, and this tenant's limits — retention, max query length, max lines per query, max series, query timeout, and whether volume and pattern endpoints are enabled. When the server is not configured, says exactly what to set. Call this first when a tool you expected is missing, when a query fails on a limit, or before trusting logs from an instance you have not checked.",
+		inputSchema: z.object({}),
+		annotations: { readOnlyHint: true }
+	}, async () => wrap(async () => {
+		const { config } = ctx;
+		const base = {
+			configured: ctx.hasCredentials,
+			...config.url ? { url: config.url } : {},
+			auth: authMode(config),
+			...ctx.tenant ? {
+				tenant: ctx.tenant.tenant,
+				tenant_source: ctx.tenant.source
+			} : { tenant_note: "No tenant configured. Fine for a single-tenant Loki (auth_enabled: false); a multi-tenant one answers 401 'no org id' until LOKI_TENANT_ID is set." },
+			...Object.keys(config.headers).length ? { headers: Object.keys(config.headers) } : {}
+		};
+		if (!ctx.hasCredentials) return {
+			...base,
+			setup: setupInstructions(config)
+		};
+		try {
+			return {
+				...base,
+				reachable: true,
+				loki: await ctx.identity()
+			};
+		} catch (err) {
+			return {
+				...base,
+				reachable: false,
+				...describeError(err)
+			};
+		}
+	}));
+};
+// src/client/shape.ts
+/**
+* Round to `digits` significant digits, but never into the integer part:
+* a byte count of 807227 stays 807227, 0.005732144858 becomes 0.005732.
+* `digits` of 0 means exact.
+*/
+const round = (n, digits) => {
+	if (digits <= 0 || !Number.isFinite(n) || Number.isInteger(n) || n === 0) return n;
+	if (Math.floor(Math.log10(Math.abs(n))) + 1 >= digits) return Math.round(n);
+	return Number(n.toPrecision(digits));
+};
+const toValue = (raw, digits) => {
+	if (raw === "NaN" || raw === "+Inf" || raw === "-Inf") return raw;
+	return round(Number(raw), digits);
+};
+/** A native histogram has no single value; its count and sum are what a reader can use. */
+const histogramValue = (h, digits) => ({
+	count: toValue(h.count, digits),
+	sum: toValue(h.sum, digits)
+});
+/**
+* Split off the labels every series shares. With one series there is nothing
+* to compare against, so its labels stay where they are.
+*/
+const splitCommonLabels = (metrics) => {
+	const [first, ...others] = metrics;
+	if (!first || others.length === 0) return {
+		common: {},
+		rest: metrics
+	};
+	const common = Object.fromEntries(Object.entries(first).filter(([k, v]) => others.every((m) => m[k] === v)));
+	return {
+		common,
+		rest: metrics.map((m) => Object.fromEntries(Object.entries(m).filter(([k]) => !(k in common))))
+	};
+};
+const withLabels = (labels) => Object.keys(labels).length > 0 ? { labels } : {};
+const numeric = (values) => values.filter((v) => typeof v === "number");
+const stats = (values, digits) => {
+	const nums = numeric(values);
+	if (nums.length === 0) return void 0;
+	let min = Infinity;
+	let max = -Infinity;
+	let sum = 0;
+	for (const n of nums) {
+		if (n < min) min = n;
+		if (n > max) max = n;
+		sum += n;
+	}
+	let last = null;
+	for (let i = values.length - 1; i >= 0; i--) if (values[i] !== null && values[i] !== void 0) {
+		last = values[i];
+		break;
+	}
+	return {
+		min: round(min, digits),
+		max: round(max, digits),
+		avg: round(sum / nums.length, digits),
+		last
+	};
+};
+/** An instant query. Upstream order is kept, so sort(), sort_desc() and topk() mean what they say. */
+const shapeInstant = (data, opts) => {
+	const { limit, precision } = opts;
+	if (opts.sort === "value" && data.resultType === "vector") {
+		const num = (s) => {
+			const n = Number(s.value?.[1] ?? s.histogram?.[1].count);
+			return Number.isNaN(n) ? -Infinity : n;
+		};
+		data = {
+			...data,
+			result: data.result.toSorted((a, b) => num(b) - num(a))
+		};
+	}
+	if (data.resultType === "scalar" || data.resultType === "string") {
+		const [t, v] = data.result;
+		return {
+			resultType: data.resultType,
+			time: isoTime(t),
+			value: data.resultType === "scalar" ? toValue(v, precision) : v
+		};
+	}
+	const total = data.result.length;
+	if (data.resultType === "matrix") {
+		const kept = data.result.slice(0, limit);
+		const { common, rest } = splitCommonLabels(kept.map((s) => s.metric));
+		return {
+			resultType: "matrix",
+			total,
+			...total > kept.length ? { truncated: true } : {},
+			...Object.keys(common).length ? { common_labels: common } : {},
+			series: kept.map((s, i) => ({
+				...withLabels(rest[i]),
+				samples: s.values ? s.values.map(([t, v]) => [t, toValue(v, precision)]) : (s.histograms ?? []).map(([t, h]) => [t, histogramValue(h, precision)])
+			}))
+		};
+	}
+	const kept = data.result.slice(0, limit);
+	const { common, rest } = splitCommonLabels(kept.map((s) => s.metric));
+	const first = kept[0];
+	const time = first?.value?.[0] ?? first?.histogram?.[0];
+	return {
+		resultType: "vector",
+		...time !== void 0 ? { time: isoTime(time) } : {},
+		total,
+		...total > kept.length ? { truncated: true } : {},
+		...Object.keys(common).length ? { common_labels: common } : {},
+		series: kept.map((s, i) => ({
+			...withLabels(rest[i]),
+			value: s.value ? toValue(s.value[1], precision) : s.histogram ? histogramValue(s.histogram[1], precision) : null
+		}))
+	};
+};
+const sortKey = (s, by) => {
+	if (!s) return -Infinity;
+	if (by === "last") return typeof s.last === "number" ? s.last : -Infinity;
+	return by === "max" ? s.max : s.avg;
+};
+/** A range query, laid on its step grid. */
+const shapeRange = (data, opts) => {
+	const { start, end, step, limit, precision, sort, view } = opts;
+	const points = Math.floor((end - start) / step) + 1;
+	const all = data.result.map((s) => {
+		const values = Array.from({ length: points }, () => null);
+		for (const [t, v] of s.values ?? []) {
+			const i = Math.round((t - start) / step);
+			if (i >= 0 && i < points) values[i] = toValue(v, precision);
+		}
+		for (const [t, h] of s.histograms ?? []) {
+			const i = Math.round((t - start) / step);
+			if (i >= 0 && i < points) values[i] = toValue(h.count, precision);
+		}
+		return {
+			metric: s.metric,
+			values,
+			stats: stats(values, precision)
+		};
+	});
+	if (sort !== "labels") all.sort((a, b) => sortKey(b.stats, sort) - sortKey(a.stats, sort));
+	const kept = all.slice(0, limit);
+	const { common, rest } = splitCommonLabels(kept.map((s) => s.metric));
+	return {
+		resultType: "matrix",
+		start: isoTime(start),
+		end: isoTime(start + (points - 1) * step),
+		step: formatDuration(step),
+		points,
+		total: all.length,
+		...all.length > kept.length ? { truncated: true } : {},
+		...Object.keys(common).length ? { common_labels: common } : {},
+		series: kept.map((s, i) => {
+			const gaps = s.values.filter((v) => v === null).length;
+			return {
+				...withLabels(rest[i]),
+				...s.stats ? { stats: s.stats } : {},
+				...gaps > 0 && view === "stats" ? { missing_points: gaps } : {},
+				...view === "values" ? { values: s.values } : {}
+			};
+		})
+	};
+};
+const shapeRule = (group, r, includeQuery) => ({
+	group,
+	name: r.name,
+	type: r.type === "alerting" ? "alert" : "record",
+	...r.state ? { state: r.state } : {},
+	health: r.health,
+	...r.lastError ? { lastError: r.lastError } : {},
+	...includeQuery ? { query: r.query } : {},
+	...r.duration ? { for: formatDuration(r.duration) } : {},
+	...r.keepFiringFor ? { keepFiringFor: formatDuration(r.keepFiringFor) } : {},
+	...r.labels && Object.keys(r.labels).length ? { labels: r.labels } : {},
+	...r.annotations?.summary ? { summary: r.annotations.summary } : {}
+});
+const ANSI_RE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, "g");
+/** Strip ANSI colour codes and the trailing newline, then cut at `max` characters. */
+const cleanLine = (raw, max) => {
+	const line = raw.replace(ANSI_RE, "").replace(/\r?\n$/, "");
+	if (line.length <= max) return {
+		line,
+		cut: false
+	};
+	return {
+		line: `${line.slice(0, max)}… [+${line.length - max} chars]`,
+		cut: true
+	};
+};
+const omit = (labels, keys) => Object.fromEntries(Object.entries(labels).filter(([k]) => !keys.has(k)));
+/** The levels Loki assigns when it found none; saying so on every line is noise. */
+const NO_LEVEL = /* @__PURE__ */ new Set(["unknown", ""]);
+/**
+* Lay a log query's streams out as one time-ordered list of lines. Labels
+* every stream shares go to `common_labels` (all of them, when there is only
+* one stream); each line keeps only what tells its stream apart.
+*/
+const shapeStreams = (result, opts) => {
+	const hide = new Set(opts.hideLabels);
+	hide.add("detected_level");
+	const metrics = result.map((s) => omit(s.stream, hide));
+	const split = metrics.length === 1 ? {
+		common: metrics[0],
+		rest: [{}]
+	} : splitCommonLabels(metrics);
+	const flat = [];
+	result.forEach((s, i) => {
+		for (const entry of s.values) flat.push({
+			ns: BigInt(entry[0]),
+			stream: i,
+			entry
+		});
+	});
+	const sign = opts.direction === "backward" ? -1 : 1;
+	flat.sort((a, b) => a.ns === b.ns ? 0 : a.ns > b.ns ? sign : -sign);
+	let cutLines = 0;
+	const parseErrors = {};
+	const entries = flat.map(({ ns, stream, entry }) => {
+		const [, raw, meta] = entry;
+		const { line, cut } = cleanLine(raw, opts.maxLineChars);
+		if (cut) cutLines += 1;
+		const sm = { ...meta?.structuredMetadata };
+		const parsed = { ...meta?.parsed };
+		const level = sm.detected_level ?? result[stream]?.stream.detected_level;
+		delete sm.detected_level;
+		let parseError;
+		if (parsed.__error__) {
+			parseError = parsed.__error__;
+			const key = parsed.__error_details__ ? `${parsed.__error__}: ${parsed.__error_details__}` : parsed.__error__;
+			parseErrors[key] = (parseErrors[key] ?? 0) + 1;
+			delete parsed.__error__;
+			delete parsed.__error_details__;
+		}
+		const fields = opts.includeParsed ? {
+			...sm,
+			...parsed
+		} : sm;
+		const labels = split.rest[stream] ?? {};
+		return {
+			ts: nsToIso(ns),
+			...withLabels(labels),
+			...level && !NO_LEVEL.has(level) ? { level } : {},
+			line,
+			...Object.keys(fields).length ? { fields } : {},
+			...parseError ? { parse_error: parseError } : {}
+		};
+	});
+	const shaped = {
+		streams: result.length,
+		lines: entries.length,
+		...Object.keys(split.common).length ? { common_labels: split.common } : {},
+		...cutLines ? { lines_cut: cutLines } : {},
+		...Object.keys(parseErrors).length ? { parse_errors: parseErrors } : {},
+		entries
+	};
+	const head = flat[0];
+	const tail = flat[flat.length - 1];
+	return {
+		shaped,
+		...head && tail ? {
+			first: head.ns,
+			last: tail.ns
+		} : {}
+	};
+};
+/** 26677090 → "26.7 MB". Decimal units, as Grafana shows them. */
+const humanBytes = (bytes) => {
+	if (!Number.isFinite(bytes)) return String(bytes);
+	const units = [
+		"B",
+		"kB",
+		"MB",
+		"GB",
+		"TB",
+		"PB"
+	];
+	let v = bytes;
+	let i = 0;
+	while (Math.abs(v) >= 1e3 && i < units.length - 1) {
+		v /= 1e3;
+		i += 1;
+	}
+	return `${i === 0 ? v : Number(v.toPrecision(3))} ${units[i]}`;
+};
+const shapeStats = (s) => ({
+	streams: s.streams,
+	chunks: s.chunks,
+	entries: s.entries,
+	bytes: s.bytes,
+	size: humanBytes(s.bytes)
+});
+/** /index/volume: bytes per label set, largest first. */
+const shapeVolume = (data, limit) => {
+	const rows = data.result.map((r) => ({
+		labels: r.metric,
+		bytes: Number(r.value?.[1] ?? 0)
+	})).toSorted((a, b) => b.bytes - a.bytes);
+	const total = rows.reduce((sum, r) => sum + r.bytes, 0);
+	const kept = rows.slice(0, limit);
+	return {
+		total_size: humanBytes(total),
+		total: rows.length,
+		...rows.length > kept.length ? { truncated: true } : {},
+		volumes: kept.map((r) => ({
+			...r.labels,
+			bytes: r.bytes,
+			size: humanBytes(r.bytes),
+			share: total > 0 ? `${round(r.bytes / total * 100, 4)}%` : "0%"
+		}))
+	};
+};
+/**
+* Patterns are line templates with `<_>` for the variable parts. The samples
+* are per-bucket counts; what a reader wants is the total and when it was
+* seen, so the buckets are summed rather than returned.
+*/
+const shapePatterns = (patterns, opts) => {
+	const rows = patterns.map((p) => {
+		let count = 0;
+		let first = Infinity;
+		let last = -Infinity;
+		for (const [t, n] of p.samples ?? []) {
+			count += n;
+			if (t < first) first = t;
+			if (t > last) last = t;
+		}
+		return {
+			p,
+			count,
+			first,
+			last
+		};
+	}).toSorted((a, b) => b.count - a.count);
+	const total = rows.reduce((sum, r) => sum + r.count, 0);
+	const kept = rows.slice(0, opts.limit);
+	return {
+		total_patterns: rows.length,
+		total_lines: total,
+		...rows.length > kept.length ? { truncated: true } : {},
+		patterns: kept.map(({ p, count, first, last }) => ({
+			count,
+			share: total > 0 ? `${round(count / total * 100, 4)}%` : "0%",
+			...p.level && !NO_LEVEL.has(p.level) ? { level: p.level } : {},
+			pattern: cleanLine(p.pattern, opts.maxChars).line,
+			...Number.isFinite(first) ? {
+				first_seen: isoTime(first),
+				last_seen: isoTime(last)
+			} : {}
+		}))
+	};
+};
+// src/tools/insights.ts
+const registerIndexTools = (server, client, ctx) => {
+	server.registerTool("loki_get_volume", {
+		title: "Loki: Get Volume",
+		description: "How many bytes of logs each service, namespace or stream produced over a range, largest first, from the index alone — no lines are read, so it is cheap over days. Use it to find the noisiest sources, to see what a selector covers before querying it, or to compare: `{namespace=~\".+\"}` by [\"namespace\"] ranks every namespace. Needs volume_enabled (see loki_auth_status).",
+		inputSchema: z.object({
+			selector: selectorArg(true),
+			by: z.array(z.string()).optional().describe("Labels to group by, e.g. [\"namespace\"] or [\"namespace\", \"app\"]. Defaults to the labels named in the selector."),
+			aggregate_by: z.enum(["series", "labels"]).default("series").describe("series: bytes per value of the `by` labels (the usual answer). labels: bytes per label NAME, i.e. how much of the volume carries each label at all."),
+			start: timeArg("Range start", "1 hour before end"),
+			end: timeArg("Range end", "now"),
+			limit: z.number().int().min(1).max(1e3).default(20).describe("Maximum rows to return (1-1000), largest first. Defaults to 20.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, by, aggregate_by, start, end, limit }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now());
+		const res = await client.read("/loki/api/v1/index/volume", {
+			query: selector,
+			start: range.start,
+			end: range.end,
+			limit: Math.max(limit, 1e3),
+			...by?.length ? { targetLabels: by.join(",") } : {},
+			aggregateBy: aggregate_by
+		});
+		const data = aggregate_by === "labels" ? { result: res.data.result.map((r) => ({
+			...r,
+			metric: { label: Object.keys(r.metric)[0] ?? "" }
+		})) } : res.data;
+		return withNotes({
+			...ctx.tag(),
+			...shapeVolume(data, limit)
+		}, res);
+	}));
+	server.registerTool("loki_get_stats", {
+		title: "Loki: Get Stats",
+		description: "How much data a stream selector covers over a range — streams, chunks, log lines and bytes — from the index, without reading any of it. Call it before an expensive loki_query_logs or a long metric range: a selector covering tens of GB will be slow or time out, and should be narrowed first.",
+		inputSchema: z.object({
+			selector: selectorArg(true),
+			start: timeArg("Range start", "1 hour before end"),
+			end: timeArg("Range end", "now")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, start, end }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now());
+		const res = await client.read("/loki/api/v1/index/stats", {
+			query: selector,
+			start: range.start,
+			end: range.end
+		});
+		return {
+			...ctx.tag(),
+			selector,
+			...shapeStats(res.data)
+		};
+	}));
+	server.registerTool("loki_list_patterns", {
+		title: "Loki: List Patterns",
+		description: "Summarize what a set of streams is logging as line templates (`<_>` marks the variable parts) with how often each occurred, most frequent first. The fastest way to see what a service is doing, or which new message started flooding, without reading lines. Patterns are built by the pattern ingester from recent data (typically the last few hours) and need it to be enabled (see loki_auth_status).",
+		inputSchema: z.object({
+			selector: selectorArg(true),
+			level: z.string().optional().describe("Keep only patterns of this detected level, e.g. `error` or `warn`."),
+			search: searchArg,
+			start: timeArg("Range start", "1 hour before end"),
+			end: timeArg("Range end", "now"),
+			limit: z.number().int().min(1).max(500).default(30).describe("Maximum patterns to return (1-500), most frequent first. Defaults to 30."),
+			max_chars: z.number().int().min(80).max(1e4).default(500).describe("Cut each pattern at this many characters. Defaults to 500.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, level, search, start, end, limit, max_chars }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now());
+		const res = await client.read("/loki/api/v1/patterns", {
+			query: selector,
+			start: range.start,
+			end: range.end
+		});
+		const kept = (res.data ?? []).filter((p) => (level === void 0 || p.level?.toLowerCase() === level.toLowerCase()) && matches(search, p.pattern));
+		return withNotes({
+			...ctx.tag(),
+			...shapePatterns(kept, {
+				limit,
+				maxChars: max_chars
+			})
+		}, res);
+	}));
+};
+// src/tools/labels.ts
+/**
+* Label discovery defaults to the last 6 hours, as Loki itself does: long
+* enough to catch a cron job, short enough not to list every pod that ever ran.
+*/
+const DISCOVERY_SPAN = 21600;
+const registerLabelTools = (server, client, ctx) => {
+	server.registerTool("loki_list_labels", {
+		title: "Loki: List Labels",
+		description: "List the indexed stream labels with how many distinct values each has, optionally only for streams matching a selector. The starting point for writing any query: low-cardinality labels (namespace, app, service_name, container) make good selectors; high-cardinality ones (pod, filename) are better left to line filters or `by`. Then loki_list_label_values for the values of one label.",
+		inputSchema: z.object({
+			selector: selectorArg(false),
+			start: timeArg("Range start", "6 hours before end"),
+			end: timeArg("Range end", "now")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, start, end }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now(), DISCOVERY_SPAN);
+		const res = await client.get("/loki/api/v1/detected_labels", {
+			query: selector,
+			start: range.start,
+			end: range.end
+		});
+		const labels = (res.data.detectedLabels ?? []).filter((l) => l.label !== "__stream_shard__").toSorted((a, b) => a.label.localeCompare(b.label));
+		return withNotes({
+			...ctx.tag(),
+			total: labels.length,
+			labels: Object.fromEntries(labels.map((l) => [l.label, l.cardinality]))
+		}, res);
+	}));
+	server.registerTool("loki_list_label_values", {
+		title: "Loki: List Label Values",
+		description: "List the values of one stream label, e.g. every namespace or every app, optionally only among streams matching a selector (the pods of one namespace). Use it to find the exact spelling to put in a selector rather than guessing with a regex.",
+		inputSchema: z.object({
+			label: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "A label name: letters, digits and underscores.").describe("The label name, e.g. `namespace`, `app`, `service_name`, `pod`."),
+			selector: selectorArg(false),
+			search: searchArg,
+			start: timeArg("Range start", "6 hours before end"),
+			end: timeArg("Range end", "now"),
+			limit: z.number().int().min(1).max(5e3).default(200).describe("Maximum values to return (1-5000). Defaults to 200.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ label, selector, search, start, end, limit }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now(), DISCOVERY_SPAN);
+		const res = await client.get(`/loki/api/v1/label/${encodeURIComponent(label)}/values`, {
+			query: selector,
+			start: range.start,
+			end: range.end
+		});
+		const all = (res.data ?? []).filter((v) => matches(search, v));
+		const values = all.slice(0, limit);
+		return withNotes({
+			...ctx.tag(),
+			label,
+			total: all.length,
+			...all.length > values.length ? { truncated: true } : {},
+			values
+		}, res);
+	}));
+	server.registerTool("loki_list_series", {
+		title: "Loki: List Series",
+		description: "List the streams (distinct label sets) matching a selector, with the labels every one shares hoisted into `common_labels`. Use it to see what a selector actually covers — which pods, containers and stdout/stderr streams — before querying it. For how much each one logs, use loki_get_volume instead.",
+		inputSchema: z.object({
+			selector: selectorArg(true),
+			start: timeArg("Range start", "6 hours before end"),
+			end: timeArg("Range end", "now"),
+			limit: z.number().int().min(1).max(1e3).default(50).describe("Maximum streams to return (1-1000). Defaults to 50."),
+			hide_labels: z.array(z.string()).default(["filename"]).describe("Labels to leave out. Defaults to [\"filename\"] (a /var/log/pods/... path that repeats pod and container); [] keeps everything.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, start, end, limit, hide_labels }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now(), DISCOVERY_SPAN);
+		const res = await client.read("/loki/api/v1/series", {
+			"match[]": [selector],
+			start: range.start,
+			end: range.end
+		});
+		const hide = /* @__PURE__ */ new Set([...hide_labels, "__stream_shard__"]);
+		const all = (res.data ?? []).map((s) => Object.fromEntries(Object.entries(s).filter(([k]) => !hide.has(k))));
+		const unique = [...new Map(all.map((s) => [JSON.stringify(Object.entries(s).toSorted()), s])).values()];
+		const kept = unique.toSorted((a, b) => JSON.stringify(Object.entries(a).toSorted()).localeCompare(JSON.stringify(Object.entries(b).toSorted()))).slice(0, limit);
+		const { common, rest } = splitCommonLabels(kept);
+		return withNotes({
+			...ctx.tag(),
+			total: unique.length,
+			...unique.length > kept.length ? { truncated: true } : {},
+			...Object.keys(common).length ? { common_labels: common } : {},
+			series: rest
+		}, res);
+	}));
+	server.registerTool("loki_list_detected_fields", {
+		title: "Loki: List Detected Fields",
+		description: "List the fields Loki can pull out of the log lines themselves — JSON keys, logfmt keys and structured metadata — with their type, cardinality and which parser finds them, for the streams a query selects. This is how to learn what to write after `| json` or `| logfmt` (e.g. `| json | status >= 500`) without reading lines first. Pass `field` to get that field's values instead.",
+		inputSchema: z.object({
+			query: z.string().min(1).describe("A stream selector, optionally with line filters, e.g. `{app=\"api\"}` or `{app=\"api\"} |= \"error\"`. Fields are sampled from the matching lines."),
+			field: z.string().min(1).optional().describe("A field name from a previous call, e.g. `status`, to list its values."),
+			search: searchArg,
+			start: timeArg("Range start", "1 hour before end"),
+			end: timeArg("Range end", "now"),
+			limit: z.number().int().min(1).max(1e3).default(100).describe("Maximum fields or values to return (1-1000). Defaults to 100.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ query, field, search, start, end, limit }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now());
+		if (field !== void 0) {
+			const all = ((await client.get(`/loki/api/v1/detected_field/${encodeURIComponent(field)}/values`, {
+				query,
+				start: range.start,
+				end: range.end,
+				limit
+			})).data.values ?? []).filter((v) => matches(search, v));
+			return {
+				...ctx.tag(),
+				field,
+				total: all.length,
+				...all.length > limit ? { truncated: true } : {},
+				values: all.slice(0, limit)
+			};
+		}
+		const all = ((await client.get("/loki/api/v1/detected_fields", {
+			query,
+			start: range.start,
+			end: range.end,
+			limit
+		})).data.fields ?? []).filter((f) => matches(search, f.label)).toSorted((a, b) => a.label.localeCompare(b.label));
+		return {
+			...ctx.tag(),
+			total: all.length,
+			...all.length > limit ? { truncated: true } : {},
+			fields: all.slice(0, limit).map((f) => ({
+				name: f.label,
+				...f.type ? { type: f.type } : {},
+				...f.cardinality !== void 0 ? { cardinality: f.cardinality } : {},
+				parsers: f.parsers?.length ? f.parsers : ["structured_metadata"],
+				...f.jsonPath && f.jsonPath.length > 1 ? { json_path: f.jsonPath.join(".") } : {}
+			}))
+		};
+	}));
+};
+// src/tools/logs.ts
+/**
+* Ask for structured metadata and parsed labels per line instead of merged
+* into the stream labels. Without it, `| json` makes every distinct set of
+* parsed fields its own stream: one stream of 12 labels became two on the
+* first line that failed to parse.
+*/
+const CATEGORIZE = { "X-Loki-Response-Encoding-Flags": "categorize-labels" };
+const NS_PER_S = 1000000000n;
+/** How much the query read: the cost signal worth keeping out of the ~2 KB stats block. */
+const scanned = (stats) => {
+	const s = stats?.summary;
+	if (!s || s.totalBytesProcessed === void 0) return {};
+	return { scanned: {
+		size: humanBytes(s.totalBytesProcessed),
+		...s.totalLinesProcessed !== void 0 ? { lines: s.totalLinesProcessed } : {},
+		...s.execTime !== void 0 ? { seconds: round(s.execTime, 3) } : {}
+	} };
+};
+const expectStreams = (res) => {
+	if (res.data.resultType !== "streams") throw new TimeArgError(`That is a metric query (it returned a ${res.data.resultType}); use loki_query_metric or loki_query_metric_range for it.`);
+	return res.data.result;
+};
+const maxLineArg = z.number().int().min(80).max(1e5).default(2e3).describe("Cut each line at this many characters (80-100000); a cut line ends with `… [+N chars]`. Defaults to 2000. Some services log single lines of hundreds of KB.");
+const parsedFieldsArg = z.boolean().default(false).describe("Include the labels extracted by | json, | logfmt, | regexp or | pattern on each line, under `fields`. Off by default because they restate the line itself and double its size; turn it on after line_format or keep has reshaped the line, or to read a nested JSON value flattened. Structured metadata (trace_id, detected_level) is always included.");
+const hideLabelsArg = z.array(z.string()).default(["filename"]).describe("Stream labels to leave out of the answer. Defaults to [\"filename\"], which on Kubernetes is a 120-character /var/log/pods/... path repeating namespace, pod and container. Pass [] to see every label.");
+const registerLogTools = (server, client, ctx) => {
+	server.registerTool("loki_query_logs", {
+		title: "Loki: Query Logs",
+		description: "Run a LogQL log query over a time range and return the matching lines, newest first by default, merged across streams into one time-ordered list. Labels shared by every stream come once as `common_labels`; each line carries only the labels that tell its stream apart, plus `level` and structured-metadata `fields` (parsed ones with parsed_fields). When `more` is true, call again with `next` as start/end to page on. To count or rank rather than read (errors per namespace, top talkers), use loki_query_metric instead: it is far cheaper than reading lines. loki_get_stats tells you how much a selector would scan.",
+		inputSchema: z.object({
+			query: logQueryArg,
+			start: timeArg("Range start", "1 hour before end"),
+			end: timeArg("Range end (exclusive)", "now"),
+			limit: z.number().int().min(1).max(5e3).default(100).describe("Maximum lines to return (1-5000; Loki's own max_entries_limit_per_query may be lower). Defaults to 100. Page with `next` rather than raising it."),
+			direction: z.enum(["backward", "forward"]).default("backward").describe("backward: newest lines first, so the limit keeps the most recent. forward: oldest first, to read what happened from the start of the range."),
+			max_line_chars: maxLineArg,
+			parsed_fields: parsedFieldsArg,
+			hide_labels: hideLabelsArg
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ query, start, end, limit, direction, max_line_chars, parsed_fields, hide_labels }) => wrap(async () => {
+		const range = resolveRange({
+			start,
+			end
+		}, ctx.now());
+		const res = await client.read("/loki/api/v1/query_range", {
+			query,
+			start: range.start,
+			end: range.end,
+			limit,
+			direction
+		}, CATEGORIZE);
+		const { shaped, last } = shapeStreams(expectStreams(res), {
+			direction,
+			maxLineChars: max_line_chars,
+			hideLabels: hide_labels,
+			includeParsed: parsed_fields
+		});
+		const more = shaped.lines === limit && last !== void 0;
+		return withNotes({
+			...ctx.tag(),
+			start: nsToIso(range.start),
+			end: nsToIso(range.end),
+			direction,
+			...shaped,
+			...more ? {
+				more: true,
+				next: direction === "backward" ? {
+					start: nsToIso(range.start),
+					end: nsToIso(last)
+				} : {
+					start: nsToIso(last + 1n),
+					end: nsToIso(range.end)
+				}
+			} : {},
+			...scanned(res.data.stats)
+		}, res);
+	}));
+	server.registerTool("loki_get_log_context", {
+		title: "Loki: Get Log Context",
+		description: "Show the lines around one log line — what the same stream logged just before and after it, unfiltered — the way Grafana's 'show context' does. Pass the stream selector (built from the line's common_labels plus its own labels, e.g. `{namespace=\"payments\", pod=\"api-7d9f-x2k4\"}`) and the line's exact `ts`. Lines come back oldest first, with the anchor line marked `anchor: true`.",
+		inputSchema: z.object({
+			selector: z.string().min(1).describe("Stream selector for the line's stream, e.g. `{namespace=\"payments\", pod=\"api-7d9f-x2k4\", container=\"api\"}`. Matchers only; the narrower, the more the context is that one process's."),
+			time: z.string().min(1).describe("The anchor line's `ts` exactly as returned (e.g. 2026-11-03T22:13:37.968458546Z), or its nanosecond timestamp. Any other time form is accepted too."),
+			before: z.number().int().min(0).max(500).default(10).describe("Lines to show before the anchor (0-500). Defaults to 10."),
+			after: z.number().int().min(0).max(500).default(10).describe("Lines to show after the anchor (0-500). Defaults to 10."),
+			window: z.string().default("1h").describe("How far to look on each side for those lines, as a duration (5m, 1h). Defaults to 1h; a quiet stream may need more."),
+			max_line_chars: maxLineArg,
+			parsed_fields: parsedFieldsArg,
+			hide_labels: hideLabelsArg
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ selector, time, before, after, window, max_line_chars, parsed_fields, hide_labels }) => wrap(async () => {
+		const at = parseTimeNs(time, ctx.now());
+		const span = parseDuration(window);
+		if (span === void 0 || span <= 0) throw new TimeArgError(`Cannot read window "${window}"; use a duration like 5m or 1h.`);
+		const spanNs = BigInt(Math.round(span)) * NS_PER_S;
+		const [older, newer] = await Promise.all([client.read("/loki/api/v1/query_range", {
+			query: selector,
+			start: at - spanNs,
+			end: at + 1n,
+			limit: before + 1,
+			direction: "backward"
+		}, CATEGORIZE), after > 0 ? client.read("/loki/api/v1/query_range", {
+			query: selector,
+			start: at + 1n,
+			end: at + spanNs,
+			limit: after,
+			direction: "forward"
+		}, CATEGORIZE) : void 0]);
+		const streams = [...expectStreams(older), ...newer ? expectStreams(newer) : []];
+		const { shaped } = shapeStreams(streams, {
+			direction: "forward",
+			maxLineChars: max_line_chars,
+			hideLabels: hide_labels,
+			includeParsed: parsed_fields
+		});
+		const anchorTs = nsToIso(at);
+		const entries = shaped.entries.map((e) => e.ts === anchorTs ? {
+			...e,
+			anchor: true
+		} : e);
+		const found = entries.some((e) => "anchor" in e);
+		return withNotes({
+			...ctx.tag(),
+			...shaped,
+			entries,
+			...found ? {} : { note: "No line at exactly that timestamp in this selector; showing the lines around the time instead. Pass the line's `ts` verbatim for an exact anchor." }
+		}, older);
+	}));
+};
+// src/tools/metrics.ts
+/** Loki, like Prometheus, refuses more than 11,000 points per series; far fewer is readable. */
+const MAX_POINTS = 1e3;
+const TARGET_POINTS = 60;
+const notLogs = (res, tool) => {
+	if (res.data.resultType === "streams") throw new TimeArgError(`That is a log query; ${tool} needs a metric query such as \`sum by (app) (count_over_time({...} |= "error" [5m]))\`. Use loki_query_logs to read lines.`);
+};
+const registerMetricTools = (server, client, ctx) => {
+	server.registerTool("loki_query_metric", {
+		title: "Loki: Query Metric",
+		description: "Evaluate a LogQL metric query at one instant: a count, rate or total over a window written into the query, e.g. errors per namespace over the last hour `sum by (namespace) (count_over_time({namespace=~\".+\"} |= \"error\" [1h]))`, or the top 10 `topk(10, ...)`. The right tool for 'how many / which ones' questions — far cheaper than reading lines with loki_query_logs. Labels shared by every series come once as `common_labels`. Series come back largest value first: LogQL's topk() picks the top N but does not order them.",
+		inputSchema: z.object({
+			query: metricQueryArg,
+			time: timeArg("Evaluation time", "now"),
+			limit: z.number().int().min(1).max(2e3).default(100).describe("Maximum series to return (1-2000). Defaults to 100. Use topk() in the query to keep the largest instead of raising this."),
+			sort: z.enum(["value", "labels"]).default("value").describe("value: largest first, applied before `limit` cuts, so a cut keeps the biggest. labels: Loki's own order."),
+			precision: precisionArg
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ query, time, limit, sort, precision }) => wrap(async () => {
+		const at = time !== void 0 ? parseTime(time, ctx.now()) : ctx.now();
+		const res = await client.read("/loki/api/v1/query", {
+			query,
+			time: secondsToNs(at)
+		});
+		notLogs(res, "loki_query_metric");
+		return withNotes({
+			...ctx.tag(),
+			...shapeInstant(res.data, {
+				limit,
+				precision,
+				sort
+			}),
+			...scanned(res.data.stats)
+		}, res);
+	}));
+	server.registerTool("loki_query_metric_range", {
+		title: "Loki: Query Metric Range",
+		description: "Evaluate a LogQL metric query over a time range, for how log volume or error rates changed: a spike, when it started, which service it came from. Each series comes back with stats (min, max, avg, last) and, with view=values, one value per step on a shared grid given by start and step (null where there was nothing). The step is picked for about 60 points unless given; the range in the query (`[5m]`) is independent of it, and usually should match it. Aggregate with sum by — one series per stream is rarely what you want and quickly hits max_query_series.",
+		inputSchema: z.object({
+			query: metricQueryArg,
+			start: timeArg("Range start", "now-1h"),
+			end: timeArg("Range end", "now"),
+			step: z.string().optional().describe("Resolution, as a duration (30s, 5m, 1h) or seconds. Defaults to a round step giving about 60 points."),
+			view: z.enum(["values", "stats"]).default("values").describe("values: stats plus the value at every step. stats: min/max/avg/last only, about a tenth of the size — use it to survey many series before plotting a few."),
+			sort: z.enum([
+				"labels",
+				"max",
+				"avg",
+				"last"
+			]).default("labels").describe("Order of series, applied before `limit` cuts: labels keeps Loki's order; max/avg/last rank highest first, so a cut keeps the biggest."),
+			limit: z.number().int().min(1).max(500).default(20).describe("Maximum series to return (1-500). Defaults to 20."),
+			precision: precisionArg
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ query, start, end, step, view, sort, limit, precision }) => wrap(async () => {
+		const now = ctx.now();
+		const endAt = end !== void 0 ? parseTime(end, now) : now;
+		let startAt = start !== void 0 ? parseTime(start, now) : endAt - 3600;
+		if (startAt >= endAt) throw new TimeArgError("start must be before end.");
+		let stepSeconds;
+		if (step !== void 0) {
+			const parsed = parseDuration(step);
+			if (parsed === void 0 || parsed <= 0) throw new TimeArgError(`Cannot read step "${step}"; use a duration like 30s, 5m or 1h.`);
+			stepSeconds = parsed;
+		} else stepSeconds = autoStep(endAt - startAt, TARGET_POINTS);
+		if (Number.isInteger(stepSeconds)) startAt = Math.floor(startAt / stepSeconds) * stepSeconds;
+		const points = Math.floor((endAt - startAt) / stepSeconds) + 1;
+		if (points > MAX_POINTS) throw new TimeArgError(`${points} points per series is too many (max ${MAX_POINTS}); raise step to at least ${Math.ceil((endAt - startAt) / 999)}s or shorten the range.`);
+		const res = await client.read("/loki/api/v1/query_range", {
+			query,
+			start: secondsToNs(startAt),
+			end: secondsToNs(endAt),
+			step: stepSeconds
+		});
+		notLogs(res, "loki_query_metric_range");
+		if (res.data.resultType !== "matrix") throw new Error(`Expected a matrix from query_range, got ${res.data.resultType}.`);
+		return withNotes({
+			...ctx.tag(),
+			...shapeRange(res.data, {
+				start: startAt,
+				end: endAt,
+				step: stepSeconds,
+				limit,
+				precision,
+				sort,
+				view
+			}),
+			...scanned(res.data.stats)
+		}, res);
+	}));
+};
+// src/tools/request.ts
+/**
+* The read APIs and nothing else: /loki/api/v1/push and the compactor's
+* delete endpoints sit under the same prefix but take POST/PUT/DELETE, which
+* this tool cannot send.
+*/
+const PATH_RE = /^\/(?:loki\/api\/v1|prometheus\/api\/v1)\/[A-Za-z0-9_\-./%]+$|^\/config$/;
+const registerRequestTools = (server, client) => {
+	server.registerTool("loki_request", {
+		title: "Loki: Request",
+		description: "Escape hatch: GET any Loki read endpoint the other tools do not wrap — /loki/api/v1/index/volume_range, /loki/api/v1/format_query (pretty-prints and validates LogQL without running it), /prometheus/api/v1/alerts, or /config (this Loki's whole running configuration, as YAML). The answer is the raw `data` (or text), unshaped, cut at max_chars. Read-only: only GET is ever sent. Prefer the named tools, which shape their output.",
+		inputSchema: z.object({
+			path: z.string().regex(PATH_RE, "The path must start with /loki/api/v1/ or /prometheus/api/v1/ (or be /config), with no query string.").refine((p) => !p.includes(".."), "The path must not contain `..`.").describe("API path, e.g. \"/loki/api/v1/format_query\"."),
+			params: z.record(z.string(), z.union([z.string(), z.array(z.string())])).default({}).describe("Query parameters, e.g. {\"query\": \"{app=\\\"api\\\"}\"}. Times are best sent as unix nanoseconds or RFC3339. A repeated parameter is an array."),
+			max_chars: z.number().int().min(100).max(2e5).default(2e4).describe("Cut the answer at this many characters (100-200000). Defaults to 20000.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ path, params, max_chars }) => wrap(async () => {
+		const res = await client.get(path, params);
+		const text = typeof res.data === "string" ? res.data : JSON.stringify(res.data);
+		if (text === void 0 || text.length <= max_chars) return withNotes({ data: res.data }, res);
+		return withNotes({
+			truncated: true,
+			chars: text.length,
+			note: `Showing the first ${max_chars} of ${text.length} characters; narrow the request with params.`,
+			data: text.slice(0, max_chars)
+		}, res);
+	}));
+};
+// src/tools/rules.ts
+const STATE_RANK = {
+	firing: 0,
+	pending: 1,
+	inactive: 2
+};
+const registerRuleTools = (server, client, ctx) => {
+	server.registerTool("loki_list_rules", {
+		title: "Loki: List Rules",
+		description: "List the Loki ruler's alerting and recording rules (LogQL rules evaluated by Loki itself, not Prometheus or Grafana-managed alerts), with health, last error and, for alerts, whether they are firing — firing first. Answers an empty list when no rule groups exist for this tenant, and 404 when the ruler is not deployed or not routed.",
+		inputSchema: z.object({
+			type: z.enum(["alert", "record"]).optional().describe("Only alerting rules (alert) or only recording rules (record)."),
+			state: z.enum([
+				"firing",
+				"pending",
+				"inactive"
+			]).optional().describe("Only alerting rules in this state."),
+			search: searchArg,
+			include_query: z.boolean().default(false).describe("Include each rule's LogQL expression. Off by default: it is most of the size.")
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: true
+		}
+	}, async ({ type, state, search, include_query }) => wrap(async () => {
+		const res = await client.get("/prometheus/api/v1/rules");
+		const groups = res.data.groups ?? [];
+		const rules = groups.flatMap((g) => g.rules.map((r) => ({
+			g,
+			r
+		}))).filter(({ g, r }) => (type === void 0 || type === "alert" === (r.type === "alerting")) && (state === void 0 || r.state === state) && matches(search, r.name, g.name)).toSorted((a, b) => (STATE_RANK[a.r.state ?? ""] ?? 3) - (STATE_RANK[b.r.state ?? ""] ?? 3) || a.r.name.localeCompare(b.r.name));
+		return withNotes({
+			...ctx.tag(),
+			groups: groups.length,
+			total: rules.length,
+			rules: rules.map(({ g, r }) => shapeRule(g.name, r, include_query))
+		}, res);
+	}));
+};
+// src/tools/index.ts
+const createToolContext = (client, config, hasCredentials, now = () => Date.now() / 1e3) => {
+	let identity;
+	const tenant = resolveTenant(config);
+	return {
+		config,
+		hasCredentials,
+		tenant,
+		tag: () => tenant ? { tenant: tenant.tenant } : {},
+		now,
+		identity: () => {
+			identity ??= fetchIdentity(client).catch((err) => {
+				identity = void 0;
+				throw err;
+			});
+			return identity;
+		}
+	};
+};
+/**
+* Register the tools. Every tool is a read: Loki's mutating endpoints (push,
+* the compactor's delete requests, ruler writes) are deliberately not wrapped,
+* so there is no write flag. `loki_request` is GET-only.
+*/
+const registerTools = (server, client, ctx) => {
+	registerAuthTools(server, ctx);
+	if (!ctx.hasCredentials) return;
+	registerLogTools(server, client, ctx);
+	registerMetricTools(server, client, ctx);
+	registerLabelTools(server, client, ctx);
+	registerIndexTools(server, client, ctx);
+	registerRuleTools(server, client, ctx);
+	registerRequestTools(server, client);
+};
+// src/server.ts
+const SERVER_NAME = BUILD_INFO.name;
+const SERVER_VERSION = BUILD_INFO.version;
+const USER_AGENT = `mcp-loki-js/${BUILD_INFO.version}`;
+const createServer = (opts) => {
+	const { config } = opts;
+	const server = new McpServer({
+		name: SERVER_NAME,
+		version: SERVER_VERSION
+	});
+	const client = new LokiClient({
+		baseUrl: config.url ?? "http://unconfigured.invalid",
+		headers: authHeaders(config),
+		timeoutSeconds: config.timeoutSeconds,
+		maxRetries: config.maxRetries,
+		userAgent: USER_AGENT,
+		...opts.fetch ? { fetch: opts.fetch } : {},
+		...opts.logger ? { logger: opts.logger } : {}
+	});
+	const ctx = createToolContext(client, config, isConfigured(config), opts.now);
+	registerTools(server, client, ctx);
+	return {
+		server,
+		client,
+		ctx
+	};
+};
+export { BUILD_INFO as _, createToolContext as a, fetchIdentity as c, authHeaders as d, authMode as f, setupInstructions as g, resolveTenant as h, createServer as i, LokiClient as l, loadConfig as m, SERVER_VERSION as n, registerTools as o, isConfigured as p, USER_AGENT as r, describeError as s, SERVER_NAME as t, LokiApiError as u };
+
+//# sourceMappingURL=server-B2TOeJ3P.js.map