@thotischner/observability-mcp 3.1.0 → 3.1.1

package/dist/conformance/mcp-2025-11-25.test.js

@@ -113,6 +113,20 @@ test("MCP 2025-11-25: tools/list returns a Tool[] each with name + inputSchema",
         assert.ok(t.inputSchema && typeof t.inputSchema === "object", `tool ${t.name} missing inputSchema`);
     }
 });
+test("MCP 2025-11-25: query_logs advertises labels + aggregate params (issue #415)", opts, async () => {
+    // Regression guard for the v3.1.0 ship gap: the labels/aggregate handler
+    // code existed but the inline MCP schema in createMcpServer never declared
+    // them, so a live tools/list omitted them and the SDK stripped them from
+    // calls — a silent no-op. Assert the live server advertises both.
+    const session = await newSession();
+    const { response } = await jsonRpc("tools/list", {}, { id: 2, session });
+    const r = response.result;
+    const queryLogs = r.tools?.find((t) => t.name === "query_logs");
+    assert.ok(queryLogs, "query_logs tool must be advertised");
+    const props = queryLogs.inputSchema?.properties ?? {};
+    assert.ok("labels" in props, "query_logs must advertise a `labels` param (issue #415 #1)");
+    assert.ok("aggregate" in props, "query_logs must advertise an `aggregate` param (issue #415 #2)");
+});
 test("MCP 2025-11-25: tools/call dispatches and returns CallToolResult", opts, async () => {
     const session = await newSession();
     const { response } = await jsonRpc("tools/call", { name: "list_sources", arguments: {} }, { id: 3, session });

package/dist/index.js

@@ -437,6 +437,10 @@ async function main() {
                 .string()
                 .optional()
                 .describe("Optional. Filter expression matched against the log message; regular expressions are supported. Omit to return all entries in the window."),
+            labels: z
+                .record(z.string(), z.string())
+                .optional()
+                .describe("Optional. Exact-match filters on backend-extracted log fields (e.g. {\"method\":\"GET\",\"status\":\"200\",\"url\":\"/\",\"environment\":\"prod\"}). All AND'd together and compiled to LogQL label filters applied after `| json`, so structured JSON fields become first-class selectors — far more reliable than regex on the raw message. Combine with `aggregate` to filter then group. Backends without label extraction ignore it."),
             duration: z
                 .string()
                 .optional()
@@ -445,12 +449,34 @@ async function main() {
                 .enum(["error", "warn", "info", "debug"])
                 .optional()
                 .describe("Optional. Return only entries at this severity. Default: all levels."),
+            aggregate: z
+                .object({
+                op: z
+                    .enum(["count_over_time", "sum", "topk"])
+                    .describe("count_over_time = time series of counts per `step` bucket; sum = single total per group over the window; topk = the top `k` groups by total."),
+                by: z
+                    .array(z.string())
+                    .optional()
+                    .describe("Label names to group by, e.g. [\"url\"] or [\"status\"]. Required for topk."),
+                k: z
+                    .number()
+                    .int()
+                    .positive()
+                    .optional()
+                    .describe("For topk: how many top groups to return (1-1000)."),
+                step: z
+                    .string()
+                    .optional()
+                    .describe("For count_over_time: bucket width as <number><unit> m|h|d (e.g. '15m'). Default auto-derived from duration."),
+            })
+                .optional()
+                .describe("Optional. Server-side aggregation pushed down to LogQL metric queries — returns grouped counts, not raw rows, so you get a number instead of a haystack (and never hit `limit`). Honours `labels`/`query` filters. Example: {\"op\":\"topk\",\"by\":[\"url\"],\"k\":10} for the busiest paths; {\"op\":\"count_over_time\",\"step\":\"15m\"} for a request-count time series."),
             limit: z
                 .number()
                 .int()
                 .positive()
                 .optional()
-                .describe("Optional. Maximum number of log entries to return (most recent first). Default: 100."),
+                .describe("Optional. Maximum number of log entries to return (most recent first). Default: 100. Ignored when `aggregate` is set."),
             bypass_redaction: z
                 .boolean()
                 .optional()

package/dist/tools/query-logs-schema.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tools/query-logs-schema.test.js

@@ -0,0 +1,38 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+// Regression guard for issue #415: the query_logs handler (query-logs.ts)
+// reads `labels` and `aggregate` from its args, and validateLogLabels /
+// validateLogAggregate enforce them — but the MCP-facing input schema is
+// declared INLINE in createMcpServer's registerTool("query_logs", …) block
+// in index.ts. In v3.1.0 that inline schema was never updated to advertise
+// `labels`/`aggregate`, so the MCP SDK stripped those keys before they
+// reached the handler: the params were unreachable over MCP and passing
+// them was a silent no-op. The handler unit tests passed because they call
+// the handler directly, bypassing the SDK schema layer.
+//
+// This test parses index.ts and asserts the query_logs registration block
+// declares both fields as schema entries, so the SDK validates and forwards
+// them. The live equivalent (real tools/list handshake) lives in the
+// conformance suite; this is the fast, server-less guard.
+const here = dirname(fileURLToPath(import.meta.url));
+const INDEX_TS = join(here, "..", "index.ts");
+function registerToolBlock(src, tool) {
+    const start = src.indexOf(`registerTool(\n    "${tool}"`);
+    assert.notEqual(start, -1, `registerTool("${tool}", …) not found in index.ts`);
+    // The block ends at the next registerTool( call (or EOF).
+    const next = src.indexOf("registerTool(", start + 1);
+    return src.slice(start, next === -1 ? undefined : next);
+}
+test("query_logs MCP schema advertises `labels` (issue #415 #1)", () => {
+    const block = registerToolBlock(readFileSync(INDEX_TS, "utf8"), "query_logs");
+    assert.match(block, /\blabels:\s*z\b/, "query_logs registration in index.ts must declare a `labels` schema field " +
+        "so the MCP SDK forwards it to the handler (else it is silently stripped).");
+});
+test("query_logs MCP schema advertises `aggregate` (issue #415 #2)", () => {
+    const block = registerToolBlock(readFileSync(INDEX_TS, "utf8"), "query_logs");
+    assert.match(block, /\baggregate:\s*z\b/, "query_logs registration in index.ts must declare an `aggregate` schema field " +
+        "so the MCP SDK forwards it to the handler (else it is silently stripped).");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thotischner/observability-mcp",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Unified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend",
   "type": "module",
   "license": "Apache-2.0",