Skip to content

sumologic/sumo-logic

v1.0.1Apache-2.0

Query logs, alerts, dashboards, SIEM insights, and detection rules from Sumo Logic for production debugging, incident response, and security investigation

GitHubOpen Website

Sumo Logic AI Plugins

AI coding tool plugins for Sumo Logic — connecting GitHub Copilot, Claude Code, and other AI development tools to the Sumo Logic observability platform.

What You Get

  • MCP tools — runLogSearch, listPartitions, listCustomFields, listExtractionRules, dashboards, alerts, SIEM insights, and detection rules
  • /sumo-investigator — Senior investigation agent that answers natural language operational questions using Sumo Logic platform data

Prerequisites

  • Sumo Logic account with credentials (any role — no admin required for CIMD)
  • Your deployment's MCP server URL (see table below)
RegionMCP Server URL
US East (N. Virginia)https://mcp.sumologic.com/mcp
US West (Oregon)https://mcp.us2.sumologic.com/mcp
Europe (Ireland)https://mcp.eu.sumologic.com/mcp
Europe (Frankfurt)https://mcp.de.sumologic.com/mcp
Asia Pacific (Tokyo)https://mcp.jp.sumologic.com/mcp
Asia Pacific (Sydney)https://mcp.au.sumologic.com/mcp
Asia Pacific (Seoul)https://mcp.kr.sumologic.com/mcp
Canada (Central)https://mcp.ca.sumologic.com/mcp
FedRAMP (US East)https://mcp.fed.sumologic.com/mcp

Kiro IDE

Installation

The Kiro Power is built to the Agent Plugins v1.0.0 specification. Add it from this repository's GitHub URL in the Kiro Powers panel (Add Custom Power → Import power from GitHub). It will also be searchable as Sumo Logic once listed in the Kiro Powers directory.

First-time setup

After installation, ask Kiro to set up Sumo Logic. The built-in sumosetup skill will:

  1. Ask which Sumo Logic deployment you use and configure the MCP server endpoint automatically
  2. Guide you through OAuth 2.0 authentication (no client ID or admin setup required — uses a Sumo Logic-hosted CIMD document)
  3. Verify the connection is working

Kiro also shows the power's own placeholder sumo-logic server as failed; ignore or disable it. The server written by setup is the one that connects. This is a Kiro limitation: powers cannot declare OAuth settings in their mcp.json (kirodotdev/Kiro#11964).

If you later switch deployments, clear the stored authentication for the sumo-logic server in Kiro's MCP panel first, then run setup again.

Usage

Ask naturally about your Sumo Logic data:

Show me error logs from the last hour
What alerts are currently triggered?
Are there any critical security insights from today?
List my dashboards

The sumo-investigator skill guides Kiro through a structured 3-step log search workflow (Discover → Sample → Targeted Query) and covers logs, alerts, SIEM insights, detection rules, and dashboards.

GitHub Copilot

Works with both the VS Code Copilot extension and Copilot CLI from a single plugin.

Installation

VS Code:

  1. Open the Extensions activity bar
  2. Enter @agentPlugins sumo-logic in the search field
  3. Select the Sumo Logic plugin and click Install

Copilot CLI:

copilot plugin install sumo-logic@awesome-copilot

First-time setup

After installation, run /sumosetup in Copilot chat. The skill will:

  1. Ask which Sumo Logic deployment you use
  2. Configure the MCP server with the correct endpoint
  3. Guide you through OAuth authentication

Usage

Ask naturally about your Sumo Logic data:

Show me error logs from the last hour
What alerts are currently triggered?
Are there any critical security insights from today?
List my dashboards

Or invoke the investigation skill directly:

/sumo-investigator what errors are happening in the API gateway?

Claude Code and Claude Cowork

Installation

Claude Code: run /plugins and search for sumologic-mcp, then install it.

Claude Cowork: go to Customize → Plugins → Discover, search for sumologic-mcp, and add it.

On first enable, you are prompted for your MCP Server URL from the table above.

Authentication

The plugin uses OAuth 2.0 with CIMD (Client ID Metadata Documents) — no pre-created credentials or admin setup required. Claude Code handles authentication and token refresh automatically.

First-time setup

  1. Launch Claude Code with the plugin installed
  2. Run /mcp
  3. Select sumo-logic → Authenticate
  4. A browser window opens — log in with your Sumo Logic credentials
    • If your org uses an identity provider, click Sign in with your identity provider
  5. Run /mcp again — the server should show as connected

Switching organizations

To connect to a different Sumo Logic org:

  1. Run /mcp
  2. Select sumo-logic → Clear authentication
  3. Select Authenticate and log in to the new org

Note: If you previously granted consent for an org, you will not be prompted again. To revoke consent, go to your Sumo Logic user settings and remove the app under Personal Authorized Apps.

Manual OAuth (pre-registered client)

For environments that don't support CIMD, an administrator can create an OAuth client manually:

  1. Create an Authorization Code client in Sumo Logic with redirect URI http://localhost:8888/callback
  2. Register manually in Claude Code:
claude mcp add --scope user --transport http \
  --client-id "<client-id>" --client-secret --callback-port 8888 \
  sumo-logic "https://mcp.sumologic.com/mcp"

Usage

Investigation Skill

/sumologic-mcp:sumo-investigator what errors are happening in the API gateway in the last hour?
/sumologic-mcp:sumo-investigator are there any critical security insights from today?
/sumologic-mcp:sumo-investigator show me triggered alerts for the collector service

The skill follows a structured 3-step workflow (Discover → Scoped Sample → Targeted Query) and covers logs, alerts, SIEM insights, detection rules, and dashboards.

Direct Tool Use

You can also ask naturally without invoking the skill — Claude will use the MCP tools directly:

Search sumo for HTTP 500 errors in the last 15 minutes
Show me critical security insights from this week
List dashboards related to kubernetes

Privacy & Support

License

Apache-2.0