Connectors · Developer & infrastructure

Graylog MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Graylog and the rest of your systems. It gives your agent 662 Graylog actions (397 reads, 186 writes and 79 that wait for a confirmation) and holds the Graylog credential itself, so the agent never does. It paces Graylog's limits and records every call.

Connect Graylog free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

662actionsin one signed file
397readlook, never change
186writecreate and update
79wait for a yesdestructive, confirmed first

Set up

Connect Graylog in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Graylog.
Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- access_tokenGraylog access token
- hostWhere your Graylog lives: your host
```
account { op: "connections.requirements", service: "graylog" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "graylog.users.get_page" }# get paginated list of users · read · 1 upstream callcheck { action: "graylog.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Graylog at a glance

Sign-in: Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: access_token
Setup fields: host
Limits we pace to: 10 calls a second, per connection
API covered: Graylog 7.2.1+25725f2 REST API (OpenAPI 3.1, served at /api/openapi), at your Graylog instance's API base URL, which you enter when connecting
Built from: Graylog's documentation, read 23 October 2026GitHub go2docs.graylog.org
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 317 of 397 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 2, so ask can line Graylog up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Graylog.

662 actions in 162 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

397readlook, never change
186writecreate and update
79destructivewait for a confirmation

System lookup
25
15 read · 6 write · 4 destructive
List available data adapters · List available caches · Create a new data adapter · Create a new cache
Streams
20
10 read · 8 write · 2 destructive
Get a paginated list of streams · Create a stream · Get a single stream · Update a stream
Events definitions
19
8 read · 9 write · 2 destructive
Get a paginated list of event definitions · Create new event definition · Get an event definition · Update existing event definition
Tools
18
18 read · 0 write · 0 destructive
Split and index test (tools) · Test contains string (tools) · Test grok (tools) · Test json (tools)
Users
18
7 read · 6 write · 5 destructive
Get paginated list of users · Create a new user account · Get user details by userId · Modify user details
Pipelines rules
14
10 read · 3 write · 1 destructive
Create a processing rule from source · Get function descriptors · Get all processing rules · Retrieve the named processing rules in bulk
Indexer indices
13
10 read · 1 write · 2 destructive
Get information of all specified indices and their shards · Reopen a closed index. This will also trigger an index ranges rebuild job · List all open, closed and reopened indices · Get a list of closed indices that can be reopened
System content packs
12
7 read · 2 write · 3 destructive
Upload a content pack · Install a revision of a content pack · Download a revision of a content pack · Get a revision of a content pack

154 more areas · 523 actions

System inputs 12
Pipelines pipelines 10
Sidecar configurations 10
Datanode 9
Events notifications 9
Search 9
System index sets 9
Roles 8
Sidecar collectors 8
System grok 8
Views 8
Authorization roles 7
Collectors fleets 7
Stream rules 7
System 7
System authentication services backends 7
System index sets templates 7
System notifications 7
Aws 6
Cluster 6
Collectors 6
Events 6
Extractors 6
Pipelines rulebuilder 6
Sidecar 6
Sidecar configuration variables 6
Stream destinations filters 6
System index sets field type profiles 6
System indexer indices 6
System input states 6
System outputs 6
System stats 6
Collectors sources 5
Data node rolling restart 5
Search decorators 5
System deflector 5
System field types 5
System index ranges 5
System jobs 5
System metrics 5
Authorization shares 4
Cluster debug support bundle 4
Cluster input state 4
Cluster system loggers 4
Collectors config 4
Data nodes API 4
Data nodes rest API 4
Datanode upgrade 4
Entity lists 4
Indexer indices templates 4
Migration 4
Op amp enrollment 4
Pipelines connections 4
Search simple 4
Stream outputs 4
System cluster 4
System cluster config 4
System debug events 4
System debug support bundle 4
System index sets types 4
System loggers 4
System notification message 4
System URL allowlist 4
Authorization capabilities 3
Aws cloud trail 3
Aws kinesis auto 3
Cluster deflector 3
Cluster jobs 3
Cluster node metrics 3
Content stream 3
Favorite fields 3
Favorites 3
Field types 3
Indexer cluster 3
Messages 3
Onboarding 3
Search export 3
Stream destinations filters builder 3
System catalog 3
System cluster stats 3
System inputs types 3
System mongodb 3
System processing 3
System sessions 3
Telemetry 3
Ca 2
Client certificates 2
Cluster processing 2
Cluster processing status 2
Indexer failures 2
Indexer overview 2
Search jobs 2
Search metadata 2
Search suggestions 2
Sidecar administration 2
Sidecar collector actions 2
Start page 2
Static fields 2
System authentication HTTP header auth config 2
System authentication services configuration 2
System authentication services test 2
System configuration 2
System getting started guides 2
System indices retention 2
System indices rotation 2
System message processors 2
System permissions 2
System processing status 2
Authorization grants overview 1
Aws config 1
Certificate renewal 1
Certificates 1
Cluster journal 1
Cluster load balancers 1
Cluster lookup table 1
Cluster metrics 1
Cluster plugins 1
Collectors activity 1
Dashboards 1
Enterprise 1
Entity scope 1
Entity suggestions 1
Events entity types 1
Hello world 1
Legacy search absolute 1
Legacy search keyword 1
Legacy search relative 1
Pipelines processing load 1
Pipelines simulator 1
Quick jump 1
Search functions 1
Search pivot export 1
Search query strings 1
Search saved 1
Search validation 1
Stream routing rules 1
Stream rules inputs 1
Streams metrics 1
System authentication services 1
System cluster traffic 1
System codecs types 1
System datanodes 1
System fields 1
System index set defaults 1
System journal 1
System load balancers 1
System messages 1
System opensearch 1
System plugins 1
System search version 1
System service manager 1
System throughput 1
Token usage 1
Views qualifying views 1

Top actions

The Graylog API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 27 of Graylog's 27 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`graylog.users.get_page`Get paginated list of users	Get paginated list of users.	read	`identity.user.list`474 connectors
`graylog.authorization_roles.get_list`Get a paginated list of all roles	Get a paginated list of all roles.	read	`identity.role.list`184 connectors
`graylog.users.create`Create a new user account	Create a new user account.	write	`identity.user.create`262 connectors
`graylog.users.delete`Removes a user account	Removes a user account.	destructive	`identity.user.delete`253 connectors
`graylog.authorization_roles.get`Get a single role	Get a single role.	read	`identity.role.get`127 connectors
`graylog.events_definitions.get_page`Get a paginated list of event definitions	Get a paginated list of event definitions.	read	`monitoring.monitor.list`32 connectors
`graylog.events_definitions.create`Create new event definition	Create new event definition.	write	`monitoring.monitor.create`27 connectors
`graylog.events_notifications.get_page`Get a paginated list of event notifications	Get a paginated list of event notifications.	read	`monitoring.notification_channel.list`18 connectors
`graylog.events_notifications.create`Create new notification definition	Create new notification definition.	write	`monitoring.notification_channel.create`16 connectors
`graylog.dashboards.views`Get a list of all dashboards	Get a list of all dashboards.	read	`monitoring.dashboard.list`15 connectors
`graylog.streams.get_page`Get a paginated list of streams	Get a paginated list of streams.	read	`monitoring.log_stream.list`12 connectors
`graylog.streams.create`Create a stream	Create a stream.	write	`monitoring.log_stream.create`8 connectors

Try it

Prompts to paste into Claude.

Each one names the Graylog actions it will call, so you know what it reads and what it changes before you send it.

Readread
Who has access in Graylog? List every user and their role.
callsgraylog.users.get_page
Writewrite
Create a new user account in Graylog. Show me exactly what you will send before you save it.
callsgraylog.users.create

Governance for Graylog

Destructive actions wait for a yes.

79 Graylog actions are destructive. The first 10:

Removes a user accountgraylog.users.delete
Delete a rolegraylog.authorization_roles.delete
Delete event definitiongraylog.events_definitions.delete
Delete a notificationgraylog.events_notifications.delete
Delete a streamgraylog.streams.delete
Remove the named role and dissociate any users from itgraylog.roles.delete
Delete viewgraylog.views.delete
Shutdown (system)graylog.system.shutdown
Shutdown (cluster)graylog.cluster.shutdown
Add a user to a rolegraylog.roles.add_member

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dograylog.users.deleteconfirm_policy: human

Removes a user account?

intent: the user asked me to removes a user account

run suspended · waiting for a named person · key graylog-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "graylog-agent",  allowed_actions: ["graylog.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "graylog.users.delete", approver: "[email protected]" },    { match: "graylog.authorization_roles.delete", approver: "[email protected]" },    { match: "graylog.events_definitions.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Graylog only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Graylog costs on actionlake.

Every Graylog action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Graylog refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 662 Graylog actions
662actions pageeach page of a long list is one call
317reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Graylog action.

662 actions by area: the id your agent calls, what it does, and its effect.

System lookup25

graylog.system_lookup.adaptersList available data adaptersread
graylog.system_lookup.cachesList available cachesread
and 23 more in this area

Streams20

graylog.streams.createCreate a streamwrite
graylog.streams.get_pageGet a paginated list of streamsread
and 18 more in this area

Events definitions19

graylog.events_definitions.createCreate new event definitionwrite
graylog.events_definitions.getGet an event definitionread
and 17 more in this area

Tools18

graylog.tools.split_and_index_testSplit and index test (tools)read
graylog.tools.test_contains_stringTest contains string (tools)read
and 16 more in this area

Users18

graylog.users.change_userModify user detailswrite
graylog.users.createCreate a new user accountwrite
and 16 more in this area

Pipelines rules14

graylog.pipelines_rules.create_from_parserCreate a processing rule from sourcewrite
graylog.pipelines_rules.function_descriptorsGet function descriptorsread
and 12 more in this area

Indexer indices13

graylog.indexer_indices.allList all open, closed and reopened indicesread
graylog.indexer_indices.closedGet a list of closed indices that can be reopenedread
and 11 more in this area

System content packs12

graylog.system_content_packs.create_content_packUpload a content packwrite
graylog.system_content_packs.download_content_pack_revisionsDownload a revision of a content packread
and 10 more in this area

System inputs12

graylog.system_inputs.createLaunch input on this nodewrite
graylog.system_inputs.get_pageGet a paginated list of inputsread
and 10 more in this area

Pipelines pipelines10

graylog.pipelines_pipelines.create_from_parserCreate a processing pipeline from sourcewrite
graylog.pipelines_pipelines.get_allGet all processing pipelinesread
and 8 more in this area

Sidecar configurations10

graylog.sidecar_configurations.copy_configurationCopy a configurationwrite
graylog.sidecar_configurations.create_configurationCreate new configurationwrite
and 8 more in this area

Datanode9

graylog.datanode.bulk_startStart multiple nodes in the clusterwrite
graylog.datanode.bulk_stopStop multiple nodes in the clusterwrite
and 7 more in this area

Events notifications9

graylog.events_notifications.createCreate new notification definitionwrite
graylog.events_notifications.getGet a notificationread
and 7 more in this area

Search9

graylog.search.create_search_v2Create a search querywrite
graylog.search.execute_queryExecute the referenced search query asynchronouslywrite
and 7 more in this area

System index sets9

graylog.system_index_sets.getGet index setread
graylog.system_index_sets.global_statsGet stats of all index setsread
and 7 more in this area

Roles8

graylog.roles.createCreate a new rolewrite
graylog.roles.get_membersRetrieve the role's membersread
and 6 more in this area

Sidecar collectors8

graylog.sidecar_collectors.copy_collectorCopy a collectorwrite
graylog.sidecar_collectors.create_collectorCreate a new collectorwrite
and 6 more in this area

System grok8

graylog.system_grok.bulk_update_patternsAdd a list of new patternswrite
graylog.system_grok.create_patternAdd a new named patternwrite
and 6 more in this area

graylog.views.createCreate a new viewwrite
graylog.views.duplicateDuplicate an existing viewwrite
and 6 more in this area

Authorization roles7

graylog.authorization_roles.deleteDelete a roledestructive
graylog.authorization_roles.getGet a single roleread
and 5 more in this area

Collectors fleets7

graylog.collectors_fleets.bulk_statsGet statistics for all fleetsread
graylog.collectors_fleets.createCreate a new fleetwrite
and 5 more in this area

Stream rules7

graylog.stream_rules.createCreate a stream rulewrite
graylog.stream_rules.getGet a single stream rulesread
and 5 more in this area

System7

graylog.system.get_metricsGet metrics for multiple inputsread
graylog.system.jvmGet JVM informationread
and 5 more in this area

System authentication services backends7

graylog.system_authentication_services_backends.createCreates a new authentication service backendwrite
graylog.system_authentication_services_backends.getReturns the authentication service backend for the given IDread
and 5 more in this area

System index sets templates7

graylog.system_index_sets_templates.built_insGets built-in templatesread
graylog.system_index_sets_templates.createCreates a new editable templatewrite
and 5 more in this area

System notifications7

graylog.system_notifications.bulk_deleteBulk delete notifications by their IDsdestructive
graylog.system_notifications.get_countGet the count of active system notificationsread
and 5 more in this area

Aws6

graylog.aws.createCreate a new AWS inputwrite
graylog.aws.get_kinesis_streamsGet all available Kinesis streams for the specified regionread
and 4 more in this area

Cluster6

graylog.cluster.cluster_process_buffer_dumpGet a process buffer dump of all cluster nodesread
graylog.cluster.getGet system overview of all Graylog nodesread
and 4 more in this area

Collectors6

graylog.collectors.find_instancesGet a paginated list of collector instancesread
graylog.collectors.get_instanceGet a collector instanceread
and 4 more in this area

Events6

graylog.events.filter_optionsGet the available values for the given event fieldsread
graylog.events.getGet event by IDread
and 4 more in this area

Extractors 6Pipelines rulebuilder 6Sidecar 6Sidecar configuration variables 6Stream destinations filters 6System index sets field type profiles 6System indexer indices 6System input states 6System outputs 6System stats 6Collectors sources 5Data node rolling restart 5Search decorators 5System deflector 5System field types 5System index ranges 5System jobs 5System metrics 5Authorization shares 4Cluster debug support bundle 4Cluster input state 4Cluster system loggers 4Collectors config 4Data nodes API 4Data nodes rest API 4Datanode upgrade 4Entity lists 4Indexer indices templates 4Migration 4Op amp enrollment 4Pipelines connections 4Search simple 4Stream outputs 4System cluster 4System cluster config 4System debug events 4System debug support bundle 4System index sets types 4System loggers 4System notification message 4System URL allowlist 4Authorization capabilities 3Aws cloud trail 3Aws kinesis auto 3Cluster deflector 3Cluster jobs 3Cluster node metrics 3Content stream 3Favorite fields 3Favorites 3Field types 3Indexer cluster 3Messages 3Onboarding 3Search export 3Stream destinations filters builder 3System catalog 3System cluster stats 3System inputs types 3System mongodb 3System processing 3System sessions 3Telemetry 3Ca 2Client certificates 2Cluster processing 2Cluster processing status 2Indexer failures 2Indexer overview 2Search jobs 2Search metadata 2Search suggestions 2Sidecar administration 2Sidecar collector actions 2Start page 2Static fields 2System authentication HTTP header auth config 2System authentication services configuration 2System authentication services test 2System configuration 2System getting started guides 2System indices retention 2System indices rotation 2System message processors 2System permissions 2System processing status 2Authorization grants overview 1Aws config 1Certificate renewal 1Certificates 1Cluster journal 1Cluster load balancers 1Cluster lookup table 1Cluster metrics 1Cluster plugins 1Collectors activity 1Dashboards 1Enterprise 1Entity scope 1Entity suggestions 1Events entity types 1Hello world 1Legacy search absolute 1Legacy search keyword 1Legacy search relative 1Pipelines processing load 1Pipelines simulator 1Quick jump 1Search functions 1Search pivot export 1Search query strings 1Search saved 1Search validation 1Stream routing rules 1Stream rules inputs 1Streams metrics 1System authentication services 1System cluster traffic 1System codecs types 1System datanodes 1System fields 1System index set defaults 1System journal 1System load balancers 1System messages 1System opensearch 1System plugins 1System search version 1System service manager 1System throughput 1Token usage 1Views qualifying views 1

This index shows a sample of each area. All 662 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Graylog MCP server, answered.

Is there a Graylog MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 662 Graylog actions across system lookup, streams, events definitions and tools, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Graylog.

What do I need to connect Graylog?

Graylog access token. Plus your host. The free call account { op: "connections.requirements", service: "graylog" } lists exactly what to paste.

Can an AI agent delete or change things in Graylog?

Only if its key allows it, and only with an explicit confirmation. 79 Graylog actions are destructive, including removes a user account, delete a role and delete event definition. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Graylog API limit?

actionlake paces every call to the limits in the Graylog service file: 10 calls a second per connection. Repeated reads are answered from cache (317 Graylog actions can be), which never reaches Graylog.

What does a Graylog action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (662 Graylog actions page). Cache hits, searches, dry runs and calls Graylog refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Graylog API does it cover?

The Graylog 7.2.1+25725f2 REST API (OpenAPI 3.1, served at /api/openapi) at your Graylog instance's API base URL, which you enter when connecting. It is built from Graylog's documentation as read on 23 October 2026. 662 actions in 162 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Graylog data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Graylog credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Graylog today.

Connect Graylog free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Graylog MCP server for AI agents.

Connect Graylog in three steps.

Add actionlake to Claude.

Connect Graylog.

Make the first call. Check before a write.

What an AI agent can do in Graylog.

System lookup

Streams

Events definitions

Tools

Users

Pipelines rules

Indexer indices

System content packs