Connectors · Developer & infrastructure

Sumo Logic MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Sumo Logic and the rest of your systems. It gives your agent 456 Sumo Logic actions (223 reads, 157 writes and 76 that wait for a confirmation) and holds the Sumo Logic credential itself, so the agent never does. It paces Sumo Logic's limits and records every call.

Connect Sumo Logic free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

456actionsin one signed file
223readlook, never change
157writecreate and update
76wait for a yesdestructive, confirmed first

Set up

Connect Sumo Logic in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Sumo Logic.
Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- access_idSumo Logic Access ID: in Sumo Logic go to Administration > Security > Access Keys (or your Preferences > Personal…
- access_keySumo Logic Access Key (shown once, when the access key is created)
- hostWhere your Sumo Logic lives: your host
```
account { op: "connections.requirements", service: "sumo_logic" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "sumo_logic.users.list" }# get a list of users · read · 1 upstream callcheck { action: "sumo_logic.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Sumo Logic at a glance

Sign-in: Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: access_idaccess_key
Setup fields: host
Limits we pace to: 4 calls a second, per connection
API covered: Sumo Logic API v1/v2 (OpenAPI 3.0) plus the Collector Management API v1, at your Sumo Logic instance's API base URL, which you enter when connecting (path /api)
Built from: Sumo Logic's documentation, read 23 October 2026api.sumologic.com sumologic.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 166 of 223 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 4, so ask can line Sumo Logic up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Sumo Logic.

456 actions in 186 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

223readlook, never change
157writecreate and update
76destructivewait for a confirmation

Parsers
13
4 read · 7 write · 2 destructive
Create a folder or parser · Copy a folder or parser · Read a folder or parser · Read a folder or parser by its path
Monitors
12
4 read · 6 write · 2 destructive
Create a monitor or folder · Get a monitor or folder · Update a monitor or folder · Delete a monitor or folder
Slos
11
4 read · 5 write · 2 destructive
Create a slo or folder · Get a slo or folder · Update a slo or folder · Delete a slo or folder
Roles
10
4 read · 4 write · 2 destructive
Get a list of roles · Create a new role · Get a role · Update a role
Metrics searches
9
3 read · 4 write · 2 destructive
Save a metrics search · Create a new metrics search page · List all metrics search pages · Get a metrics search
Muting schedules
9
3 read · 4 write · 2 destructive
Create a mutingschedule or folder · Copy a mutingschedule or folder · Get a mutingschedule or folder · Bulk read a mutingschedule or folder
Source templates
8
3 read · 4 write · 1 destructive
Create source template · Preview source template linking changes · List all source templates · Get a source template by Id
Apps
7
3 read · 3 write · 1 destructive
List available apps · List apps · Get an app by UUID · Install an app by UUID

178 more areas · 377 actions

Connections 7
Lookup tables 7
Source template 7
Users 7
Data masking rules 6
Oauth clients 6
Partitions 6
Scheduled views 6
Scim users 6
Access keys 5
Account subdomain 5
Budgets 5
Collectors 5
Collectors sources 5
Content 5
Dashboards 5
Dashboards report schedules 5
Dataarchiving destinations 5
Dynamic parsing rules 5
Event extraction rules 5
Extraction rules 5
Fields 5
Ingest budgets 5
Log searches 5
Logs data forwarding destinations 5
Logs data forwarding rules 5
Macros 5
Service accounts 5
Service accounts access keys 5
Tokens 5
Transformation rules 5
Content folders 4
Data deletion rules 4
Multi account management content sync 4
Roles users 4
Saml identity providers 4
Tracing spanquery 4
Apps subscription 3
Archive jobs 3
Content permissions 3
Monitors permissions 3
Ot collectors 3
Saml allowlisted users 3
Search jobs 3
Service allowlist addresses 3
Threat intel datastore indicators 3
Apps install status 2
Budgets usage 2
Collectors offline 2
Collectors upgrades 2
Dashboards migrate 2
Feature settings 2
Fields builtin 2
Oauth consents 2
Password policy 2
Plan pending update request 2
Policies access keys lifetime 2
Policies audit 2
Policies data access level 2
Policies data deletion 2
Policies max user session timeout 2
Policies o auth cimd 2
Policies search audit 2
Policies share dashboards outside organization 2
Policies timestamp format 2
Policies user concurrent sessions limit 2
Saml lockdown 2
Service allowlist 2
System parsers 2
Threat intel datastore DB 2
Tracing tracequery 2
Tracing traces spans 2
Access keys personal 1
Access keys scopes 1
Account account owner 1
Account status 1
Account usage forecast 1
Account usage report 1
Account usage report status 1
Apps details 1
Apps uninstall status 1
Apps upgrade status 1
Archive jobs count 1
Collectors name 1
Collectors overview 1
Collectors upgrades collectors 1
Collectors upgrades targets 1
Content copy status 1
Content delete 1
Content delete status 1
Content export result 1
Content export status 1
Content folders admin recommended 1
Content folders admin recommended result 1
Content folders admin recommended status 1
Content folders global 1
Content folders global result 1
Content folders global status 1
Content folders import result 1
Content folders import status 1
Content folders installed apps 1
Content folders installed apps result 1
Content folders installed apps status 1
Content folders personal 1
Dashboards migrate result 1
Dashboards migrate status 1
Dashboards report jobs 1
Dashboards report jobs status 1
Data deletion rules delete 1
Event extraction rules quota 1
Fields disable 1
Fields dropped 1
Fields quota 1
Health events 1
Health events resources 1
Ingest budgets usage 1
Log searches estimated usage 1
Log searches estimated usage by metering type 1
Log searches estimated usage by tier 1
Log searches estimated usage by view 1
Lookup tables jobs status 1
Metrics queries 1
Monitors export 1
Monitors permission summaries by subjects 1
Monitors playbooks 1
Monitors playbooks details 1
Monitors root 1
Monitors search 1
Monitors usage info 1
Multi account management content sync info 1
Multi account management content sync result 1
Multi account management content sync status 1
Muting schedules export 1
Muting schedules root 1
Muting schedules search 1
Oauth scopes 1
Organizations usages 1
Ot collectors offline 1
Ot collectors ot collectors by name 1
Ot collectors total count 1
Parsers export 1
Parsers root 1
Parsers search 1
Partitions quota 1
Scheduled views disable 1
Scheduled views quota 1
Schema identities grouped 1
Search jobs messages 1
Search jobs records 1
Service allowlist status 1
Slos export 1
Slos root 1
Slos search 1
Slos sli 1
Slos usage info 1
Threat intel datastore data source 1
Tracing metrics 1
Tracing service map 1
Tracing spanquery aggregates 1
Tracing spanquery fields 1
Tracing spanquery fields values 1
Tracing spanquery rows facets 1
Tracing spanquery rows spans 1
Tracing spanquery status 1
Tracing tracequery fields 1
Tracing tracequery fields values 1
Tracing tracequery rows traces 1
Tracing tracequery status 1
Tracing traces 1
Tracing traces critical path 1
Tracing traces critical path breakdown service 1
Tracing traces exists 1
Tracing traces spans billing info 1
Tracing traces trace events 1
Upgrade source template 1
Users email 1
Users mfa 1
Users password 1

Top actions

The Sumo Logic API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 36 of Sumo Logic's 36 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`sumo_logic.users.list`Get a list of users	Get a list of users.	read	`identity.user.list`474 connectors
`sumo_logic.roles.list`Get a list of roles	Get a list of roles.	read	`identity.role.list`184 connectors
`sumo_logic.users.create`Create a new user	Create a new user.	write	`identity.user.create`262 connectors
`sumo_logic.service_accounts.list`Get a list of service accounts	Get a list of service accounts.	read	`identity.service_account.list`35 connectors
`sumo_logic.roles.create`Create a new role	Create a new role.	write	`identity.role.create`105 connectors
`sumo_logic.users.delete`Delete a user	Delete a user.	destructive	`identity.user.delete`253 connectors
`sumo_logic.service_accounts.create`Create a new service account	Create a new service account.	write	`identity.service_account.create`32 connectors
`sumo_logic.access_keys.create`Create an access key	Create an access key.	write	`identity.api_key.create`100 connectors
`sumo_logic.access_keys.list`List all access keys	List all access keys.	read	`identity.api_key.list`96 connectors
`sumo_logic.monitors.create`Create a monitor or folder	Create a monitor or folder.	write	`monitoring.monitor.create`27 connectors
`sumo_logic.monitors_search.list`Search for a monitor or folder	Search for a monitor or folder.	read	`monitoring.monitor.search`2 connectors
`sumo_logic.saml_identity_providers.create`Create a new SAML configuration	Create a new SAML configuration.	write	`identity.identity_provider.create`15 connectors

Try it

Prompts to paste into Claude.

Each one names the Sumo Logic actions it will call, so you know what it reads and what it changes before you send it.

Readread
Who has access in Sumo Logic? List every user and their role.
callssumo_logic.users.list
Writewrite
Create a new user in Sumo Logic. Show me exactly what you will send before you save it.
callssumo_logic.users.create

Governance for Sumo Logic

Destructive actions wait for a yes.

76 Sumo Logic actions are destructive. The first 10:

Delete a usersumo_logic.users.delete
Delete a rolesumo_logic.roles.delete
Delete a service accountsumo_logic.service_accounts.delete
Delete a monitor or foldersumo_logic.monitors.delete
Delete an access keysumo_logic.access_keys.delete
Delete a SAML configurationsumo_logic.saml_identity_providers.delete
Delete a dashboardsumo_logic.dashboards.delete
Delete a slo or foldersumo_logic.slos.delete
Delete a custom fieldsumo_logic.fields.delete
Delete a macrosumo_logic.macros.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dosumo_logic.users.deleteconfirm_policy: human

Delete a user?

intent: the user asked me to delete a user

run suspended · waiting for a named person · key sumo-logic-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "sumo-logic-agent",  allowed_actions: ["sumo_logic.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "sumo_logic.users.delete", approver: "[email protected]" },    { match: "sumo_logic.roles.delete", approver: "[email protected]" },    { match: "sumo_logic.service_accounts.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Sumo Logic only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Sumo Logic costs on actionlake.

Every Sumo Logic action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Sumo Logic refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 456 Sumo Logic actions
456actions pageeach page of a long list is one call
166reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Sumo Logic action.

456 actions by area: the id your agent calls, what it does, and its effect.

Parsers13

sumo_logic.parsers.copyCopy a folder or parserwrite
sumo_logic.parsers.createCreate a folder or parserwrite
and 11 more in this area

Monitors12

sumo_logic.monitors.createCreate a monitor or folderwrite
sumo_logic.monitors.deleteDelete a monitor or folderdestructive
and 10 more in this area

Slos11

sumo_logic.slos.createCreate a slo or folderwrite
sumo_logic.slos.deleteDelete a slo or folderdestructive
and 9 more in this area

Roles10

sumo_logic.roles.createCreate a new rolewrite
sumo_logic.roles.getGet a roleread
and 8 more in this area

Metrics searches9

sumo_logic.metrics_searches.createSave a metrics searchwrite
sumo_logic.metrics_searches.getGet a metrics searchread
and 7 more in this area

Muting schedules9

sumo_logic.muting_schedules.copyCopy a mutingschedule or folderwrite
sumo_logic.muting_schedules.createCreate a mutingschedule or folderwrite
and 7 more in this area

Source templates8

sumo_logic.source_templates.createCreate source templatewrite
sumo_logic.source_templates.getGet a source template by Idread
and 6 more in this area

Apps7

sumo_logic.apps.getGet an app by UUIDread
sumo_logic.apps.installInstall an app by UUIDwrite
and 5 more in this area

Connections7

sumo_logic.connections.createCreate a new connectionwrite
sumo_logic.connections.getGet a connectionread
and 5 more in this area

Lookup tables7

sumo_logic.lookup_tables.createCreate a lookup tablewrite
sumo_logic.lookup_tables.getGet a lookup tableread
and 5 more in this area

Source template7

sumo_logic.source_template.createCreate source template (deprecated)write
sumo_logic.source_template.getGet a source template by Id (deprecated)read
and 5 more in this area

Users7

sumo_logic.users.createCreate a new userwrite
sumo_logic.users.getGet a userread
and 5 more in this area

Data masking rules6

sumo_logic.data_masking_rules.createCreate a new data masking rulewrite
sumo_logic.data_masking_rules.evaluateTest and preview a regex pattern by evaluating it against sample input text. Optionally provide a maskString to use as the replacement for text that matches the regexread
and 4 more in this area

Oauth clients6

sumo_logic.oauth_clients.createCreate a new OAuth clientwrite
sumo_logic.oauth_clients.getGet an OAuth clientread
and 4 more in this area

Partitions6

sumo_logic.partitions.createCreate a new partitionwrite
sumo_logic.partitions.getGet a partitionread
and 4 more in this area

Scheduled views6

sumo_logic.scheduled_views.createCreate a new scheduled viewwrite
sumo_logic.scheduled_views.getGet a scheduled viewread
and 4 more in this area

Scim users6

sumo_logic.scim_users.createCreate SCIM Userwrite
sumo_logic.scim_users.getGet a SCIM Userread
and 4 more in this area

Access keys5

sumo_logic.access_keys.createCreate an access keywrite
sumo_logic.access_keys.deleteDelete an access keydestructive
and 3 more in this area

Account subdomain5

sumo_logic.account_subdomain.createCreate account subdomainwrite
sumo_logic.account_subdomain.getGet the configured subdomainread
and 3 more in this area

Budgets5

sumo_logic.budgets.createCreates a budget definitionwrite
sumo_logic.budgets.getGet budgetread
and 3 more in this area

Collectors5

sumo_logic.collectors.createCreate a Hosted Collectorwrite
sumo_logic.collectors.getGet a collector by idread
and 3 more in this area

Collectors sources5

sumo_logic.collectors_sources.createCreate a source on a collectorwrite
sumo_logic.collectors_sources.getGet a source by idread
and 3 more in this area

Content5

sumo_logic.content.copyStart a content copy jobwrite
sumo_logic.content.exportStart a content export jobwrite
and 3 more in this area

Dashboards5

sumo_logic.dashboards.createCreate a new dashboardwrite
sumo_logic.dashboards.getGet a dashboardread
and 3 more in this area

Dashboards report schedules5

sumo_logic.dashboards_report_schedules.createSchedule dashboard reportwrite
sumo_logic.dashboards_report_schedules.getGet dashboard report scheduleread
and 3 more in this area

Dataarchiving destinations5

sumo_logic.dataarchiving_destinations.createCreate a data archiving destinationwrite
sumo_logic.dataarchiving_destinations.getGet a data archiving destinationread
and 3 more in this area

Dynamic parsing rules5

sumo_logic.dynamic_parsing_rules.createCreate a new dynamic parsing rulewrite
sumo_logic.dynamic_parsing_rules.getGet a dynamic parsing ruleread
and 3 more in this area

Event extraction rules5

sumo_logic.event_extraction_rules.createCreate event extraction rulewrite
sumo_logic.event_extraction_rules.getGet an event extraction ruleread
and 3 more in this area

Extraction rules5

sumo_logic.extraction_rules.createCreate a new field extraction rulewrite
sumo_logic.extraction_rules.getGet a field extraction ruleread
and 3 more in this area

Fields5

sumo_logic.fields.createCreate a new fieldwrite
sumo_logic.fields.enableEnable custom field with a specified identifierwrite
and 3 more in this area

Ingest budgets 5Log searches 5Logs data forwarding destinations 5Logs data forwarding rules 5Macros 5Service accounts 5Service accounts access keys 5Tokens 5Transformation rules 5Content folders 4Data deletion rules 4Multi account management content sync 4Roles users 4Saml identity providers 4Tracing spanquery 4Apps subscription 3Archive jobs 3Content permissions 3Monitors permissions 3Ot collectors 3Saml allowlisted users 3Search jobs 3Service allowlist addresses 3Threat intel datastore indicators 3Apps install status 2Budgets usage 2Collectors offline 2Collectors upgrades 2Dashboards migrate 2Feature settings 2Fields builtin 2Oauth consents 2Password policy 2Plan pending update request 2Policies access keys lifetime 2Policies audit 2Policies data access level 2Policies data deletion 2Policies max user session timeout 2Policies o auth cimd 2Policies search audit 2Policies share dashboards outside organization 2Policies timestamp format 2Policies user concurrent sessions limit 2Saml lockdown 2Service allowlist 2System parsers 2Threat intel datastore DB 2Tracing tracequery 2Tracing traces spans 2Access keys personal 1Access keys scopes 1Account account owner 1Account status 1Account usage forecast 1Account usage report 1Account usage report status 1Apps details 1Apps uninstall status 1Apps upgrade status 1Archive jobs count 1Collectors name 1Collectors overview 1Collectors upgrades collectors 1Collectors upgrades targets 1Content copy status 1Content delete 1Content delete status 1Content export result 1Content export status 1Content folders admin recommended 1Content folders admin recommended result 1Content folders admin recommended status 1Content folders global 1Content folders global result 1Content folders global status 1Content folders import result 1Content folders import status 1Content folders installed apps 1Content folders installed apps result 1Content folders installed apps status 1Content folders personal 1Dashboards migrate result 1Dashboards migrate status 1Dashboards report jobs 1Dashboards report jobs status 1Data deletion rules delete 1Event extraction rules quota 1Fields disable 1Fields dropped 1Fields quota 1Health events 1Health events resources 1Ingest budgets usage 1Log searches estimated usage 1Log searches estimated usage by metering type 1Log searches estimated usage by tier 1Log searches estimated usage by view 1Lookup tables jobs status 1Metrics queries 1Monitors export 1Monitors permission summaries by subjects 1Monitors playbooks 1Monitors playbooks details 1Monitors root 1Monitors search 1Monitors usage info 1Multi account management content sync info 1Multi account management content sync result 1Multi account management content sync status 1Muting schedules export 1Muting schedules root 1Muting schedules search 1Oauth scopes 1Organizations usages 1Ot collectors offline 1Ot collectors ot collectors by name 1Ot collectors total count 1Parsers export 1Parsers root 1Parsers search 1Partitions quota 1Scheduled views disable 1Scheduled views quota 1Schema identities grouped 1Search jobs messages 1Search jobs records 1Service allowlist status 1Slos export 1Slos root 1Slos search 1Slos sli 1Slos usage info 1Threat intel datastore data source 1Tracing metrics 1Tracing service map 1Tracing spanquery aggregates 1Tracing spanquery fields 1Tracing spanquery fields values 1Tracing spanquery rows facets 1Tracing spanquery rows spans 1Tracing spanquery status 1Tracing tracequery fields 1Tracing tracequery fields values 1Tracing tracequery rows traces 1Tracing tracequery status 1Tracing traces 1Tracing traces critical path 1Tracing traces critical path breakdown service 1Tracing traces exists 1Tracing traces spans billing info 1Tracing traces trace events 1Upgrade source template 1Users email 1Users mfa 1Users password 1

This index shows a sample of each area. All 456 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Sumo Logic MCP server, answered.

Is there a Sumo Logic MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 456 Sumo Logic actions across parsers, monitors, slos and roles, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Sumo Logic.

What do I need to connect Sumo Logic?

Sumo Logic Access ID: in Sumo Logic go to Administration > Security > Access Keys (or your Preferences > Personal… and Sumo Logic Access Key (shown once, when the access key is created). Plus your host. The free call account { op: "connections.requirements", service: "sumo_logic" } lists exactly what to paste.

Can an AI agent delete or change things in Sumo Logic?

Only if its key allows it, and only with an explicit confirmation. 76 Sumo Logic actions are destructive, including delete a user, delete a role and delete a service account. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Sumo Logic API limit?

actionlake paces every call to the limits in the Sumo Logic service file: 4 calls a second per connection. Repeated reads are answered from cache (166 Sumo Logic actions can be), which never reaches Sumo Logic.

What does a Sumo Logic action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (456 Sumo Logic actions page). Cache hits, searches, dry runs and calls Sumo Logic refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Sumo Logic API does it cover?

The Sumo Logic API v1/v2 (OpenAPI 3.0) plus the Collector Management API v1 at your Sumo Logic instance's API base URL, which you enter when connecting (path /api). It is built from Sumo Logic's documentation as read on 23 October 2026. 456 actions in 186 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Sumo Logic data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Sumo Logic credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Sumo Logic today.

Connect Sumo Logic free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Sumo Logic MCP server for AI agents.

Connect Sumo Logic in three steps.

Add actionlake to Claude.

Connect Sumo Logic.

Make the first call. Check before a write.

What an AI agent can do in Sumo Logic.

Parsers

Monitors

Slos

Roles

Metrics searches

Muting schedules

Source templates

Apps