VMware Aria Operations for Logs — MCP Server

MCP server for querying and analyzing logs from VMware Aria Operations for Logs (formerly vRealize Log Insight). Provides log search, mass incident detection, and optional VMware Aria Operations (vROps) correlation.

Built for use with Claude Code, Claude Desktop, LobeChat, and any MCP-compatible client.

Features

• Log Search — Query events with time range, text filters, and field constraints via Log Insight API v2
• Incident Detection — Signature-based clustering to identify mass log incidents (Stormbreaker engine)
• API Surface Probe — Detect appliance version and available API endpoints
• Dashboard Listing — Enumerate saved dashboards (legacy vRLIC API, deprecated on 8.18+)
• vROps Correlation — Cross-reference log entities with Aria Operations resources and alerts

Quick Start

Install via uvx (recommended)

uvx vmware-aria-logs

Install via pip

pip install vmware-aria-logs

Run with environment variables

export LI_BASE_URL=https://loginsight.example.com
export LI_USERNAME=admin
export LI_PASSWORD=your-password
export LI_PROVIDER=Local

vmware-aria-logs

MCP Tools

Tool	Description
query_events	Search log events with time range, text filter, field constraints
get_version	Get appliance version and probe API surface
list_dashboards	List saved dashboards (legacy vRLIC API, deprecated on 8.18+)
detect_incidents	Mass incident detection via signature clustering
find_vrops_resources	Find entities in Aria Operations by name
get_vrops_alerts	Get alerts for specific vROps resources

Configuration

Required Environment Variables

Variable	Description	Default
LI_BASE_URL	Log Insight appliance URL	—
LI_USERNAME	API username	admin
LI_PASSWORD	API password	—
LI_PROVIDER	Auth provider (Local, ActiveDirectory)	Local
LI_VERIFY_TLS	Verify TLS certificates	false
LI_TIMEOUT_SEC	HTTP request timeout (seconds)	30

Optional (vROps Correlation)

Variable	Description	Default
VROPS_BASE_URL	Aria Operations URL	—
VROPS_USERNAME	vROps username	admin
VROPS_PASSWORD	vROps password	—
VROPS_AUTH_SOURCE	Auth source	local
VROPS_VERIFY_TLS	Verify TLS certificates	false
VROPS_TIMEOUT_SEC	HTTP request timeout (seconds)	30

Claude Code / MCP Client Configuration

{
  "mcpServers": {
    "aria-logs": {
      "command": "uvx",
      "args": ["vmware-aria-logs"],
      "env": {
        "LI_BASE_URL": "https://loginsight.example.com",
        "LI_USERNAME": "admin",
        "LI_PASSWORD": "your-password"
      }
    }
  }
}

Why This Server?

VMware Aria Operations for Logs (Log Insight) is widely deployed in enterprise VMware environments, but lacks modern AI-assisted log analysis tooling. This MCP server bridges that gap:

• Zero dependencies beyond the MCP SDK — uses Python stdlib urllib for HTTP
• Stormbreaker engine — unique signature-based clustering that finds mass incidents humans miss
• vROps correlation — cross-reference log events with infrastructure health in a single conversation
• Works on v8.x+ — tested on Aria Operations for Logs 8.18.3, gracefully degrades deprecated APIs

Also Available On

• Smithery
• Glama
• PyPI

License

MIT