Coding agents

To ask Copilot about your logs inside Logsift’s own window instead, see the Assistant.

A coding agent such as GitHub Copilot can ask Logsift about your logs. You ask in the agent’s chat, for example “why is orders.log full of timeouts?”. The agent calls Logsift, and Logsift reads the file on your computer and answers with short summaries and line numbers, never whole files. The agent can then search and read the lines around what it found.

It works with GitHub Copilot in VS Code, Visual Studio and JetBrains IDEs, with Copilot CLI, and with any other agent that supports MCP (the Model Context Protocol).

Setting it up

  1. Open Settings → Agents.
  2. Choose your agent in the Agent list. Under it, Logsift says where the setup goes and shows it, with the path of logsift-mcp on this computer filled in.
  3. Click Copy and paste it into the agent’s MCP settings. Merge it with what is already there.
  4. VS Code: choose Agent mode in Copilot Chat. Logsift’s tools are under the tools button. Copilot CLI: start copilot again.

logsift-mcp comes with Logsift:

System Where
Windows next to Logsift.exe
macOS Logsift.app/Contents/MacOS/logsift-mcp
Linux bin/logsift-mcp
The zip for any Java bin/logsift-mcp

A Logsift run from a source build has no logsift-mcp, so the tab says so and Copy is off.

Other agents: add a local (stdio) MCP server called logsift that runs logsift-mcp, with no arguments.

GitHub Copilot CLI

  1. Add Logsift with one command in a terminal, giving the path of logsift-mcp after -- (see the table above; Settings → Agents shows it):

    # macOS
copilot mcp add logsift -- /Applications/Logsift.app/Contents/MacOS/logsift-mcp
# Linux (.deb; from the .tar.gz it is Logsift/bin/logsift-mcp where you unpacked it)
copilot mcp add logsift -- /opt/logsift/bin/logsift-mcp
# Windows (PowerShell; the installer puts Logsift in your own AppData folder)
copilot mcp add logsift -- "$env:LOCALAPPDATA\Logsift\logsift-mcp.exe"

    Or, by hand: open Settings → Agents, choose GitHub Copilot CLI, click Copy, and paste it into ~/.copilot/mcp-config.json (on Windows %USERPROFILE%\.copilot\mcp-config.json). If the file already lists other servers, add "logsift": {…} next to them inside "mcpServers". In this file, a Windows path has each \ written twice ("C:\\Users\\you\\…"). Copy does that for you.

    {
  "mcpServers": {
    "logsift": {
      "type": "local",
      "command": "/Applications/Logsift.app/Contents/MacOS/logsift-mcp",
      "args": [],
      "tools": ["*"]
    }
  }
}
  2. Check it: copilot mcp list lists logsift, and copilot mcp get logsift shows its command.
  3. Start copilot (start it again if it was running).
  4. Ask in plain words, naming the file:
    • What went wrong in ~/logs/orders.log last night?
    • Why did orders fail last night? (with your log locations described)
    • Group the exceptions in /var/log/app/app.log and tell me which started after 10:00.
    • Is the GC in ~/gc.log healthy?
    • Why did the JVM crash? ~/crash/hs_err_pid31337.log
    • Explain the crash in C:\dumps\orders-service.dmp: which thread crashed and what were the others doing?

The first time it uses a Logsift tool, Copilot CLI asks whether to allow it; choose to allow it for the session (or always). Logsift’s tools only read. To skip the question, start it with copilot --allow-tool=logsift.

To remove it: copilot mcp remove logsift.

If logsift isn’t listed, or its tools fail:

When MCP servers are blocked: the skill

Some companies block MCP servers in their agents. Agents that support skills (GitHub Copilot CLI, Copilot in VS Code, Claude Code, and others) can use Logsift without one: the skill tells the agent to run logsift-mcp in its terminal, one tool at a time. The tools, the masking, the folders agents may read and What Agents Asked… are the same as with MCP.

  1. Open Settings → Agents and choose A skill, where MCP servers are blocked in the Agent list.
  2. Click Install for Me. Logsift saves the skill as ~/.copilot/skills/logsift/SKILL.md, where Copilot CLI and VS Code look for your skills.
    • Claude Code: click Copy and save it as ~/.claude/skills/logsift/SKILL.md.
    • For a whole project: save it as .github/skills/logsift/SKILL.md in the project. It names the path of logsift-mcp on your computer, so each person’s may differ.
  3. Start the agent again, and ask as you would with MCP: What went wrong in ~/logs/orders.log last night? The agent asks before it runs a command; allow logsift-mcp.

From a terminal, logsift-mcp skill prints the skill and logsift-mcp skill --install saves it (--install FOLDER saves it in FOLDER/logsift/).

The skill says where your logs are: the services you described in Log Locations for Agents, each with its folders, kinds of files, time zone and notes. Their names are in the skill’s description too, so the agent uses the skill for Why did orders fail last night? without a path. When you change the locations, Logsift saves the installed skill again. A copy you saved elsewhere by hand needs Copy again. With no locations described, the skill tells the agent how you can describe them.

Settings → Agents with the skill chosen: what it is, and Install for Me

The agent runs commands like these (you can too):

logsift-mcp run insights log=~/logs/orders.log
logsift-mcp run search log=~/logs/orders.log query="timed out" limit=20
logsift-mcp run read_lines log=~/logs/orders.log from=1200 count=40
logsift-mcp tools                # the tools
logsift-mcp tools search         # one tool's arguments
logsift-mcp prompt investigate problem="orders failing since 10:00"

Where your logs are

Without help, an agent needs a path in every question. Tell Logsift where each service writes its logs, and ask “why did orders fail last night?”: the agent calls list_logs, sees that orders writes app.log (the application log, with 14 rotated copies) and gc.log in /var/log/orders, and opens the right file itself.

Log Locations for Agents: a service, its folder, its logs found and described, and what an agent sees

Open File → Log Locations for Agents… (it starts from the log you are looking at), Describe for Agents… in a folder’s tab, or Log Locations… under Settings → Agents:

  1. Add Folder… and choose the folder a service writes its logs to. Logsift names the service after the folder (the one above a logs folder: /srv/orders/logs is orders).
  2. What it is: one line, such as Order service: takes orders from the shop and charges cards.
  3. Its logs: Logsift finds the files in the folder (and its subfolders, three deep), puts each log together with its rotated copies (app.log, app.log.1, app.2026-10-27.log.gz are one log), and guesses what each holds (Java GC log, CSV: order_id, placed_at, amount, Log (logback format), Java crash report). The guesses are gray. Click one to say it better, for example Application log: one line per order, errors with stack traces, or Use the Guesses to keep them.
  4. Times in: the time zone of the times in its logs, if it isn’t this computer’s.
  5. Its JVMs (also JVM → JVM Connections (SSH, JMX)…; Add JVM at the bottom left keeps one with no folder of logs): where the service’s JVM runs, so the assistant can take a thread dump or a heap histogram after you say yes. Add a row: what it runs (orders.jar, com.acme.App), how it’s reached (This computer, SSH with user@host or host:port, or a JMX port like prod-7:9010 or monitor@prod-7:9010). Never a password: the list may be shared, and Logsift asks for one when it’s needed.
  6. Notes: anything an agent should know, such as payment timeouts before 06:00 are the nightly maintenance.
  7. An agent sees shows exactly what list_logs will answer.

Agents read only the folders allowed under Folders agents may read (your home folder unless you chose others). If a service’s folder is outside them, a bar says so, and Let Agents Read Them adds it.

Saved in chooses where the service is kept:

Sharing with your team

The lists are written to work on other computers:

Three ways to share:

logsift-mcp --logs FILE reads one more list, for example one on a shared drive. The lists are read again on each call, so changes count at once.

The file is plain JSON, if you prefer to write it by hand:

{
  "services": [
    {
      "name": "orders",
      "description": "Order service: takes orders from the shop and charges cards",
      "folders": ["/var/log/orders"],
      "files": [
        { "pattern": "app*.log*", "description": "Application log: one line per order, errors with stack traces" },
        { "pattern": "gc*.log", "description": "GC log (G1)" }
      ],
      "timeZone": "UTC",
      "notes": "Payment timeouts before 06:00 are the nightly maintenance."
    }
  ]
}

What the agent can ask

Tool What it does
list_logs Your services and where their logs are (see Where your logs are): each kind of log with what it holds, rotated copies counted together, sizes and when they last changed
open_log Opens a log (also a .gz file, a file inside a zip, or a web address, downloaded once to Logsift’s temporary folder), by its path or by a name from list_logs (orders/app opens the newest app.log), and gives back a short name for it (log:1), its format, size, line count and time range
list_open The logs open so far
insights What happened in the log, most important first (error bursts, new errors, restarts, known problems)
exceptions Exceptions grouped by root cause, with counts and where they first and last appear
search Lines that match a text or regex, in a range of lines if asked
read_lines Lines from a line number on, or around a time (at): what another log was doing when a line was written
top_messages The most frequent messages, with numbers replaced by placeholders
metrics How long things took, and numbers in messages
query A read-only SQL query over a log (the table log: line, time, level, logger, message, text…) or a CSV/TSV file (the table t): exact counts, groups, time buckets, percentiles. A big table comes from the app’s cache, reading only the columns the query names. tables adds other CSV files, each named after its file (customers.csv → customers), to join with. See Query
query_examples Queries to start from, made for the file’s columns: the Query tab’s Examples, with those for wide tables (COLUMNS('^cpu_[0-9]+$'))
pivot Pivot a table (CSV/TSV) or a log’s columns, as the Pivot tab: rows by fields (host, time:hour), columns by another, values like count, sum(ms), p95(ms), sum(cpu_*), filters and percentages. See Pivot
search_folder Every file in a folder that contains a text, inside zips and .gz files too; give a service’s name to search all its folders
analyze_gc Explains a GC log: pauses, time stopped, heap after collections, and what to tune
analyze_threads Explains thread dumps: deadlocks, lock queues, stuck and busy threads
follow_request One request, trace or order id through a log, several logs or a service’s folders: its lines in time order, the threads, the errors, the longest wait
merge_logs Several logs merged by time into one (a temporary copy, never next to your files), to search and query together
analyze_profile A profile (a .jfr recording or collapsed stacks): the hottest methods, your own code’s share, the hottest stacks
compare_files Two files (paths, open logs or web addresses): CSV/TSV as tables matched by a key (added, removed and changed rows, old → new), only the rows where says if asked (region = EU and amount > 100), anything else line by line (times, numbers or IDs masked if asked)
compare_folders Two folders or zips, file by file: the same, different, only on one side
compare_logs A bad run against a good one, by kinds of message: new, gone, much more or less often
analyze_crash Explains a crash file: a Windows dump (.dmp, .mdmp) or a Java hs_err_pid file. What happened, the code to blame, the crashed thread’s stack, what other threads and libraries may have caused it, and what to try
crash_threads The threads of a crash file with their stacks, threads with the same stack together; filter by name, state or function
crash_modules The DLLs or shared libraries loaded in the crashed process, with versions and paths
list_jvms The JVMs to look into: where you said each service’s JVM runs (Its JVMs), and those running on this computer, each with a handle (jvm:1)
thread_dump A thread dump of a running JVM, after you say yes: its threads by state, deadlocks, who blocks whom, the biggest groups doing the same. The whole dump becomes a log to read
heap_histogram A running JVM’s objects counted by class, as you allow (asked by default), without a full GC: what takes the memory. Refused on a heap bigger than you allow (8 GB)
heap_dump A heap dump (.hprof) of a running JVM, asked every time (or never, as you choose), saved in ~/.logsift/heap-dumps for analyze_heap_dump. Refused on a heap bigger than you allow, or without room for it
analyze_heap_dump Explains a heap dump file (.hprof) as the Heap Dump tab does: what fills the memory in sentences, the chain of references that keeps it alive, memory that isn’t strongly reachable or is wasted on copies and empty collections, the biggest classes. A big dump takes a while: the agent is told to ask again. Logsift reads dumps you have; it never takes one
network_check How Logsift reaches the internet: its proxy setting (automatic, manual or none), the proxy GitHub and a web address go through, and with test whether GitHub can be reached. For when opening a log from a web address fails
assistant_audit The questions asked to Logsift’s own assistant, newest first. For each one: what answering it took (the model, its calls, each tool with its arguments and the size of its answer, the tokens, the time and the cost), what was flagged (failed tools, the same call again, big tool answers, broken links, answers rated bad) and your note. Use it to find what to change. When Logsift is running, it answers this itself
assistant_audit_question One of those questions in full: what went with it, each step with the start of each tool’s answer, and the answer. On request, the instructions the assistant had too

Line numbers in answers start at 1, like in the log view. Times are the log’s own times.

From a crash file the agent gets only the explanation: stacks, modules and facts. It never gets the process’s memory that a dump holds.

Long answers are cut, and say where. Slow work, such as a first look at a multi-GB log, goes on in the background. The agent is told to ask again in a few seconds.

Ready-made tasks

Logsift also offers tasks that tell the agent how to go about a job, step by step, with which tools. It asks for evidence: line numbers, times and counts. Agents that support MCP prompts show them as commands. In VS Code’s Copilot Chat, type / and look for mcp.logsift.….

Task Asks for What the agent does
investigate the problem in your words, and where (optional) Finds the logs, insights and root causes, errors over time, the lines around the first error, one failing request end to end
explain_crash the crash file, and the logs around it (optional) Explains the dump or hs_err file, the other threads and libraries, and what the logs show just before
compare_runs the bad run’s log and the good run’s What’s new or different in the bad run, and when they diverge
find_slow a service or log Durations and percentiles over time, the slowest requests followed end to end, GC and threads for Java
health_check a service or log A short report: healthy or not, and the top three things to look at

They come with logsift-mcp, so there’s nothing else to install. Agents without prompts still get the same guidance when they connect.

Running JVMs

Settings → Agents → Running JVMs: what an agent may do to a running JVM

An agent can look into a JVM you named in Log Locations (Its JVMs) or one running on this computer. Settings → Agents → Running JVMs sets what it may do. The assistant and coding agents follow the same settings:

  Choices What it does to the JVM
Thread dumps Ask each time (default), Allow without asking, Never A pause of a moment
Heap histograms Ask each time (default), Allow without asking, Never Objects counted by class, without a full GC: about a second’s pause per GB of heap
Heap dumps Ask each time (default), Never A full GC, then a pause of several seconds per GB while the dump is written. Saved in ~/.logsift/heap-dumps (from a server over SSH it’s copied there, and the server’s copy stays where it was written; over JMX it stays on the server, and Logsift says where). Logsift checks first that there’s room for it. analyze_heap_dump then explains it
Largest heap 8 GB Histograms and heap dumps of a bigger heap are refused: the pause would be too long. Take them yourself in the Heap tab

A heap dump is asked for every time; Allow for This Chat (or for This Session) isn’t offered for it.

Who asks you:

Logsift's window asks when the agent can't

What it can’t do

What is masked

Everything Logsift answers goes to the agent’s AI provider, under your agreement with them. Before an answer leaves Logsift, it replaces what you chose to mask with ‹masked:…›, for example token=‹masked:secret›, and says how many values it masked.

Setting Default What it masks
Secrets on Passwords and secrets in key=value pairs, bearer tokens, JWTs, API keys (AWS, GitHub, Slack, Google, OpenAI, Anthropic and similar), passwords in web addresses, private keys, card numbers
Email addresses off name@example.com
IP addresses off IPv4 and IPv6 addresses
Your own patterns none One regular expression per line, for example customer numbers or host names. A pattern with a mistake is shown in red under the list and isn’t used

Changes apply the next time the agent starts Logsift. Agents usually start it when you open a new chat or restart the agent.

Text from logs is passed on as data. Logsift tells the agent never to follow instructions found in a log.

What agents asked

What Agents Asked… opens ~/.logsift/agent.log. Each line is one call, with:

The answers themselves are never kept.

From a terminal

logsift-mcp --help lists the options. The command line wins over Settings → Agents.

Option What it does
--root FOLDER Allow reading under this folder (can be given several times)
--mask-emails, --mask-ips Also mask email addresses or IP addresses
--mask REGEX Also mask your own pattern
--no-mask Don’t mask secrets
--max-chars N The longest answer, in characters
--version Print the version

The commands for the skill (run, tools, prompt, skill) are under When MCP servers are blocked.

GitHub Copilot is a trademark of GitHub, Inc. Claude and Claude Code are trademarks of Anthropic, PBC. Logsift is not affiliated with or endorsed by GitHub or Anthropic.

← All guide pages