logicmonitor-mcp

A Model Context Protocol (MCP) server that exposes the LogicMonitor REST API as tools an LLM can call. Ships as a Docker image, runs over stdio.

What it exposes

About 40 ergonomic, curated tools across the main resource areas:

Area	Tools
Devices	list_devices, get_device, create_device, update_device, delete_device, get_device_properties, set_device_property, delete_device_property, list_device_instances, list_device_alerts
Device Groups	list_device_groups, get_device_group, create_device_group, update_device_group, delete_device_group, list_devices_in_group, list_device_group_properties, set_device_group_property
Alerts	list_alerts, get_alert, ack_alert, ack_alerts_bulk, add_alert_note
SDTs	list_sdts, get_sdt, create_sdt, update_sdt, delete_sdt
Dashboards	list_dashboards, get_dashboard, list_dashboard_groups, get_dashboard_group, list_widgets, get_widget, get_widget_data
Reports	list_reports, get_report, run_report, get_report_task, list_report_groups
DataSources	list_datasources, get_datasource, list_device_datasources, list_device_datasource_instances, get_instance_data, list_datasource_instance_groups
Collectors	list_collectors, get_collector, update_collector, delete_collector, list_collector_groups, get_collector_group, list_collector_versions
Users & Roles	list_users, get_user, create_user, update_user, delete_user, list_roles, get_role, list_api_tokens
Websites	list_websites, get_website, create_website, update_website, delete_website, list_website_groups, get_website_group, get_website_checkpoint_data
Audit & Ops Notes	list_audit_logs, get_audit_log, list_ops_notes, create_ops_note

Plus three generic tools that give full coverage of every other endpoint in the spec:

• lm_list_tags — list all resource tags with endpoint counts
• lm_list_endpoints — discover endpoints (filterable by tag or substring)
• lm_describe_endpoint — show parameters/body schema for any endpoint
• lm_api_request — call any LM REST endpoint with arbitrary method/path/query/body

The OpenAPI spec is bundled with the image so discovery works offline.

Configuration

Set two environment variables. Generate a bearer token in LogicMonitor at Settings → Users & Roles → API Tokens.

Variable	Required	Description
LM_ACCOUNT	yes	Portal prefix — the <account> in <account>.logicmonitor.com
LM_BEARER_TOKEN	yes	Bearer token (lmb_…)
LM_API_VERSION	no	API version header. Default 3
LM_HTTP_TIMEOUT	no	Request timeout in seconds. Default 30

See .env.example.

Build

docker build -t logicmonitor-mcp .

Run

The server speaks MCP over stdio, so the client launches the container. Pass -i (interactive) so stdin stays open, and --rm so the container is cleaned up when the client disconnects:

docker run --rm -i \
  -e LM_ACCOUNT=yourcompany \
  -e LM_BEARER_TOKEN=lmb_xxxxxxxx \
  logicmonitor-mcp

Claude Desktop / Claude Code

Add to your MCP config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, or ~/.claude.json):

{
  "mcpServers": {
    "logicmonitor": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "LM_ACCOUNT",
        "-e", "LM_BEARER_TOKEN",
        "logicmonitor-mcp"
      ],
      "env": {
        "LM_ACCOUNT": "yourcompany",
        "LM_BEARER_TOKEN": "lmb_xxxxxxxx"
      }
    }
  }
}

Running locally without Docker

pip install -e .
export LM_ACCOUNT=yourcompany LM_BEARER_TOKEN=lmb_xxxxxxxx
python -m logicmonitor_mcp

Notes on filters

LogicMonitor uses a query-string filter syntax. A few quick examples:

• displayName:"web-*" — devices whose displayName starts with web-
• severity>=3 — alerts at warning severity or higher
• cleared:"false",acked:"false" — open, unacked alerts (comma = AND)
• hostStatus:"normal"|hostStatus:"dead" — pipe = OR

Pass filters to any tool that accepts a filter parameter.

Mutations

This server exposes the full CRUD surface — create_*, update_*, delete_* tools and the generic lm_api_request can write to your LogicMonitor portal. Make sure the bearer token's role permissions match the level of access you want the LLM to have, and prefer a read-only role unless writes are required.