Bring Grepr into the AI assistant you already use

Introducing the Grepr agent plugins and the Grepr MCP server

Every observability team makes the same trade-off: send every log to your observability platform and pay for all of it, or drop some and hope no one needs them later. Grepr removes that trade-off. Your platform gets the logs that matter plus summaries of the noisy ones, and the raw logs stay in your data lake, ready when you need them.

The Grepr MCP server and agent plugins make that data lake as easy to reach as a chat. Ask the AI assistant you already use, in plain language:

• "What did checkout log during last night's 502s?" It queries your data lake and hands you the logs.
• "Find the payment timeout for order 8812." It looks in your observability platform first. If all it finds there is a Grepr summary, it follows that summary to your data lake, pulls the original, and can backfill it if you need it in Datadog.
• "Drop the health-check noise from my web-api pipeline." It drafts the change, shows you the diff, and waits for your yes.

There are two ways to connect:

• Grepr agent plugins for Claude Code and Codex. Includes Skills that drive the Grepr CLI from your terminal.
• The Grepr MCP server. A remote Model Context Protocol (MCP) endpoint for Claude, ChatGPT, Cursor, Codex, Claude in Slack, and any other MCP client.

Both use the same role-based permissions as the Grepr UI and REST APIs. An agent cannot do anything through them that you could not do yourself.

Which one should you use?

If you live in a terminal, start with the plugin. If you want Grepr answers in ChatGPT, Cursor, the Claude app, or Slack, add the MCP server. Most teams will want both.

How to set up the Claude Code or Codex plugin

Install the Grepr CLI (Node.js 22, 24, or 26) and save a configuration for your organization. The first command that needs Grepr signs you in with OAuth in your browser, and the CLI caches the token.

npm install -g @grepr/cligrepr --org-name <your-org> config:save prod --default‍Then add the plugin. In Claude Code:‍/plugin marketplace add grepr/cli/plugin install grepr@grepr-cli

In Codex:

codex plugin marketplace add grepr/cli --ref maincodex plugin add grepr@grepr-cli

Requirements and full steps are in the plugin docs.

What's in the plugin

A skill packages what an agent needs to know to do one Grepr task well: which commands to run, in what order, and how to read the output. The plugin ships nearly 30 of them, in three groups:

• Command skills run the CLI to get things done: list and inspect jobs, datasets, and integrations, query logs and spans, recover the original logs behind a Grepr summary, run analytical SQL over the data lake, backfill to your observability platform, search the docs, and read Grepr Agent investigations.
• Workflow skills handle multi-step pipeline work: build a pipeline end to end, build or fix Grok parsing, tune reduction, change filtering, exceptions, masking, sources, or sinks, write a SQL transform, and debug a pipeline that is not producing what you expect.
• Reference skills teach the agent how Grepr works (events, jobs, job graphs, and every available operation), so it does not have to guess.

You never pick a skill yourself. The cli skill routes your request to the right one. The query skill also checks which fields a dataset indexes and scopes every search so it reads as little data as possible.

Walkthrough: backfill a service's logs

When you need everything a service logged during an incident, ask for it:

Prompt: Backfill the trino service's logs from the last 30 minutes to my observability platform.

The agent picks the backfill skill. It finds the pipeline that sends your logs to your observability platform (Datadog, in this example), turns "the trino service" into the query service:trino, and works out the time window. Backfills re-ingest logs at your observability platform's cost, so the skill previews the logs that match before it creates the job, stops if nothing matches, and asks you when the pipeline or destination is ambiguous. Backfilled logs carry a grepr.backfilled attribute, so you can tell them apart in Datadog.

You don't need to know which logs Grepr summarized. Ask for a specific log, like the payment timeout for order 8812, and the agent checks Datadog first when it can search it through Datadog's MCP server or CLI. If Datadog has only a summary, such as Repeats 2431x in the past 30.0s: payment authorization timed out for order <any>, the agent reads its Grepr attributes to find the exact pipeline, dataset, and time window, then pulls the matching originals from your data lake. Without Datadog access, it goes straight to the data lake.

No hunting for the right dataset, no remembering query syntax, and no backfill form to fill in. Datadog is just the example here: recovering and backfilling work the same way for New Relic, Splunk, Sumo Logic, and any OTLP destination.

Change pipelines with a draft first

The workflow skills show you a change before it reaches production. Every change follows the same path:

1. Plan the change and show you a readable diff.
2. Draft it: run live traffic through a copy of the pipeline with the change in place. The draft writes nothing to your data lake or your observability platform.
3. Compare the draft's output with the current pipeline.
4. Apply only after you approve.

That approval step is the agent following the skill's instructions, not a lock in the CLI, so read the diff and the draft results before you say yes.

With that loop in place, prompts like these are reasonable to try on a real pipeline:

• Reduction on my checkout pipeline is low. Find out why and fix it.
• Build a Grok rule that parses our NGINX access logs.
• Keep every payment-failure log out of aggregation.

We walked through these steps for PII in Redact PII from your logs with Grepr, including applying the change through Terraform.

How to set up the Grepr MCP server

The MCP server lives at https://app.grepr.ai/mcp (US) and https://app.euc1.grepr.ai/mcp (EU). Setup is the endpoint, your assistant's Grepr client ID from the Grepr MCP docs, and a sign-in with your Grepr account, so the assistant acts as you. Slack and generic MCP clients use a service account instead:

• Claude (web, desktop, and mobile). Go to Settings > Connectors > Add custom connector, enter the Grepr URL, and add the client ID under Advanced settings.
• ChatGPT. Go to Plugins > Add > Add custom MCP server, enter the Grepr URL, and add the client ID under Advanced OAuth settings. Your plan or workspace must allow custom MCP servers.
• Cursor. Add a grepr server with the client ID to ~/.cursor/mcp.json, then restart Cursor.
• Codex. Add a grepr server with the client ID and callback port to ~/.codex/config.toml, then run codex mcp login grepr.
• Claude Code. Add the server with the claude mcp add command from the docs, then run /mcp and sign in.
• Claude in Slack. Upload the Grepr plugin for Claude Tag and connect it with a Grepr service account. Everyone in the channel shares that account's access, so give it the narrowest role that fits.
• Any other MCP client. Send a service account access token in the Authorization header.

What your assistant can do over MCP

• List and inspect your pipelines, datasets, and templates.
• Search raw logs in a dataset, 100 per page. The assistant can fetch the next page without rerunning the query. Searching spans needs the CLI.
• Validate Flink SQL and test Grok patterns against sample log lines.
• Read Grepr Agent investigations: status, summary, actions taken, the full transcript, and the memories the agent recorded.
• Work the Grepr issue board: search and read issues and, when you sign in as yourself, file and update them, comment, and add guidance that later agent investigations of the same problem will read. A Slack service account can search and read issues but not change them.
• Make small, add-only changes to a templated pipeline: add Grok rules or a new parser, or add a filter that picks which logs reach Grepr agents. Grepr verifies the change before it applies, including running new Grok rules against the sample logs you provide.

Walkthrough: catch up on what your Grepr agents did

Grepr agents investigate new log patterns and work the issue board as signals arrive. With the MCP server connected, you can catch up from Claude, ChatGPT, or Slack without opening Grepr:

Prompt: What did the Grepr agents investigate in the last week? Only include the investigations that needed to take an action. Include the investigation links.

The assistant lists the agents' investigations through the Grepr MCP server, reads each one's summary and the actions it took, and links back to the full investigation in Grepr. From there you can keep going in the same chat: read an investigation's transcript, check whether there's already an issue for it, or search the raw logs it looked at.

Skills come with it

The MCP server also serves five Grepr skills as MCP resources: setting up the Grepr CLI, querying logs and spans, writing query predicates, recovering the original logs behind a summary, and backfilling logs to your observability platform. Clients that read resources, such as Claude Code, load one when your request matches it. When your assistant can run shell commands, as Claude Code and Codex can, the skills prefer the Grepr CLI, which writes results to a file instead of the chat, has no page cap, and searches spans too. They ask before installing it.

Get started

Install the plugin, add the connector, and ask your agent something about your logs. The setup guides are in the docs: Grepr agent plugins and Grepr MCP server.

New to Grepr? Get started free, or talk to us.

FAQ

What is the Grepr MCP server?

A remote Model Context Protocol server at https://app.grepr.ai/mcp (US) and https://app.euc1.grepr.ai/mcp (EU). It lets AI assistants list your pipelines, datasets, and templates, search raw logs, validate SQL and Grok, read Grepr Agent investigations, work the issue board, and make small, verified pipeline changes, all under your Grepr permissions. It also serves Grepr skills as MCP resources.

Which AI assistants work with Grepr?

The agent plugins work with Claude Code and Codex. The MCP server works with Claude on the web, desktop, and mobile, ChatGPT, Cursor, Codex, Claude Code, Claude in Slack, and any MCP client that can send a bearer token.

Can I get the original logs behind a Grepr summary?

Yes, and you don't have to ask for them by name. When your observability platform shows a Grepr summary in place of a log you need, the agent uses the summary to find the originals in your data lake and can backfill them.

Can an agent change my production pipelines without me?

Only with your permissions. The plugin's workflow skills draft every change and ask before applying, though that is the skill's instruction, not a lock in the CLI. Over MCP, your assistant can apply a Grok or agent signal filter change as soon as Grepr verifies it, with no draft step, so use your MCP client's tool-approval settings to decide whether it asks you first.

Does the agent get more access than I have?

No. Every command and tool call uses the same role-based permissions as the Grepr UI and REST APIs. In Slack, Claude uses the service account you connect, so give it the narrowest role that fits the channel.

Is the EU region supported?

Yes. Use https://app.euc1.grepr.ai/mcp and the EU client IDs listed in the docs.
‍

Ready to reduce your observability TCO by 75%? Get started for free today.