More security and operations work now happens inside an AI client instead of a dedicated console. That shift creates a gap for any platform that isn’t part of the conversation. Every time an analyst needs to triage an insight or check a log, they have to leave the AI client and go open a different tool.
Sumo Logic closes that gap with a Model Context Protocol (MCP) server. It connects Sumo Logic’s SIEM and Log Analytics capabilities directly to Claude Code, GitHub Copilot, and other MCP-compatible AI clients, so SOC analysts, DevOps, and SRE teams can search logs, investigate insights, and manage alerts and dashboards from inside the AI client they already use.
Here’s what that actually looks like, and how it works.
What the Sumo Logic MCP server does
MCP is an open standard for connecting AI clients to external tools and data sources. Instead of building a one-off integration for every AI product your team adopts, MCP gives you one governed connection point.
Sumo Logic’s MCP server exposes a defined set of tools that any MCP-compatible client can call: alert search, dashboard management, SIEM insights and detection rules, log search, and data discovery. Connect Claude Code (or another supported client) to that server, and you can ask it to pull an alert, triage a SIEM insight, or run a log search in plain language, then act on the results, all in the same session.
This solves a real workflow gap. Analysts spending more of their day inside an AI client still had to break context and open the Sumo Logic UI every time they needed to triage an insight or search logs. Teams that tried to close that gap with custom integrations usually did it without the audit trails and access controls security and compliance teams require. The MCP server removes both problems. There’s no custom connector to build and every action still runs through Sumo Logic’s existing authentication, authorization, and role-based permissions.
What you can actually do with it
The MCP server groups its tools into a few categories:
- SIEM. Get and filter insights, pull the signals and entities behind an insight, update insight status or assignee, and create or review detection rules.
- Log search. Run a log search over a time range and get back aggregated records or raw messages.
- Alerts. Search and retrieve alerts by status, severity, or monitor.
- Dashboards. Create, retrieve, and update dashboards.
- Discovery. List custom fields, field extraction rules, and partitions to help scope a search.
In practice, that supports multi-step investigations in a single conversation: pull an open SIEM insight, review its signals and involved entities, then run a log search on one of those entities to find the raw events behind it, all without leaving Claude.
How the connection is governed
Every MCP action runs as a named user constrained by that user’s existing Sumo Logic role and permissions, not by an all-access service account. Authentication runs on OAuth 2.0, with client ID metadata documents (CIMD) as the recommended setup for supported clients. Customer data is never used to train AI models, and all MCP interactions are logged for compliance and security review. Agents connected through MCP run in your own environment, not inside Sumo Logic’s infrastructure.
Administrators control MCP server access separately from other AI features. It’s on by default at the organization level, and can be toggled independently of Mobot and the SOC Analyst Agent under Feature Management.
What MCP is for, and what it isn’t for
Sumo Logic scopes the MCP server for conversational, agent-driven work such as multi-step investigations, triage, and agent-to-agent workflows where a person is in the loop. It isn’t meant for bulk data extraction or high-volume automated queries. Those still belong on the standard Search Job API. MCP requests are cost-amplifying by nature, since one conversational request can trigger several tool calls, so this distinction matters most for Flex pricing customers watching scan costs.
