Skip to content

Connect MCP

You will learn how to authenticate and use the Cordo MCP server.

Agents use the Model Context Protocol endpoint to discover streams, query events, manage views, run ops digests, and review anomaly findings.

Endpoint and auth

Setting Value
URL https://<api-host>/mcp (hosted: https://api.cordo.cloud/mcp)
Transport Streamable HTTP
Auth Authorization: Bearer lxp_…

Create a personal access token under Settings → API tokens — see Manage personal access tokens.

Example client config

{
  "mcpServers": {
    "cordo": {
      "url": "https://api.cordo.cloud/mcp",
      "headers": {
        "Authorization": "Bearer lxp_<prefix>_<secret>"
      }
    }
  }
}

Prefer the Cursor plugin when you use Cursor — it ships the Cordo C badge and the same remote MCP connection.

What agents can do

Area Tools (examples)
Orient cordo_context, cordo_help, describe_stream
Investigate query, top_values, sample_events, ops_digest, get_trace, event_context
Patterns and findings list_patterns, list_findings, get_finding, manage_findings
Views manage_views (incl. visibility), resolve_view, tail_view
Detect manage_metrics, manage_monitors (incl. action: history), manage_channels, manage_alerts
Streams / keys manage_streams, manage_stream_api_keys
Samples ingest_events

Full catalogue: MCP tools.

Typical flow: cordo_context → describe_stream → query or ops_digest. For a request_id timeline, use get_trace. To check monitors and what fired, use manage_monitors (action=history) then manage_alerts (action=evidence) — see Inspect monitors and alerts. For "what's unusual right now?", follow Find what's unusual with an agent.

stream_id and view_id accept a UUID or name (case-insensitive). Use UUIDs for durable automation and writes. If a stream name matches more than one PAT-allowed stream, Cordo returns ambiguous_stream with safe workspace candidates before doing any work; retry with the intended UUID.

Sample ingest vs production shipping

ingest_events is for agent-driven sample events. For production collectors, use a stream API key and one of the paths in Ingest your logs.

Next