Trace a failed order
Search a single application stream for an order identifier, then compare the event with its SQL record. The response includes timestamps, severity and log messages.
APIs & logs · MCP Firewall integration
Investigate Loki logs within the boundaries you set.
Put Loki log access behind GateRook’s MCP Firewall. Configure the tenant, credentials and source scope, then let AI search with LogQL and receive bounded results. The connector reads logs without exposing log editing, retention changes or administration tools.
Connection in GateRook
stage-logs
Loki
stage / QA- Connector type
- Loki
- Name / environment
- stage-logs / stage
- URL
- https://loki.stage.internal
- Tenant
- orders-team
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Find recent order 48213 errors in Loki and explain the sequence.
loki_search · arguments
{
"connection": "stage-logs",
"query": "{app=\"orders\"} |= \"48213\" |= \"ERROR\"",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "loki",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with Loki and AI
Follow a new failure
Use loki_tail and its returned cursor to collect subsequent entries. Each call has a bounded wait rather than an unending live stream.
Work across tenants deliberately
Keep tenant-specific Loki connections clearly named and expose only the relevant connection on an endpoint.
From service to MCP Firewall
How to connect Loki
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Loki. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Find the Loki API endpoint
Use the Loki service URL, not a Grafana dashboard URL. Confirm that the GateRook computer can reach it and obtain credentials for the intended tenant.
Configure the Loki connection
In Connections, choose Add connection and Loki. Set the name, environment, URL, optional tenant and the matching authentication mode. Enter the token or password in the connection form.
Test a bounded log query
Run Test connection, then finish Add to endpoint. Start with a specific stream selector and a short time range in Playground before connecting the AI app.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Loki in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | Loki | Choose Loki in Add connection. It is a dedicated built-in connector. |
Name / environment | stage-logs / stage | Use the connection name to target log tool calls. |
URL | https://loki.stage.internal | The Loki API base URL. A Grafana Cloud Logs endpoint can also be configured. |
Tenant | orders-team | Optional X-Scope-OrgID. Leave empty for single-tenant Loki. |
Credentials mode | bearer | Choose none, bearer or basic to match the server. Grafana Cloud commonly uses basic authentication with its numeric user ID. |
Token or password | Enter in GateRook (write-only) | Store the credential in the connection. Add a PEM certificate when Loki uses a private CA. |
Know what you expose
Loki tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
loki_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
loki_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- Loki queries use LogQL and need a valid stream selector. An empty query is not supported.
- The tenant is configured on the connection; it is not a free-form tenant selector given to the AI.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Loki connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Is Grafana itself required?
GateRook talks to the Loki API. You can use a standalone Loki service or a compatible Grafana Cloud Logs endpoint; a dashboard URL is not the API address.
What query language does the AI use?
loki_search uses LogQL for a Loki connection. Begin with a stream selector such as {app="orders"} and add line filters for the event you are investigating.
Can I tail logs through MCP?
Yes. loki_tail returns bounded pages of new entries and a cursor for the next call, with a wait of up to eight seconds per call.
Why does an older connection still expose logs_search and logs_tail?
Older saved Logs connections retain their compatible tool names. New Loki connections expose loki_search and loki_tail. Use the names shown in your endpoint; the endpoint may also add a connection-specific prefix.
Keep exploring
Extend control across your stack
AWS CloudWatch Logs
Control CloudWatch Logs access through GateRook. Restrict regions and log groups, keep AWS credentials local and bound queries and returned results.
Google Cloud Logging
Protect Google Cloud log access with GateRook. Choose projects or log views, use a scoped identity and bound the log data returned to your AI client.
SSH log files
Read selected SSH log files through GateRook’s MCP Firewall. Verify host keys, restrict file access and inspect bounded results and call history in Activity.
Your MCP Firewall. Your access rules.
Control AI access to Loki.
Start with read-only access. Approve changes. Inspect the audit trail.