Skip to main content

Connect Your AI

You need a SparkLogs workspace with data (typically the SparkLogs Agent on the endpoints you manage) and a way for your AI tool to query that workspace.

Chat first​

Ask a normal question. The plugin queries SparkLogs and answers. Follow-ups are expected: narrow the window, pivot to another host, ask what else failed the same way. Chat goes as deep as the issue warrants.

/sparklogs-investigate is for when you want the artifact: a written, cited system-condition report to attach to the ticket or hand to the next engineer. It takes more turns because it gathers, cites, and structures everything it reports. Depth is not what separates the two; the deliverable is.

/sparklogs-analyze-cause comes after a report exists, and returns candidate causes with confirm and refute steps.

Workflow: agentic RCA.

Plugin​

For L2/L3 engineers working in Claude Code, Cursor, or Codex.

  1. Install from the SparkLogs AI Plugins marketplace (itlightning/sparklogs-ai-plugins). Host-specific steps live in that repository's install docs (Claude, Cursor, Codex).
  2. Sign in with OAuth (Workspace Settings > Access, consent screen) or a workspace API token.
  3. Ask about a client, host, or time window.
  4. Run /sparklogs-investigate when you want the written report. Then /sparklogs-analyze-cause for candidate causes, or /sparklogs-summary and /sparklogs-explain for handoff notes.

The plugin queries SparkLogs through MCP, so every claim carries the query behind it.

MCP​

For the custom agents you already run next to PSA, RMM, and the rest of your stack.

Point a compatible MCP client at SparkLogs. Authenticate with a workspace API token or OAuth under Workspace Settings > Access. Grant only the scopes that client needs.

Your agent can search events, page and refine results, list sources, pull pattern statistics, and read agent health, including devices that have gone silent. Sampled counts are labeled, so a partial number is not treated as a complete one. Results stay inside the authenticated workspace and organization scope.

SparkLogs is the evidence layer in that stack; the workflow stays yours.

See also the live demo.

If something fails to connect​

  • Confirm the token or OAuth grant is for the same workspace you deployed agents into.
  • Confirm the endpoint can reach SparkLogs over HTTPS.
  • Revoking a token takes effect immediately and cannot be undone from the Access screen; mint a new one if needed.