Connect Your AI
You first need a SparkLogs workspace with data, typically from the SparkLogs Agent on the devices you manage. Then pick the AI tool your team already uses.
| Host | What you set up |
|---|---|
| Claude | SparkLogs plugin (Code, Desktop, or organization-wide) |
| Cursor | SparkLogs plugin |
| Codex | SparkLogs plugin |
| Microsoft Copilot Studio | MCP plus the instruction template (standard harness) |
The plugin (Claude, Cursor, Codex) brings investigation skills, follow-up commands, and the SparkLogs MCP connection. Copilot Studio does not load that plugin yet, so you connect MCP yourself and paste the instruction template.
When the host prompts, sign in to SparkLogs in your browser and approve the connection. The SparkLogs MCP server runs in the SparkLogs cloud, so there is no server to install or host.
All plugin hosts install from the same marketplace repository, itlightning/sparklogs-ai-plugins.
Source: plugin repository.
Install the plugin
Use the page for your host:
Ask questions and run investigations
After the plugin or MCP is connected, ask in plain language and ask it to use SparkLogs data.
Your AI then calls the SparkLogs tools that fit the question. Answers carry citations, so you can open the same evidence in the SparkLogs app.
Ask follow-up questions: narrow the time window, switch to another host, or ask what else failed the same way.
The plugin also includes skills and commands for common jobs:
- ask answers a question from logs and device state, in conversation.
- investigate writes a full cited report for the ticket or the next engineer.
- analyze-cause is an optional follow-up: candidate root causes, with how to confirm or refute each one.
- summary and explain, in Claude and Cursor, re-render a prior investigation or walk a finding back to its evidence.
How you invoke a skill depends on the host.
Ask in plain language everywhere ("use sparklogs-investigate on SRV-FILE01 this week").
Codex also exposes $sparklogs:sparklogs-investigate.
In Claude and Cursor, summary and explain are follow-up commands.
Ask, investigate and analyze-cause are skills on every host.
Workflow guides: your AI and the app, agentic RCA.
MCP for your own automation
Point a compatible MCP client at https://mcp.sparklogs.app/mcp. Use OAuth (dynamic discovery if the host offers it). Sign in to SparkLogs when prompted. Grant only the scopes the client needs.
Your AI agent can search events, page and refine results, list sources, pull pattern statistics, and read SparkLogs Agent health, including devices that have gone silent. A count that comes from a sample is labeled as sampled.
A host that does not load the SparkLogs plugin needs the instructions the plugin would have supplied. Copy the Agent Instruction Template into the agent's system or instruction field.
Microsoft Copilot Studio is the common case: connect Copilot Studio.
SparkLogs works beside the other MCP tools your agent uses, such as your RMM, PSA and ticketing.
See also the live demo.
Do not set an API key or bearer header on the connector unless you intend to skip OAuth. API tokens: Workspace Access.
Microsoft Copilot Studio
Full walkthrough (standard harness, environment, MCP, publish): Microsoft Copilot Studio.
Claude (organization-wide)
Team and Enterprise org marketplace steps: Claude.
If something fails to connect
- Confirm the OAuth grant is for the same workspace you deployed agents into.
- Confirm the endpoint can reach https://mcp.sparklogs.app/mcp over HTTPS.
- Do not add an
Authorizationheader to the plugin's MCP server unless you intend to use an API token instead of OAuth. - API tokens are for hosts that cannot do OAuth. Mint and revoke them in the app in Workspace Access.
Updating the AI plugin
Update steps are on each host page: Claude, Cursor, Codex. Copilot Studio has no plugin to update. Its tool descriptions refresh from the SparkLogs MCP server when members connect.