Connect Your AI

You first need a SparkLogs workspace with data (typically the SparkLogs Agent on the endpoints you manage). Then pick the AI host your techs already use.

Host	What you set up
Claude	SparkLogs plugin (Code, Desktop, or organization-wide)
Cursor	SparkLogs plugin
Codex	SparkLogs plugin
Microsoft Copilot Studio	MCP plus the instruction template (standard harness)

The plugin (Claude, Cursor, Codex) brings investigation skills, follow-up commands, and the SparkLogs MCP connection. Copilot Studio does not load that plugin yet, so you connect MCP yourself and paste the instruction template.

Sign in with SparkLogs OAuth when the host prompts (browser consent).

All plugin hosts install from the same marketplace repository, itlightning/sparklogs-ai-plugins. Source: plugin repository.

Install the plugin

Use the page for your host:

• Claude (Code, Desktop, Team and Enterprise)
• Cursor
• Codex

Ask questions and run investigations

After the plugin or MCP is connected, ask in plain language and ask it to use SparkLogs data.

Your AI then chooses the MCP tools to analyze SparkLogs at the right level of detail. Answers carry citations, so you can open the same evidence in the SparkLogs app.

Follow-ups are expected: narrow the window, pivot to another host, ask what else failed the same way.

The plugin also contains skills that accelerate common workflows:

• investigate writes a full cited report for the ticket or the next engineer.
• analyze-cause is an optional follow-up: candidate root causes, with how to confirm or refute each one.
• summary and explain re-render a prior investigation or walk a finding back to its evidence.

How you invoke a skill depends on the host. Ask in plain language everywhere ("use sparklogs-investigate on SRV-FILE01 this week"). Codex also exposes $sparklogs:sparklogs-investigate. Claude and Cursor ship follow-up commands for summary and explain; ask, investigate, and analyze-cause are skills.

Workflow guide: agentic RCA.

MCP for your own automation

Point a compatible MCP client at https://mcp.sparklogs.app/mcp. Use OAuth (dynamic discovery if the host offers it). Sign in to SparkLogs when prompted. Grant only the scopes the client needs.

Your agent can search events, page and refine results, list sources, pull pattern statistics, and read agent health, including devices that have gone silent. Sampled counts are labeled, so a partial number is not treated as a complete one.

Hosts that do not load the SparkLogs plugin need instructions for good results. Copy the Agent Instruction Template into the agent's system or instruction field.

Microsoft Copilot Studio is the common case: connect Copilot Studio.

Use SparkLogs as an evidence layer next to other MCP tools (RMM, PSA, ticketing) in workflows you already run.

See also the live demo.

Do not set an API key or bearer header on the connector unless you intend to skip OAuth. API tokens: Workspace Access.

Microsoft Copilot Studio

Full walkthrough (standard harness, environment, MCP, publish): Microsoft Copilot Studio.

Claude (organization-wide)

Team and Enterprise org marketplace steps: Claude.

If something fails to connect

• Confirm the OAuth grant is for the same workspace you deployed agents into.
• Confirm the endpoint can reach https://mcp.sparklogs.app/mcp over HTTPS.
• Do not add an Authorization header to the plugin's MCP server unless you intend to use an API token instead of OAuth.
• API tokens are for hosts that cannot do OAuth. Mint and revoke them in the app in Workspace Access.

Updating the AI plugin

The plugin improves often. Update steps live on each host page: Claude, Cursor, Codex. Copilot Studio has no plugin to update; tool descriptions refresh from the SparkLogs MCP server when members connect.