Work with the Cribl MCP Server

Learn how to configure and use the Cribl MCP server, an AI-native way to interact with your Cribl environment.

Overview

​

The Cribl MCP server can help you gain insight into your Cribl environment by investigating your Sources, Destinations, Worker Groups, and system health through an MCP client of your choice. The Cribl MCP server is self-hosted and can run locally or in the cloud, depending on the needs of your organization.

Prerequisites

​

• Cribl environment (cloud, self-hosted, or hybrid)
• MCP client (such as Cursor, Claude Desktop, GitHub Copilot, Windsurf, or LibreChat)
• Docker container (if you want to host locally)
• AWS account (if you want to host in AWS)
• Amazon ECS or Amazon ECS Anywhere (if you want to host in AWS)
• Access to port 3030

Set Up Your Target Environment and MCP Clients

​

For demonstration purposes, this guide will use a Cribl MCP server hosted locally through Docker, with Cursor as the MCP client.

Start by downloading the Cribl MCP server image. Depending on where you want to host your server, you can get the container image from Docker Hub or the AWS Marketplace.

• Docker Hub
• AWS Marketplace

Run the image in a container on your platform of choice. The Cribl MCP server requires certain environment variables to be set for the container, as described in the following table.

When you have the information needed to populate the necessary environment variables, run your Cribl MCP server in your chosen container using one of the following terminal commands:

Docker (local)

​

docker run -p 3030:3030 \
  -e CRIBL_BASE_URL=<https://your-org.cribl.cloud> \
  -e CRIBL_CLIENT_ID=<your-client-id> \
  -e CRIBL_CLIENT_SECRET=<your-client-secret> \
  -e MCP_API_KEY=<your-secure-api-key> \
  cribl/cribl-mcp-server

AWS ECS

​

docker run -p 3030:3030 <aws_account_id>.dkr.ecs.<aws_region>.amazonaws.com/cribl/cribl-mcp-server
-e CRIBL_BASE_URL=<https://your-org.cribl.cloud> 
-e CRIBL_CLIENT_ID=<your-client-id>
-e CRIBL_CLIENT_SECRET=<your-client-secret>
-e MCP_API_KEY=<your-secure-api-key> 
cribl-mcp

You should see the following responses from your container hosting platform, confirming that your Cribl MCP server is successfully running:

[2025-11-04T17:00:45.965Z] INFO  Configuration validated successfully {"baseUrl":"<https://your-org.cribl.cloud>"}
[2025-11-04T17:00:45.966Z] INFO  Registering MCP tools...
[2025-11-04T17:00:45.966Z] INFO  MCP tools registered successfully
[2025-11-04T17:00:45.969Z] INFO  MCP Stateless Streamable HTTP Server listening on port 3030

Configure Your MCP Client

​

The Cribl MCP server is treated as a local MCP server, even if it is running in an ECS instance. For your chosen MCP client, add the following Cribl MCP server details to the client’s mcp.json file:

{
  "mcpServers": { 
    "cribl-mcp-remote": { 
      "command": "npx", 
      "args": [ "-y", "mcp-remote", "http://localhost:3030/mcp", "--transport", "http" ] 
      } 
    }
}

After successful configuration, your client should surface four available tools for the Cribl MCP Server: cribl_getSystemMetrics, cribl_listWorkerGroups, cribl_getSources, and cribl_getDestinations. You can access each of these tools through your MCP client to gain insights on and interact with your Cribl environment.

Use Case Examples

​

The Cribl MCP server provides an AI-native approach to interacting with your Cribl environment. When evaluating how to best use your Cribl MCP, consider the following use cases as a reference.