mcp-infra-lens

Explain Linux incidents over SSH with baseline-aware MCP tooling.

Demo

Sample analyze_server response when Claude asks, "What's wrong with prod-01?":

{
  "host": "prod-01.internal",
  "health_score": 42,
  "summary": "Found 2 anomalies on prod-01.internal. Most urgent signal: CPU is at 91% (3.4σ above baseline 28.2%). Load is 7.2/6.8/5.1. Top CPU consumer: java (87%).",
  "anomalies": [
    {
      "metric": "cpu",
      "severity": "high",
      "value": 91,
      "z_score": 3.4,
      "explanation": "CPU is at 91% (3.4σ above baseline 28.2%). Load is 7.2/6.8/5.1. Top CPU consumer: java (87%).",
      "recommendation": "Investigate java (PID 18432) and review application logs or scale-out options."
    },
    {
      "metric": "disk:/",
      "severity": "high",
      "value": 91,
      "explanation": "Disk / is 91% full (182GB/200GB).",
      "recommendation": "Run du -sh //* | sort -rh | head -20 and clean logs or temporary files."
    }
  ]
}

What It Does

mcp-infra-lens connects to Linux hosts over SSH, captures a live infrastructure snapshot, compares it to recently recorded baselines, and explains anomalies in plain English.

• Collects CPU, memory, disk, network, process, and OS data without mutating the target host
• Records local metric history in SQLite for baselines, comparisons, and trend lookups
• Uses z-score analysis for CPU anomaly detection once enough baseline samples exist
• Explains the likely cause of pressure, not just the raw metric value
• Supports MCP over stdio and Streamable HTTP

How It Works

flowchart TD
    A["Claude / Cursor / VS Code / Windsurf"] --> B["mcp-infra-lens"]
    B --> C["server-core.ts"]
    C --> D["collector.ts"]
    C --> E["analyzer.ts"]
    C --> F["baseline.ts + db.ts"]
    D --> G["ssh.ts"]
    G --> H["Linux host over SSH"]
    F --> I["SQLite history + baselines"]

analyze_server now performs real sampled collection over the requested duration_minutes, averages CPU and memory pressure across the collection window, persists the resulting snapshot, and then runs anomaly detection against the selected baseline.

Tools

| Tool | What it does | Key params | | --- | --- | --- | | analyze_server | Collects a sampled snapshot, stores it, and explains anomalies | connection, duration_minutes, include_processes, include_network | | snapshot | Captures and stores the current point-in-time metrics without analysis | connection | | record_baseline | Saves a labeled healthy-state sample for future comparisons | connection, label | | compare_to_baseline | Compares the current state to a named baseline and explains the deltas | connection, baseline_label | | get_history | Returns historical CPU, memory, or load points from SQLite | host, metric, hours, label? |

Quick Start

1. Run via npx

npx -y mcp-infra-lens

If you are pinned to 1.0.1, upgrade to 1.0.2 or newer to avoid Node 24 native install failures:

npx -y mcp-infra-lens@latest

2. Claude Desktop

Published package:

{
  "mcpServers": {
    "infra-lens": {
      "command": "npx",
      "args": ["-y", "mcp-infra-lens"],
      "env": {
        "INFRA_LENS_D

... [View full README on GitHub](https://github.com/oaslananka/mcp-infra-lens#readme)