Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fmcp-server%2Faws-devops-agent.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fmcp-server%2Faws-devops-agent.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) # Connect AWS DevOps Agent to Coralogix Connect Coralogix to AWS DevOps Agent so the agent can use your logs, metrics, and traces during incident investigations and, when you configure it, start investigations automatically when a Coralogix alert fires. Responders begin an investigation with context already in hand. This is a built-in integration, so you do not install or operate a local connector. AWS DevOps Agent reaches Coralogix through the Coralogix hosted Model Context Protocol (MCP) server, and Coralogix reaches AWS DevOps Agent through a webhook. For telemetry introspection the agent needs read-only access, so grant only read permissions. ## How it works[​](#how-it-works "Direct link to How it works") The integration has two independent paths. Configure the first on its own if you start investigations manually, or configure both to also trigger investigations automatically. * Telemetry introspection: during an investigation, AWS DevOps Agent queries Coralogix telemetry through the MCP server. This path answers requests and cannot start an investigation on its own. * Automated triggering: when a selected alert fires, Coralogix sends an event to the Agent Space webhook, which opens an investigation. This path uses the Coralogix Notification Center or a legacy outbound webhook. ``` Coralogix alert -> Coralogix Notification Center / outbound webhook (or AWS EventBridge) -> AWS DevOps Agent webhook -> New investigation AWS DevOps Agent investigation -> Coralogix hosted MCP server -> Read logs, metrics, traces, RUM, alerts, and incidents ``` ## What you need[​](#what-you-need "Direct link to What you need") * An active Coralogix account. * Access to AWS DevOps Agent with permission to register account-level capability providers, and at least one Agent Space. * Your Coralogix domain or region value, such as `eu1`. The MCP endpoint uses the API host `api..coralogix.com`, which can differ from the hostname you see in the Coralogix UI. * One authentication method for the MCP server: OAuth, or a dedicated personal Coralogix API key. * Read permissions for each telemetry type the agent queries. Scope the credential to read-only, and do not grant write, delete, or administrative access. Create a dedicated personal API key rather than reusing a broadly privileged key, because the MCP server inherits the permissions of the key owner. At minimum, grant these read permissions when you create the key: | Telemetry | Coralogix permission | | ---------------- | ----------------------------------------- | | Logs | Query logs (`ReadData` on log data) | | Metrics | Query metrics (`ReadData` on metric data) | | Spans and traces | Query spans (`ReadData` on span data) | For the full list, see [MCP server permissions](https://coralogix.com/docs/user-guides/mcp-server/permissions.md). [![Screenshot of the Coralogix create personal key dialog with DataQuerying log, metric, and span read permissions selected](/docs/assets/images/image6-4da9cd7bd42265df214cf20b99966af2.webp)](https://coralogix.com/docs/assets/images/image6-4da9cd7bd42265df214cf20b99966af2.webp) Note The Coralogix MCP endpoint format is `https://api..coralogix.com/mgmt/api/v1/mcp`. EU1 (Ireland) is a naming exception: its canonical API host is the bare `api.coralogix.com`. The regional alias `api.eu1.coralogix.com` also resolves but can return `403` for EU1 credentials. If one host fails authentication, try the other. Every other region carries its label, for example `https://api.eu2.coralogix.com/mgmt/api/v1/mcp` for EU2. ## Register Coralogix as a capability provider[​](#register-coralogix-as-a-capability-provider "Direct link to Register Coralogix as a capability provider") Register the Coralogix MCP server once at the AWS account level. After registration, it is available to every Agent Space in the account. [![Screenshot of the AWS DevOps Agent Capability Providers page with the MCP Server provider available to register](/docs/assets/images/image14-f78e6a35bb53b9ee7d86a6bdd08b0767.webp)](https://coralogix.com/docs/assets/images/image14-f78e6a35bb53b9ee7d86a6bdd08b0767.webp) ### Register in the console[​](#register-in-the-console "Direct link to Register in the console") 1. Sign in to the AWS Management Console and open AWS DevOps Agent. 2. Open the account-level **Capability Providers** page. 3. Find **MCP Server** in the **Available** section and select **Register**. 4. On the **MCP server details** page, enter: * **Name**: a descriptive name, for example `Coralogix_MCP`. * **Endpoint URL**: your region's MCP endpoint, for example `https://api.coralogix.com/mgmt/api/v1/mcp` for EU1. * **Description** (optional): for example, query Coralogix telemetry data. * **Enable Dynamic Client Registration** (preferred): Coralogix supports it. Clear this check box for API-key authentication. * **Connect to endpoint using a private connection**: leave cleared. The MCP server is a public SaaS endpoint. 5. Select **Next**. With Dynamic Client Registration, a browser opens to authenticate against your Coralogix account. Otherwise, select the authorization flow on the next step. 6. On the **Authorization flow** page, select **API Key** for a personal API key, or **OAuth 3LO** for the browser authorization flow. 7. Select **Next**. [![Screenshot of the Register MCP Server details step with the Coralogix endpoint and Dynamic Client Registration selected](/docs/assets/images/image2-ad03d621f427efee3fa0b2a72f484752.webp)](https://coralogix.com/docs/assets/images/image2-ad03d621f427efee3fa0b2a72f484752.webp) 8. On the **Authorization configuration** page, for **API Key**, set **Header name** to `Authorization` and **API key value** to `Bearer `, including the `Bearer `prefix. For **OAuth 3LO**, enter the Coralogix token and authorization endpoints and the scopes for read-only telemetry access. 9. Select **Next**, review on **Review and submit**, and select **Submit**. AWS validates the connection. On success, Coralogix appears in the **Currently registered** section. Note Coralogix recommends the `mcp-version: v2` header. Of the registration auth methods, only AWS SigV4 exposes a custom-headers field in the console. If your method cannot attach a custom header, rely on the server default and confirm the active version during validation. ### Register with the AWS CLI[​](#register-with-the-aws-cli "Direct link to Register with the AWS CLI") Replace the endpoint with your region's endpoint and supply your personal API key with the `Bearer `prefix: ``` aws devops-agent register-service \ --service mcpserver \ --service-details '{ "mcpserver": { "name": "coralogix", "endpoint": "https://api.coralogix.com/mgmt/api/v1/mcp", "authorizationConfig": { "apiKey": { "apiKeyName": "coralogix-api-key", "apiKeyValue": "Bearer ", "apiKeyHeader": "Authorization" } } } }' \ --region us-east-1 ``` Confirm the current field shape with `aws devops-agent register-service help`, because the service API can change. ## Create and enable an Agent Space[​](#create-and-enable-an-agent-space "Direct link to Create and enable an Agent Space") An Agent Space is where investigations run. Account-level registration makes Coralogix available, but each Agent Space must add it and select which tools it can call. This is also where you keep access least-privilege. ### Create an Agent Space[​](#create-an-agent-space "Direct link to Create an Agent Space") Skip this if you already have an Agent Space to use. 1. In AWS DevOps Agent, select **Create Agent Space**. 2. In **Agent Space details**, enter a **Name**. Optionally add a **Description** and an **Agent response language**. 3. Under **Give this Agent Space AWS resource access**, select an IAM role method. **Auto-create a new AWS DevOps Agent role** is the safe default and needs permission to create IAM (Identity and Access Management) roles. 4. Under **Enable the Agent Space Web App**, select a role method the same way. The Web App is where operators review and run investigations. 5. Optionally add **Tags**, then select **Create**. [![Screenshot of the AWS DevOps Agent Create an Agent Space form showing the name, description, and response language fields](/docs/assets/images/image1-4f0b34d948388f02425202496508543a.webp)](https://coralogix.com/docs/assets/images/image1-4f0b34d948388f02425202496508543a.webp) ### Enable Coralogix in the Agent Space[​](#enable-coralogix-in-the-agent-space "Direct link to Enable Coralogix in the Agent Space") 1. Open the **Agent Spaces** page, select your Agent Space, and select **View details**. 2. On the **Capabilities** tab, in the **Telemetry** (MCP server) section, select **Add**. 3. Select the Coralogix MCP server you registered, by its name. Registering at the account level does not enable it here. [![Screenshot of the Add a capability dialog with the registered Coralogix MCP server available to add](/docs/assets/images/image7-f947d689c9da9f81c37af7fab3f1728c.webp)](https://coralogix.com/docs/assets/images/image7-f947d689c9da9f81c37af7fab3f1728c.webp) 4. Allowlist the query tools. In the **MCP server tools** list, search `query` and select the three query tools: * `query_dataprime` for logs and traces or spans, using DataPrime. * `query_promql_instant` and `query_promql_range` for metrics, using PromQL. * Optionally add a RUM query tool if you use Real User Monitoring. 5. Select the webhook authentication type, needed only to trigger investigations automatically. Select **API key** so Coralogix can authenticate with a static `Authorization` header. Coralogix cannot compute the per-request signature that **HMAC** requires. 6. Select **Next**, then **Review**, then **Save**. 7. Copy the Webhook URL and the Webhook API Key from the set-up instructions, and store the key in a secrets manager. The key appears only once. Note Coralogix exposes a single `manage_alerts` tool that performs both reads and writes, so you cannot allowlist only its read operations. If you add it for alert context, use a Coralogix key with read-only alert permissions so any write fails at the API. Otherwise, omit `manage_alerts` and rely on the DataPrime and PromQL query tools. ## Trigger investigations from alerts[​](#trigger-investigations-from-alerts "Direct link to Trigger investigations from alerts") Configure this section to open an investigation automatically when a Coralogix alert fires. The telemetry path works on its own for manually started investigations. ### Webhook request format[​](#webhook-request-format "Direct link to Webhook request format") Send an HTTP POST to the Agent Space Webhook URL with a bearer token. Follow Version 2 of the AWS DevOps Agent webhook format: ``` POST Content-Type: application/json Authorization: Bearer x-amzn-event-timestamp: ``` The body carries the incident fields: ``` { "eventType": "incident", "incidentId": "cx-alert-8842-2025-11-23T18:00:00Z", "action": "created", "priority": "HIGH", "title": "example-service 5xx rate above 5% for 5m", "description": "HTTP 5xx rate exceeded 5% on example-service (production).", "timestamp": "2025-11-23T18:00:00Z", "service": "example-service", "data": { "metadata": { "environment": "production", "source": "coralogix" } } } ``` `incidentId` combined with `timestamp` must be unique per firing. Reused values are deduplicated and dropped. Tip Design the payload so the investigation is actionable. Carry the affected resource or Amazon Resource Name (ARN), the AWS account ID, the region, and a bounded time window inside `data`, plus the alert name and a deep link back to the alert. A title-only event produces an investigation that acknowledges the alert but has nothing to root-cause. ### Select a delivery path[​](#select-a-delivery-path "Direct link to Select a delivery path") Coralogix delivers the alert to the webhook in one of three ways. Configure one. All three send the same Version 2 request and differ only in where you template the payload. #### Path A: Coralogix Notification Center[​](#path-a-coralogix-notification-center "Direct link to Path A: Coralogix Notification Center") The Coralogix Notification Center uses a Connector for where to send, a Preset for what to send, and Routing for which alerts use them. 1. Create a **Generic HTTPS** connector. Set the URL to the Agent Space Webhook URL and the method to `POST`. Expand **Advanced**, then under **Headers** add `Content-Type: application/json` and `Authorization: Bearer `. [![Screenshot of the Generic HTTPS connector in Coralogix with the Advanced section expanded, showing the Content-Type and Authorization headers](/docs/assets/images/connector-advanced-headers-2709d9b64a7babf3beb685993f9808fb.png)](https://coralogix.com/docs/assets/images/connector-advanced-headers-2709d9b64a7babf3beb685993f9808fb.png) 2. Create a custom preset on the Generic HTTPS schema. Select the **Alert** entity type, because the `alert.*` and `alertDef.*` variables exist only for alert entities. Set the preset **Headers** template to `{}` and put the payload in the **Body** template: ``` { "eventType": "incident", "incidentId": "{{ alertDef.id }}", "action": "{% if alert.status == 'Resolved' %}resolved{% else %}created{% endif %}", "priority": "{% if alertDef.priority == 'P1' %}CRITICAL{% elif alertDef.priority == 'P2' %}HIGH{% elif alertDef.priority == 'P3' %}MEDIUM{% elif alertDef.priority == 'P4' %}LOW{% else %}MINIMAL{% endif %}", "title": {{ alertDef.name | json_encode }}, "description": {{ alertDef.description | default(value='') | json_encode }}, "timestamp": "{{ alert.timestamp }}", "service": "example-service", "data": { "metadata": { "source": "coralogix", "region": "us-east-1", "alertUrl": "{{ alert.alertDataUrl | default(value='') }}", "alertType": "{{ alertDef.type }}", "priority": "{{ alertDef.priority }}", "status": "{{ alert.status }}" } } } ``` The `json_encode` filter emits a safely quoted string, so `title` and `description` need no surrounding quotes. The `priority` block maps Coralogix `P1` through `P5` to the AWS set, and `action` maps the alert status to `created` or `resolved`. 3. In the preset editor, select the AWS DevOps Agent connector and select **Send test notification**. The editor renders the preset against sample data and posts to the webhook, so you can confirm an investigation opens before wiring a real alert. [![Screenshot of the Coralogix preset editor showing the Version 2 body template, its rendered preview, and the Send test notification action](/docs/assets/images/image9-cc46c833e944e2b7d68b8f582bf02af1.webp)](https://coralogix.com/docs/assets/images/image9-cc46c833e944e2b7d68b8f582bf02af1.webp) 4. In the alert's **Response** step, set **Notify on** to **Alerts, Signal-Based**. Then choose a notification method. For a targeted setup, select **Custom Notifications**, then on the **Destinations** tab select **+ Add destination** and choose the AWS DevOps Agent connector and its preset. To route dynamically instead, select **Route via Labels** and use a router whose `routingLabels` match the alert's labels (Team, Environment, Service). [![Screenshot of the alert Response step on the Destinations tab, showing the AWS DevOps Agent connector and the DevOps Agent Alert HTTPS Preset added as a destination](/docs/assets/images/alert-destinations-a84e7662f49d6aba14078d1ec4ae0009.png)](https://coralogix.com/docs/assets/images/alert-destinations-a84e7662f49d6aba14078d1ec4ae0009.png) #### Path B: legacy outbound webhook[​](#path-b-legacy-outbound-webhook "Direct link to Path B: legacy outbound webhook") Use this older mechanism if you are not yet on the Notification Center. Create a **Generic** outbound webhook, set the URL to the Agent Space Webhook URL and the method to `POST`, add the `Authorization` and `Content-Type` headers, and set the body to the Version 2 schema using the Coralogix dollar-style variables such as `$ALERT_ID`, `$ALERT_NAME`, and `$EVENT_TIMESTAMP`. Legacy webhooks substitute variables literally, with no conditional logic and no JSON encoding, so a quote or newline in an alert name can break the body. Prefer Path A when it is available. #### Path C: AWS EventBridge[​](#path-c-aws-eventbridge "Direct link to Path C: AWS EventBridge") Use this option when your organization routes alerts through AWS EventBridge. Send the selected alert events to EventBridge, create a rule that matches them, add an API destination pointed at the Agent Space Webhook URL, configure its connection to send the `Authorization` bearer header, and use an input transformer to map the payload to the Version 2 schema. ## Query Coralogix telemetry[​](#query-coralogix-telemetry "Direct link to Query Coralogix telemetry") After you authorize and enable the connection, AWS DevOps Agent calls the allowlisted MCP tools during an investigation. Coralogix groups the tools into logs and traces (DataPrime), metrics (PromQL), RUM, alerts, optional Olly tools, and management tools. For incident response, allowlist the read-only DataPrime and PromQL query tools first. The agent uses these tools to root-cause an incident: it queries logs for the affected service and window, queries traces to find failing routes and dependencies, and queries metrics to compare against a healthy baseline. ## Verify the integration[​](#verify-the-integration "Direct link to Verify the integration") Run these checks after setup and after any change to credentials or endpoints. 1. Confirm the provider appears on the **Capability Providers** page with your endpoint URL. 2. Confirm Coralogix appears as an enabled capability on the Agent Space **Capabilities** tab, with the tools you allowlisted. 3. Confirm the connection shows a connected or authorized status. Test the read path with a tool-list handshake, which returns a JSON-RPC result listing the Coralogix tools: ``` curl -sS -X POST "https://api.coralogix.com/mgmt/api/v1/mcp" \ -H "Authorization: Bearer " \ -H "mcp-version: v2" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' ``` Then send a test alert through each configured trigger path and confirm a new investigation opens in the target Agent Space. AWS labels the investigation **Triggered by MCP Server**, as expected, because AWS registers the provider webhook as an MCP-server webhook. AWS DevOps Agent recognizes a title-only test event as a synthetic check and reports an integration-check acknowledgment. To exercise data gathering, send an event whose `data` carries a real test-account resource or ARN, the AWS account, the region, and a bounded time window. ## Troubleshoot common issues[​](#troubleshoot-common-issues "Direct link to Troubleshoot common issues") | Symptom | Resolution | | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Registration validation fails or times out. | Confirm the endpoint uses the format `https://api..coralogix.com/mgmt/api/v1/mcp`. For EU1 use the bare host `api.coralogix.com`. The alias `api.eu1.coralogix.com` can return `403`. Confirm outbound network access, and set `HTTP_PROXY` and `HTTPS_PROXY` if required. | | Coralogix rejects MCP requests as an invalid version. | Send the `mcp-version: v2` header and remove any use of `v1`. | | API-key authorization fails. | Confirm the header name is `Authorization` and the value is `Bearer `. Confirm the key is a personal API key, not an ingestion key, and has not expired. | | Authorization succeeds, but telemetry returns permission errors. | Grant the credential read access to the telemetry category that fails. | | An alert fires, but no investigation starts. | Confirm you attached the alert to the connector or route, and that the target URL matches the Agent Space Webhook URL. Check the delivery log for responses other than 2xx. | | The webhook returns `200` but no investigation starts. | Confirm the body is valid JSON and matches the Version 2 schema, and that `incidentId` and `timestamp` are unique. | | A new investigation lacks Coralogix context. | Confirm Coralogix appears in the same Agent Space, that you allowlisted the read-only tools, and that the authorization status shows connected. | ## Security considerations[​](#security-considerations "Direct link to Security considerations") * Prefer OAuth over API-key authentication. OAuth avoids storing a static key, and you can revoke it independently. * Grant only read-only access to the telemetry categories the agent needs. * Treat the Webhook URL, Webhook API Key, and Coralogix API key as secrets, and store them in a secrets manager. * Rotate the keys periodically and immediately after suspected exposure. * Review the allowlisted tools regularly and remove any that are no longer needed. ## Remove the integration[​](#remove-the-integration "Direct link to Remove the integration") Remove Coralogix in the reverse order of setup. First, on each Agent Space **Capabilities** tab, remove or turn off the Coralogix provider. Then, on the account-level **Capability Providers** page, confirm the provider is no longer in use and select **Deregister**. ## Permissions[​](#permissions "Direct link to Permissions") Grant the person who registers the provider and the API-key owner the read permissions for the telemetry the agent queries. For the exact keys and the RUM, alerts, and management scopes, see [MCP server permissions](https://coralogix.com/docs/user-guides/mcp-server/permissions.md). ## Related resources[​](#related-resources "Direct link to Related resources") * [Coralogix MCP server overview](https://coralogix.com/docs/user-guides/mcp-server/overview.md) * [MCP server setup](https://coralogix.com/docs/user-guides/mcp-server/setup.md) * [MCP server OAuth](https://coralogix.com/docs/user-guides/mcp-server/oauth.md) * [MCP server tools overview](https://coralogix.com/docs/user-guides/mcp-server/tools/overview/index.mdx) * [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md) * [Coralogix domain reference](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md)