# logs/ — Production Log Querying (Loki)

See @../../CLAUDE.md for project-wide patterns.

## What This Is
Single MCP tool for querying production logs from a Loki instance. **Completely separate from `work_logs/`** (which is the peon DB audit trail).

## MCP Tool
`query_logs(query, start, end, limit=100)` — sends LogQL query to Loki HTTP API.

## How It Works
- Calls `GET /loki/api/v1/query_range` with query, start/end as nanoseconds since epoch, direction=backward
- Time formats supported: ISO 8601 with `Z`, `+00:00`, or no TZ suffix
- Defaults: start = 15 min ago, end = now
- Returns: list of `{timestamp (ISO), labels (dict), line (str)}`

## Environment
- `PEON_LOKI_URL` — Loki endpoint (default: `http://loki:3100`)
- No authentication — assumes Loki is on a trusted network

## Gotchas
- Loki must be running and accessible or tool fails
- LogQL syntax is user's responsibility — no query validation
- Direction is hardcoded to `backward` (most recent first)
- 15 second request timeout
- This is a tools-only module (no routes.py, no client.py, no schemas.py)
