Logins

Tool Name: logs/logins

Lists login history (wraps last) or failed login attempts (type: "failed", wraps lastb). Read-only; returns raw text, not JSON. limit keeps the N most recent entries and user filters by username; the trailing wtmp begins... summary line is dropped and an empty history returns an empty line. last/lastb must be installed on the host. For account details use users/list, for authentication messages logs/journal-control.

type: "failed" typically requires privileged: true, since btmp is usually root-only readable. When mcpd runs containerized, privileged: true also automatically reads the real host's login history - see Master Daemon Configuration's worker.containerized setting.

Arguments

Argument	Type	Required	Description
`limit`	integer	no	Only return this many most recent entries
`privileged`	boolean	no	Run as root - typically required for type "failed". Needs a grant for this tool in mcp-sudo.yaml
`type`	string	no	"success" (default, wraps `last`) or "failed" (wraps `lastb`) One of: `success`, `failed`.
`user`	string	no	Only return entries for this username

Example

Every example below shows the equivalent linuxctl command and the raw MCP JSON-RPC call it resolves to. The raw call always follows the same two-step pattern (see MCP API overview for the full explanation): open an SSE stream to get a one-time POST endpoint, then POST the JSON-RPC request there - the result streams back on the SSE connection.

linuxctl

linuxctl get logs logins --privileged true

Output:

last failed: exec: "last": executable file not found in $PATH

curl (raw MCP JSON-RPC)

# 1. Open the SSE stream (in the background) and capture the one-time POST endpoint
curl -N -s --cacert mcpd.crt -H "Authorization: Bearer $MCP_TOKEN" https://localhost:9091/sse &
# server sends: event: endpoint / data: /message?session_id=...

# 2. POST the tools/call request to that endpoint
curl -s --cacert mcpd.crt -X POST "https://localhost:9091/message?session_id=<from step 1>" \
  -H "Authorization: Bearer $MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": "1", "method": "tools/call", "params": {"name": "logs/logins", "arguments": {"privileged": true}}}'

# 3. The result arrives on the SSE stream opened in step 1

Response:

{
  "jsonrpc": "2.0",
  "id": "23",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "last failed: exec: \"last\": executable file not found in $PATH"
      }
    ],
    "isError": true
  }
}

Arguments​

Example​

Arguments

Example