AI agents are good at writing queries and bad at knowing which query to write. This toolkit teaches coding agents — Claude Code, Codex, Cursor, and anything that speaks Agent Skills — how to investigate production systems with Last9: which tool to reach for, in what order, and which dead ends to skip.
Each skill encodes an investigation workflow the way the product intends it — the skills hand off to one another when an investigation crosses domains.
| Skill | What it teaches |
|---|---|
last9-logs |
Log investigation: scope to a service first, attribute filters over body search, aggregate before drilling into raw lines |
last9-traces |
Trace investigation: a five-question interview that lands on the right tool call, plus a tracejson syntax reference card |
npx skills add last9/ai-toolkitInstall a single skill, or target a specific agent:
npx skills add last9/ai-toolkit --skill last9-logs
npx skills add last9/ai-toolkit -a claude-codeClaude Code and Codex users can install through their plugin marketplaces instead. The marketplace package lives in plugins/last9/.
Last9 MCP is hosted, so there is no local server to run. Point your agent's MCP config at your organization's endpoint. For Codex:
[mcp_servers.last9]
url = "https://app.last9.io/api/v4/organizations/<org-slug>/mcp"For Claude Code, add the same endpoint through its MCP configuration flow. Then run /mcp to authenticate. Keep local MCP config files (.codex/config.toml, .claude/settings.local.json) out of version control.
The top-level skills/ directory is canonical; the packaged copies under plugins/last9/skills/ are generated by scripts/sync-agent-plugin-skills.sh, and CI fails any PR where the two drift. See CONTRIBUTING.md for the workflow, and SECURITY.md for reporting vulnerabilities.
Last9 AI Toolkit is released under the MIT License.