Events
Query, retrieve, and investigate analytics events via MCP tools.
Events are the raw log records emitted by SDKs — every Owl.info(), Owl.error(), Owl.step(), etc. Filter by app, level, user, session, environment, screen, or time range. Defaults to the last 24 hours.
Use these tools to search events, inspect individual records, and investigate context around notable events.
query-events
Query analytics events with flexible filters. Defaults to the last 24 hours.
| Parameter | Type | Required | Description |
|---|---|---|---|
project_id | UUID | No | Filter by project |
app_id | UUID | No | Filter by app (takes precedence over project_id) |
level | string[] | No | Array of log levels to include: any of info, debug, warn, error (e.g. ["info","warn"]). A single-string value is also accepted for backwards compatibility. |
user_id | string | No | Filter by user ID |
session_id | UUID | No | Filter by session ID |
environment | string | No | ios, ipados, macos, watchos, android, web, or backend |
screen_name | string | No | Filter by screen name |
since | string | No | Start time — relative (1h, 7d) or ISO 8601 |
until | string | No | End time — relative or ISO 8601 |
cursor | string | No | Pagination cursor from previous response (tied to the current order) |
limit | number | No | Max results (default 50, max 200) |
data_mode | string | No | production (default), development, or all |
order | string | No | Sort direction by timestamp: desc (default, newest first) or asc (oldest first — preferred for session timelines and breadcrumb walks) |
compact | boolean | No | Drop verbose fields (custom_attributes, device metadata) to stay under MCP token limits |
Returns { events: [...], cursor, has_more }. Pass cursor to the next call for pagination.
Session reconstruction
Use session_id to walk a full user session manually — every event the SDK logged during that session, in order.
For issue investigation, prefer investigate-event over query-events. Pass an occurrence's event_id from get-issue and you get the same session plus cross-app events for the same user (e.g. backend logs that ran during the iOS session) in one call — richer than walking the session by session_id alone.
Time formats
Relative — a number followed by a unit suffix:
| Suffix | Unit |
|---|---|
s | Seconds |
m | Minutes |
h | Hours |
d | Days |
w | Weeks |
Absolute — ISO 8601 timestamps: 2025-01-15T10:00:00Z
get-event
Get a single event by ID with full details including custom attributes and device info.
| Parameter | Type | Required | Description |
|---|---|---|---|
event_id | UUID | Yes | The event ID |
investigate-event
The standard tool for investigating an issue's occurrences. Pass an occurrence's event_id from get-issue and receive the full breadcrumb trail leading to the error. If the target has a session_id, the tool pulls the entire session from that app; otherwise it falls back to a ±window_minutes time window. It then enriches the result with cross-app events for the same user in the same project (bounded by the session/window's time range) so backend and client events appear together even when they don't share a session_id. Results are merged, deduped by event id, and sorted ascending by timestamp.
| Parameter | Type | Required | Description |
|---|---|---|---|
event_id | UUID | Yes | The target event ID |
window_minutes | number | No | Fallback time window, used only when the target has no session_id (default: 5) |
data_mode | string | No | production (default), development, or all — set to match the target event's mode |
compact | boolean | No | Drop verbose fields (custom_attributes, device metadata) to stay under MCP token limits |
Returns { events, target_event_id, total } — a single chronological timeline with the target event flagged by target_event_id.
Run this for multiple occurrences of the same issue (not just one) to surface common patterns — same screen, same app_version, same user flow — before commenting or resolving. One breadcrumb trail rarely tells the whole story.