systems log compression for agents

95% fewer log tokens
Same debugging signal

$curl -fsSL https://codag.ai/install.sh | sh

Free forever.

26.6M tokens

1,200,000 lines · 108 MB

raw logs
1 hour window

3,317 tokens

1 capsule

incident capsule
schema-valid json

2026-05-04T14:22:11Z INFO pod/api-7f9 starting...

2026-05-04T14:22:11Z INFO loaded config /etc/api

2026-05-04T14:22:12Z INFO postgres pool size=20

2026-05-04T14:22:12Z INFO redis ping ok 0.6ms

2026-05-04T14:22:13Z INFO health probe ok 200

2026-05-04T14:22:14Z INFO request id=abc123 path=/v1/users

2026-05-04T14:22:14Z INFO cache hit user:42

2026-05-04T14:22:15Z WARN pool acquire 240ms

2026-05-04T14:22:16Z WARN pool acquire 480ms

2026-05-04T14:22:16Z ERROR psycopg2.OperationalError: connection

2026-05-04T14:22:17Z ERROR retry 1/3 db_users

2026-05-04T14:22:17Z INFO request id=abc124 path=/v1/orders

2026-05-04T14:22:18Z ERROR retry 2/3 db_users

2026-05-04T14:22:18Z ERROR upstream timeout id=abc124

2026-05-04T14:22:19Z INFO cache miss user:99

2026-05-04T14:22:19Z WARN circuit breaker open svc=db

2026-05-04T14:22:20Z INFO request id=abc125 path=/v1/users

2026-05-04T14:22:20Z ERROR pool exhausted, queue=18

2026-05-04T14:22:21Z INFO retry succeeded id=abc126

2026-05-04T14:22:21Z WARN p99 latency 2840ms

2026-05-04T14:22:22Z INFO cache miss user:51

+ 1,199,979 more lines …

{
  "service": "api",
  "window": "14:22:11 to 15:22:11",
  "compression": 8021,
  "evidence": [
    {
      "role": "root_cause",
      "line": 412847,
      "text": "psycopg2.OperationalError"
    },
    {
      "role": "trigger",
      "line": 412831,
      "text": "pool acquire 480ms"
    },
    {
      "role": "consequence",
      "line": 412854,
      "text": "pool exhausted, queue=18"
    }
    // + 4 more, all cited
  ],
  "routine_summary": { "total_lines": 1085399, "template_count": 15 }
}

the problem

Agents are great at debugging
until they hit the logs

for individuals

Too costly to read

Every read burns tokens and context. The window fills with routine noise before your agent reaches the answer.

for platform & infra

Too big to read

Millions of lines a day, more than any agent can hold. Most of it never fits the window at all.

the capsule

Not a summary
A cited capsule

Codag returns schema-valid JSON. Every line it keeps points to a real line number, tagged by its role in the incident. Nothing summarized away, nothing invented.

cited to the line

Every claim references a real line number. No invented evidence.

tagged by role

root_cause, trigger, consequence. Your agent gets causality, not a flat dump.

schema-valid

Strict JSON your agent and tools parse every time.

IncidentCapsule · 1.2M lines → 3.3k tokens

{

"service": "api",

"window": "14:22:11 to 15:22:11",

"compression": 8021,

"evidence": [

{ "role": "root_cause", "line": 412847, "text": "psycopg2.OperationalError" }

{ "role": "trigger", "line": 412831, "text": "pool acquire 480ms" }

{ "role": "consequence", "line": 412854, "text": "pool exhausted, queue=18" }

"routine_summary": { "total_lines": 1085399, "templates": 15 }

}

for coding agents

Your agent reads logs
We hand it what matters

Set up once, then wrap any log fetch your agent already makes.

claude code

Hooks + MCP, wired automatically

codag setup installs the hook and the MCP server. Claude reads logs through Codag from then on.

Same Claude. Same answers. Fraction of the token bill.

$ codag setup
detected Claude Code
registered MCP server: codag

claude tail_kubernetes
returns compact incident capsule

codex

MCP, drop-in

Point Codex at the Codag MCP server. Same prompts, compressed logs.

$ codag mcp serve
tools: tail_aws_logs, tail_vercel, wrap

codex wrap docker logs api
raw logs stay out of the prompt

any source

Wrap any log command
We handle the rest

Drop-in over HTTPS. Point Codag at any log stream you already run, and your agent gets one compact capsule back.

$ codag wrap -- kubectl logs -n prod api

$ codag wrap -- vercel logs --since 1h

$ codag wrap -- aws logs tail /prod/api

$ codag wrap -- railway logs

$ codag wrap -- docker compose logs api

$ codag wrap -- journalctl -u api -f

→ IncidentCapsule · 1.2M lines → 3.3k tokens · schema-valid

vercel aws cloudwatch railway kubernetes docker datadog sentry journalctl any stdout

faq

Questions, answered

What is Codag?

Codag is a developer tool that compresses infrastructure logs into a schema-valid IncidentCapsule that AI agents can read. It turns up to 1.2M log lines into roughly 3,300 tokens in under a second, so your agent spends its context on reasoning instead of scrolling raw logs.

How is Codag different from raw logs or Drain3?

Codag keeps every line that matters and tags it by its role in the incident, with a pointer to the real log line number. Nothing is summarized away and nothing is invented. It is benchmarked against Drain3 and a raw-logs control on LogHub-2.0 with a blind-judge agent-diagnosis evaluation.

Does Codag replace my LLM?

No. Codag sits in front of your LLM. Send raw logs to Codag, get a structured IncidentCapsule back, then pass that capsule to whatever agent you already use: Claude, GPT, Gemini, or a local model.

Which log formats does Codag support?

Anything line-oriented: JSON logs, syslog, framework-specific formats like Hadoop, Spark, HDFS, and Kubernetes, and unstructured application logs. Preprocessing handles parsing and PII redaction before templating.

How much does Codag cost?

Codag is free forever on the Free plan, which includes 50 MB per month. Paid plans start at $19 per month for Hobby and $199 per month plus usage for Team. Pricing is by compute, not seats.

95% fewer log tokensSame debugging signal

Agents are great at debugging until they hit the logs