ULogViewer: a cross-platform, agent-native log viewer with MCP support

What ULogViewer solves, and for whom

Log files arrive in whatever shape the tool that wrote them chose. A Windows machine produces EVTX event logs, an application writes plain text, a database writes rows, and a device writes something with its own timestamp format. Reading them usually means opening several tools, or writing a parser each time. ULogViewer is a desktop application that reads, parses and analyzes various types of logs in one place, and the repository describes it as cross-platform and agent-native. The audience is engineers and support staff who work on a workstation rather than inside a log aggregation service: someone handed a customer's log bundle, someone checking an EVTX file on a Windows box, or someone who wants an AI client to look at a log without uploading it to a third party. The 2026.1 release added two features that frame the current version. Sensitive Data Protection filters data before it leaves the viewer, and Model Context Protocol support lets AI clients read logs through a defined interface instead of a copy-paste loop.

How ULogViewer is put together

The project is a .NET application with an Avalonia UI, which is what makes the same codebase build for Windows, macOS and Linux. The dependency list in the README shows the pieces: Avalonia and AvaloniaEdit for the interface and the text editor, LiveCharts2 for charts, NLog for the application's own logging, and IronPython 3 and Jint for scripting, which is how user-defined parsers and filters can be written in Python or JavaScript rather than compiled into the app. Storage and data access lean on System.Data.SQLite and MySqlConnector, and EVTX parsing comes from EricZimmerman's evtx library. Roslyn appears in the list, which points at runtime compilation of C# code inside the viewer. The repository layout backs this up: a ULogViewer/ project directory, a ULogViewer.Tests/ project using NUnit, a SQLite/ directory, and a TextShellHost/ directory. The MCP work is visible at the top level too: AGENTS.md and CLAUDE.md sit next to the solution file, which is what you would expect from a project that now ships an agent-facing interface. The data flow is straightforward: a log source is read, a profile or parser turns each line into structured fields, filters and charts operate on those fields, and the same parsed stream is what an MCP client sees.

Installing ULogViewer and reading a first log

There is no package manager step in the README. Distribution is through GitHub release archives, one per platform and architecture, named ULogViewer-2026.1.5-win-x64.zip, ULogViewer-2026.1.5-osx-arm64.zip, ULogViewer-2026.1.5-linux-x64.zip and similar variants for x86, arm64 and Intel macOS. Download the archive for your platform, unpack it, and run the executable inside. On Windows there is one upgrade caveat the README states explicitly: if upgrading from 2026.1.0 Preview, 2026.1.1 RC or 2026.1.2 fails, close all mcp.exe processes manually and try again. The repository also carries build scripts if you prefer to compile from source: BuildWindowsPackages.bat, BuildMacOSPackages.sh and BuildLinuxPackages.sh, with NotarizeMacOSPackages.sh for the macOS signing step. A typical session starts by opening a log file, then choosing or defining a profile that describes how to parse it. The README's 2026.1 notes mention phrase input assistance in the text filter, so the filter box suggests phrases as you type rather than requiring exact syntax from memory. If you plan to use the MCP side, the AI client is what initiates the connection; the README does not document the transport or endpoint, so treat the client's own MCP configuration as the place to look. The commands below are only the download-and-unpack path for the Linux x64 archive, since the README gives no installer:

Where ULogViewer is the wrong tool

ULogViewer is a desktop viewer. It has no server component, no shared index, and no alerting. If your problem is searching terabytes of logs across a fleet, correlating events from dozens of services, or paging someone at 3 a.m., this is not that product, and no amount of MCP support changes it. The MCP integration is also per-client: an AI agent connected to your local viewer sees what that viewer has loaded, not a central store. The README is silent on rollback, on downgrade paths, and on what happens to a profile or filter set when you move between the 2026.1.x releases. The upgrade notice is a real operational detail rather than a formality: an upgrade can be blocked by a running mcp.exe process, which means the MCP feature has a lifecycle cost on Windows. Finally, the project depends on a fairly wide stack of third-party libraries, so anyone packaging it for an offline or air-gapped environment should expect to resolve those dependencies themselves.

Alternatives and the difference in approach

The nearest comparison in the related searches is Tailviewer, another open source log viewer. The difference is breadth of format support and platform reach rather than a feature checklist: ULogViewer ships builds for Windows, macOS and Linux from one Avalonia codebase, while a Windows-oriented viewer stays on Windows. If your logs already live in a search cluster, an Elastic or Loki style stack answers a different question entirely, because it indexes centrally instead of parsing locally, and it costs you a server to run. If you only ever read plain text logs on a terminal, grep and less remain faster than launching a GUI. ULogViewer earns its place when the format is awkward, when the machine is not yours to install a server on, or when you want an AI client to read logs without shipping them anywhere.

Maintenance, licensing and upgrade cost

The last push to the default branch was on 2026-07-31, the same day as the 2026.1.5 release, and 2026.1.4 and 2026.1.3 landed on 2026-07-27 and 2026-07-21. That is a tight release cadence within the 2026.1 line, and it means upgrade cost is mostly about keeping up rather than waiting for fixes. The licence is MIT, which permits commercial and closed-source use and modification provided the copyright notice and licence text are preserved; that is a summary of the licence, not legal advice, and if you redistribute a modified build you should read LICENSE yourself. The practical cost of upgrading is the Windows mcp.exe caveat plus whatever profile or parser changes a release introduces, none of which the README documents for the 2026.1.x series. Budget for a quick smoke test of your own log formats after each upgrade rather than assuming compatibility.

Editorial conclusion

Adopt ULogViewer if you need one desktop tool to read and parse heterogeneous log files across Windows, macOS and Linux, or if you want an AI client to inspect logs directly over MCP. Do not adopt it if you need a hosted, multi-user log platform, or if you rely on a package manager that the project does not publish to. Before deploying, verify the MCP setup against your AI client, confirm that Sensitive Data Protection covers the fields you care about, and check whether the Windows mcp.exe upgrade issue from 2026.1.0 Preview, 2026.1.1 RC or 2026.1.2 applies to your version.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes