Terminal

north tail follows your production log. north top shows one app live: its endpoints, alerts, and uptime. Both read your server with the read-only agent key, from any machine.

Needs LogNorth v0.20.0 or later on the server.

Install and connect

curl -fsSL https://lognorth.com/cli | sh

That’s the whole setup. It picks the build for your Mac or Linux machine, checks it against the release checksum, and installs north without sudo: to /usr/local/bin if you can write there, otherwise ~/.local/bin. Then it asks for two things:

1. Your LogNorth URL, for example https://logs.yoursite.com.
2. An agent key, from Settings > Developer. It’s read-only and starts with lgn-agent-. It stays hidden as you paste it.

Settings > Developer shows the same command with your URL already in it, and with the key too right after you create one:

curl -fsSL https://lognorth.com/cli | sh -s -- https://logs.yoursite.com lgn-agent-...

To change servers later, run north connect. It checks the key against the server, then saves both to ~/.config/lognorth/remote.json, which only you can read. Run north alone to see which server it reads.

north connect also offers to add LogNorth to Claude Code, Codex, Gemini CLI, and Cursor. Those agents then start north mcp, so they read the same file. See MCP. Run north agents to add an agent you install later, and north call list_alerts to run any tool and print its JSON.

To update, run north update. It downloads the latest release and checks it against the release checksum, like the installer. To remove it, delete the north file it installed and ~/.config/lognorth.

north is open source (MIT): github.com/karloscodes/lognorth-cli. It is a small client for the same read-only tools your coding agent uses.

tail

north tail                      # everything, live
north tail --errors             # only failures
north tail --path /checkout     # one endpoint
north tail --app api-prod -n 50 # one app, the last 50 first

tailing https://logs.yoursite.com
05:00:56.997  POST   /checkout  201 · 850ms
05:00:57.138    Charging card  640ms
05:00:58.012  POST   /checkout  500 · 1204ms  Stripe::CardError: Your card was declined.  app/services/payment_service.rb:67

Flag	What it does
--errors	Only failed requests and errors
--path /checkout	Only events that mention the path
--app name	Only one app, by name or id. With several apps and no --app, each line shows its app
-n 20	How many recent events to show first. 0 shows only new ones

Words after the flags search the log: north tail --errors timeout.

tail follows by event id, so it prints each event once, in the order they arrived, even when an SDK sends a batch late. Colors turn off when you pipe it, or when NO_COLOR is set. ctrl+c stops.

top

north top
north top --app api-prod

top fills the terminal like htop: the 24-hour uptime strip, the alerts firing now, and the endpoints most broken first, with SPIKE or SILENT next to the ones alerting.

Key	What it does
j / k	Move down, up
enter	Show the selected endpoint’s recent errors
esc	Close them
w	Window: last hour, 24 hours, 7 days
a	Next app
r	Refresh now
q	Quit

It refreshes every 5 seconds and reads the uptime every 30. That is about half of what the server allows the agent key in a minute, so an agent can work at the same time. When the server says slow down, top waits and says so at the bottom.

north and lognorth

north runs on your laptop and only reads. lognorth is the command on your server that installs, updates, and restarts LogNorth. They are two programs with two names, so nothing gets mixed up when both are on one machine.