How is this different from connecting Langfuse MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Langfuse MCP API changes?

We track the Langfuse MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Langfuse tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Langfuse?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Langfuse MCP server myself?

No. TrustGate connects to the Langfuse MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Langfuse directly.

Connect Langfuse MCP to your AI agents, securely.

Q: Is Langfuse MCP secure?

The server itself exposes 94 tools, and some of them can write to your Langfuse account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Langfuse.

One secured endpoint for every Langfuse call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Langfuse MCP now

What your agents can ask once Langfuse MCP is connected.

Select the tools your AI agents can call

94 tools from the Langfuse MCP schema.

Showing 94 tools

getPromptreadFetches a prompt by name with an optional label or version, returning the full content with resolved dependencies. Label and version are mutually exclusive; neither returns latest.
getPromptUnresolvedreadFetches a prompt without resolving dependencies, returning raw content with dependency tags intact for understanding composition or debugging the dependency graph.
listPromptsreadLists and filters prompts in the project, returning versions, labels, tags, last updated timestamp and prompt type.
createTextPromptwriteCreates a new text prompt version. Prompts are immutable, new versions receive the latest label automatically, and the production label cannot be assigned at creation.
createChatPromptwriteCreates a new chat prompt version as an array of role and content messages, optionally with placeholder messages that reference runtime variables such as conversation history.
updatePromptLabelshigh riskUpdates the labels on a prompt version and is the only way to modify an existing prompt. Adding the production label promotes that version into live traffic, and labels are unique across versions so setting one removes it from whichever version held it.
listObservationsreadFinds generations, spans, events, agent steps and tool calls, with filters for trace, name, type, level, environment, time range and advanced conditions. Input, output and metadata projections require a window of at most 14 days.
getObservationreadReturns one observation by ID with its timing, model, status, payload, metadata, usage, cost and prompt fields. Metadata truncates to 200 characters per key unless expandMetadataKeys is passed.
getObservationFieldSchemareadShows which observation fields can be requested, marking default fields and fields that may be large or contain sensitive application data.
getObservationFilterSchemareadShows which observation fields can be used in filters, including the supported operators for each.
getObservationFilterValuesreadLists example values for a string or boolean filter field such as names, types, levels, environments, models, tags, users or sessions; numeric fields return a range.
listAnnotationQueuesreadLists annotation queues, the worklists that collect trace or observation items for human review and scoring.
getAnnotationQueuereadReturns one annotation queue by ID.
listAnnotationQueueItemsreadLists the items in a queue, each linking one trace or observation to it with a review status, with optional status filtering.
getAnnotationQueueItemreadReturns one queued trace or observation with its review status, by queue ID and item ID.
createAnnotationQueuewriteCreates an annotation queue bound to one or more score configurations.
createAnnotationQueueItemwriteAdds a trace, observation or session to a queue for review.
updateAnnotationQueueItemwriteUpdates a queue item's review status between pending and completed.
deleteAnnotationQueueItemwriteRemoves a queued trace or observation from a queue.
createAnnotationQueueAssignmentwriteAssigns a project user to an annotation queue so they can work through its review items.
deleteAnnotationQueueAssignmentwriteRemoves a project user's assignment from an annotation queue.
listCommentsreadLists comments in the project, optionally filtered by object or author.
getCommentreadReturns one comment by ID.
createCommentwriteCreates a comment of up to 5,000 characters on a trace, observation, session or prompt, optionally attributed to a given author user ID.
listDatasetsreadLists datasets, the named collections of input and optional expected-output examples used for experiments and evaluations.
getDatasetreadReturns one dataset by ID.
listDatasetItemsreadLists dataset items, optionally filtered by dataset, source trace, source observation or version.
getDatasetItemreadReturns one dataset item with its input and optional expected output.
listDatasetRunsreadLists the dataset runs, each an experiment or evaluation execution over a dataset.
getDatasetRunreadReturns one dataset run and its run items.
listDatasetRunItemsreadLists the run items that link dataset items to traces or observations within a run.
upsertDatasetwriteCreates or updates a dataset with its description, metadata and optional input and expected-output schemas.
upsertDatasetItemwriteCreates or updates one example in a dataset. Item IDs are unique per project across all datasets.
batchUpsertDatasetItemswriteUpserts up to 100 items in one dataset. Items process in order, the operation stops on the first failure, and it is not atomic.
createDatasetRunItemwriteCreates a run item linking one dataset item to a trace or observation within a dataset run.
deleteDatasetItemhigh riskDeletes one example in a dataset along with all of its run items.
deleteDatasetRunhigh riskDeletes a dataset run and enqueues deletion of its run items.
listScoresreadFinds quality, evaluation and feedback scores for traces, observations, sessions and experiments. Reads are eventually consistent, so a newly created score may not appear immediately.
getScorereadReturns one score by ID, with its polymorphic value and the subject it scores.
listScoreConfigsreadLists the score configurations in the project.
getScoreConfigreadReturns one score configuration by ID.
createScorewriteCreates one score against exactly one of a trace, session or dataset run, optionally scoped to an observation.
createScoreConfigwriteCreates a score configuration for numeric, categorical, boolean or text scores. Boolean configs automatically receive True and False categories.
updateScoreConfigwriteUpdates a score configuration's name, description or allowed numeric range and categories.
deleteScoreConfigwriteDeletes a score configuration by archiving it.
listModelsreadLists the custom and Langfuse-managed model definitions visible to the project.
getModelreadReturns a model definition by ID.
createModelwriteCreates a custom model definition for cost tracking and tokenization, with input, output or total prices and optional pricing tiers.
deleteModelwriteDeletes a custom model definition. Built-in models cannot be deleted.
listLlmConnectionsreadLists the LLM connections usable in the current project, including those inherited from the organization.
listManagedEvaluatorTemplatesreadLists the evaluator templates maintained by Langfuse and partners, which can be copied into createEvaluator.
listEvaluatorsreadLists the LLM-as-a-judge, code and decision-model evaluators defined in the project.
getEvaluatorreadReturns one evaluator including its LLM prompt, code or decision-model questions and state mapping, plus how many evaluation rules reference it.
createEvaluatorwriteCreates an evaluator. Code evaluators accept up to 256 KB of Python or TypeScript source that Langfuse then runs.
updateEvaluatorwriteUpdates an evaluator by its stable ID. Definition changes append an immutable version; name and description changes do not.
testEvaluatorhigh riskTests a saved evaluator or an unsaved draft against one observation. It executes the evaluator, emits an internal trace, and may incur model or code execution cost.
deleteEvaluatorhigh riskDeletes an evaluator. This cannot be undone.
listEvaluationRulesreadLists the rules that run evaluators automatically against project traffic.
getEvaluationRulereadReturns one evaluation rule by ID.
updateEvaluationRulewriteUpdates an existing evaluation rule.
detachEvaluatorFromEvaluationRulewriteDetaches an evaluator from a rule, stopping its automatic scoring.
deleteEvaluationRulewriteDeletes an evaluation rule.
createEvaluationRulehigh riskCreates a rule that runs evaluators automatically against incoming traffic, which is a recurring model cost rather than a single call.
attachEvaluatorToEvaluationRulehigh riskAttaches an evaluator to a rule so it begins scoring production traces continuously.
listDashboardWidgetsreadLists the dashboard widgets in the project.
getDashboardWidgetreadReturns one dashboard widget by ID.
listDashboardsreadLists the dashboards in the project.
getDashboardreadReturns one dashboard by ID.
createDashboardWidgetwriteCreates a dashboard widget.
updateDashboardWidgetwriteUpdates an existing dashboard widget.
deleteDashboardWidgetwriteDeletes a dashboard widget.
createDashboardwriteCreates a dashboard.
updateDashboardwriteUpdates an existing dashboard.
deleteDashboardwriteDeletes a dashboard.
addDashboardPlacementwriteAdds a placement positioning a widget on a dashboard.
updateDashboardPlacementwriteUpdates a widget's placement on a dashboard.
deleteDashboardPlacementwriteRemoves a widget's placement from a dashboard.
queryMetricsreadAnswers analytics questions about usage over time, model costs, latency, errors and scores, with breakdowns by environment, trace, observation, model, user, session, tag or score name.
getMetricsSchemareadDiscovers which metrics can be analyzed and how to group, filter, aggregate and time-bucket them before calling queryMetrics.
getMediareadReturns metadata and a signed download URL for one media asset, so the asset itself moves outside the server.
getHealthreadChecks Langfuse API health, optionally verifying database availability and recent ingestion.
getV4MigrationDatareadReturns data relating to the v4 migration.
submitFeedbackwriteSends feedback to Langfuse.
listExperimentsreadLists the experiments in the project.
listExperimentItemsreadLists the items within an experiment.
listAlertsreadLists the project's alerts.
getAlertreadReturns one alert by ID.
listSkillsreadLists and searches project skills with tags and version summaries.
getSkillreadGets a skill's metadata and file paths, without file contents.
loadSkillreadReads a skill's SKILL.md as text.
loadSkillResourcereadReads a skill file as text by path.
searchLangfuseDocsreadRuns a semantic search over the Langfuse documentation and returns a synthesized answer.
getLangfuseDocsPagereadFetches the raw Markdown of a single Langfuse docs page.
getLangfuseOverviewreadGets a high-level, machine-readable index of the Langfuse docs from llms.txt.

What Langfuse MCP exposes

Langfuse MCP groups its 94 tools into 14 categories, each with a suggested starting policy.

All 94 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Datasets	Upserting datasets and their items individually or in batches of up to 100, listing and reading datasets, items, runs and run items, deleting an item with all its run items, deleting a run, and creating run items that link a dataset item to a trace or observation	Read / Write	deleteDatasetItem takes its run items with it and deleteDatasetRun enqueues deletion of everything under the run. batchUpsertDatasetItems is not atomic: it processes in order and stops on the first failure, so a partial batch is a real outcome
Dashboards	Listing, reading, creating, updating and deleting dashboards and dashboard widgets, and adding, updating or deleting the placements that position widgets on a dashboard	Read / Write	Nothing here reaches production behaviour, so this is the safest write surface on the connection. The deletes remove shared views other people rely on, which is an availability concern rather than a data one
Annotation Queues	Listing, creating and reading annotation queues, the worklists that collect traces or observations for human review and scoring, managing the items in them with their pending or completed status, and assigning or unassigning project users to a queue	Read / Write	createAnnotationQueueAssignment puts work in a named person's queue, so an agent here is allocating human effort. Queue items reference real traces, so the queue is a pointer into production data
Scores	Finding and reading quality, evaluation and feedback scores for traces, observations, sessions and experiments, creating a score, and listing, reading, creating, updating and archiving score configurations with their numeric ranges or categories	Read / Write	Score reads are eventually consistent, so a score created here may not appear in a read immediately; an agent that retries on a missing score can double-write. Score configs define what every later score is validated against
Evaluators	Listing Langfuse and partner evaluator templates, listing, reading, creating, updating and deleting project evaluators of LLM-as-a-judge, code and decision-model types, and testing a saved or draft evaluator against one observation	Read / Write	createEvaluator and updateEvaluator accept up to 256 KB of Python or TypeScript that Langfuse runs. testEvaluator executes it against a real observation, emits an internal trace and may incur model or code execution cost. deleteEvaluator cannot be undone
Evaluation Rules	Listing and reading the rules that run evaluators automatically, creating and updating them, attaching an evaluator to a rule or detaching it, and deleting a rule	Read / Write	Creating a rule or attaching an evaluator starts automatic scoring against incoming traffic, which is a recurring model cost rather than a one-off. Detaching or deleting stops evaluation silently, so both directions deserve a log line
Prompts	Fetching a prompt by name with a label or version and with dependencies resolved or left intact, listing and filtering prompts with their versions, labels and tags, creating new text and chat prompt versions, and updating the labels on a version	Read / Write	Prompts are immutable, so content changes create a new version that receives the latest label and cannot be given the production label at creation. updatePromptLabels is the only route to production, and labels are unique across versions, so setting one moves it off whichever version held it
Metrics & Platform	Analytics queries over usage, model cost, latency, errors and scores with grouped breakdowns, the schema of what can be analyzed, metadata and a signed download URL for a media asset, an API health check, v4 migration data and feedback to Langfuse	Read / Write	getMedia returns a signed download URL, so the asset itself moves outside the server and is invisible to anything watching tool calls alone. getMetricsSchema is the prerequisite for a queryMetrics call that validates
Observations	Finding and paging through generations, spans, events, agent steps and tool calls with filters for trace, name, type, level, environment and time, reading one by ID, and discovering which fields and filters are available with their example values	Read	Read-only but this is the production LLM traffic itself. Metadata truncates to 200 characters per key unless expandMetadataKeys is passed, and input, output and metadata projections require a window of at most 14 days
Models	Listing the custom and Langfuse-managed model definitions visible to the project, creating a custom definition for cost tracking and tokenization, reading one by ID and deleting a custom one	Read / Write	Model definitions set the prices used for cost attribution, so changing one rewrites what every later trace appears to have cost. Built-in models cannot be deleted
Experiments & Alerts	Listing experiments and their items, and listing and reading the project's alerts	Read	Entirely read-only. Alerts can be read but not changed through this server, which removes the usual risk of an agent quietly silencing monitoring
Comments	Creating a comment of up to 5,000 characters on a trace, observation, session or prompt, listing comments filtered by object or author, and reading one by ID	Read / Write	createComment accepts an author user ID, so an agent can attribute a comment to a person. Comments sit on production traces where colleagues will read them as human notes
Skills	Listing and searching project skills, reading their metadata, SKILL.md and files	Read	Read-only; safe to allow
Documentation	Searching the Langfuse docs, fetching a docs page and the llms.txt index	Read	Allow documentation searches

Connect Langfuse MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Langfuse
Find Langfuse in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Langfuse MCP or block it. You allow the exact tools each agent can call, one by one.

Langfuse MCP	94 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 94 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Langfuse MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Langfuse MCP94 documented tools on the authenticated, project-scoped Langfuse Cloud MCP server, available for EU, US, Japan, HIPAA US, self-hosted and local deployments. Authentication is HTTP Basic with a base64 public and secret key pair. Langfuse describes the server as self-describing and warns that its tool set and schemas may change, so clients should refresh capabilities rather than assume a static interface. A separate unauthenticated Langfuse Docs MCP server offers four documentation tools.
Coding assistants	Connection & credentialsper user	Datasets13 tools
Internal copilots	Tool access policiesdeny by default	Dashboards13 tools
Workflow automations	Request & response inspectioninline	Annotation Queues10 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools58 tools