Use Axiom with Sazabi: APL queries over MCP and the axiom CLI

Last verified on Nov 8, 2026.

Axiom stores events in datasets and answers questions with APL, its pipe-style query language. Sazabi, the AI-native observability and security platform, gives its agent two ways to reach that data: an MCP connector for queries in a thread, and the axiom command-line tool in its sandbox. You can use either or both.

What each source sends

MCP connector. Axiom's MCP server authenticates with OAuth and dynamic client registration. Once you authorize, the agent can query datasets and logs in APL, search and filter events, analyze traces, errors and structured logs, retrieve dataset schemas and field information, and run aggregations and time-series analysis. Write operations follow the read-only toggle on that connection.

Sandbox CLI. The axiom binary is already in the agent's sandbox image. Connecting it supplies AXIOM_TOKEN and AXIOM_ORG_ID, plus an optional AXIOM_URL for self-hosted or non-default endpoints. Axiom's CLI reference lists axiom query, axiom stream and axiom ingest, which map to the query, stream and ingest workflows Sazabi names. The agent can run them against your organization.

Questions it answers

• What fields does this dataset have, and which ones hold the status code and URI?
• How many 500 responses did each route return, per time bucket, in the last hour?
• Do the error events in Axiom line up with the errors Sazabi already has for the same service?
• What does the live stream for this dataset show right now?
• Which dataset holds traces for the checkout service?

A worked example: counting errors by route

APL queries start with a dataset and add operators separated by the pipe character. Axiom's introduction shows where to filter, summarize to aggregate, and project to keep only the fields you need. Its sample dataset sample-http-logs has the fields _time, method, status, uri and resp_body_size_bytes. You ask the agent in a thread:

In the sample-http-logs dataset, count 500 responses by uri in time
buckets for the last hour and tell me which uri changed first.

The agent can check the schema first, then write something like this:

['sample-http-logs']
| where status == '500'
| summarize count() by bin_auto(_time), uri

Axiom advises filtering early and projecting only what you need, because a dataset can hold hundreds of fields and fetching them all slows the query. If the query returns nothing, the likely cause is the field type, since status may be a number in your dataset, so ask the agent to read the schema again before it retries. Once you see which uri moved first, ask for the same window in Sazabi's own logs to see whether the service wrote an error line at that minute.

For something you would rather run as a one-off command, the agent can use axiom query in the sandbox, which reads the same data with an API token instead of OAuth. Rotate that token in the Sazabi settings if it expires, because the CLI reports an authentication error until you do.

How it fits with other integrations

Axiom is one of several stacks the Sazabi agent can query alongside its own data, next to Honeycomb, SigNoz and Datadog. Browse observability tools for the rest. To send your own services' telemetry to Sazabi, start with OpenTelemetry, or see pricing.