Can Claude Code read my production logs?

Why it cannot see them by default

Claude Code runs on your laptop or on a CI box. Your production logs sit on another machine or with your hosting provider. Reading files in your working directory needs no approval, and in the default Manual mode a shell command asks first, apart from a built-in set of read-only commands.

Commands it runs use the credentials your shell already has. If your terminal is signed in to production, Claude Code can reach production as soon as you approve the command, so the approval is the control.

The three routes compared

If you use a shell command, allow only that command

Put permission rules in .claude/settings.json so one log command runs without a prompt and the rest still ask. Replace yourhost with the command you use:

{
  "permissions": {
    "allow": ["Bash(yourhost logs *)"],
    "deny": ["Bash(ssh *)"]
  }
}

• Deny rules win: an allow rule cannot carve an exception out of a matching deny rule.
• Claude Code understands shell operators, so that allow rule does not approve yourhost logs api && some-other-command. Every part has to be allowed.
• Be careful with allow rules on ssh. An ssh command runs whatever follows it on the server, so one broad rule hands over the box.
• Use a read-only credential scoped to logs where your provider offers one.

What logs leave out

• Grouping. One failure repeated thousands of times is thousands of lines, and the agent reads them a window at a time.
• Anything your code did not write. A log line has no breadcrumbs unless you logged them, and often no stack trace.
• State. Nothing records that a failure was fixed, so nothing tells the agent it came back.
• A filter on what reaches the model. Personal data and tokens in a log line go into the session with everything else.

Give it the errors without log access

Runheed does not read log files. Your app reports each exception through the Node.js or Python SDK, and Claude Code reads it over MCP. Add it with one command, then run /mcp and choose Authenticate:

claude mcp add --transport http runheed https://runheed.com/api/mcp

Then ask "what broke in production since the last deploy?" Nobody has to notice the error, find it and paste it in. Python logging calls and Node console.error calls are kept as breadcrumbs with the next error, and secret headers are redacted on arrival. Setup for each stack is under setup by framework.