Agent Plugins Marketplace
← All plugins

sherlock-holmes

v0.4.0

Evidence-first incident investigation by trace ID using Grafana Loki logs and Grafana Tempo traces. Read-only: it reconstructs the timeline, finds the first anomalous event, separates cause from consequence and states its confidence and gaps.

Claude Code4 Skills

By WhitebeardLicense: MIT8 GitHub starsUpdated 1 hour ago

Directory evidence

Runtimes
Claude Code
Parsed components
4 skill or MCP entries
Source updated
Sep 27, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install sherlock-holmes for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install sherlock-holmes@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/whitebeardit/claude-plugins

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is sherlock-holmes/.

Plugin files

sherlock-holmes/
├── .claude-plugin/plugin.json
├── skills/error-sweep/SKILL.md
├── skills/setup/SKILL.md
├── skills/trace-debug/SKILL.md
└── skills/trace-diagram/SKILL.md

Included Skills4

error-sweepskills/error-sweep/SKILL.md

List the errors of a time window - without a trace id - as a fixed, numbered table of facts from Grafana Tempo (spans with error status) and Grafana Loki (error lines grouped by a masked message signature), then let the user choose what to see - the sequence diagram of an example trace, or a full investigation with trace-debug. Use when the user asks whether there were errors in a period ("any errors in the last 2 hours?", "what failed in payment-service yesterday afternoon?", "sweep the logs for errors"). Deterministic - no model judges severity or cause. Read-only. The table is the answer - show it to the user exactly as printed, in full, without summarizing, reordering or commenting on it.

setupskills/setup/SKILL.md

Guided first-run setup for Sherlock Holmes, in one conversation - checks Grafana access with the doctor, discovers the Loki and Tempo datasource UIDs, proposes the Loki stream selector from the labels your Loki really has, hands over the exact /config values, optionally installs archify for the trace diagram, and verifies the result. Use right after installing the plugin, whenever the doctor reports a configuration problem, or when the user asks how to configure or set up Sherlock Holmes. Changes nothing in production.

trace-debugskills/trace-debug/SKILL.md

Investigate a production incident from a trace ID using Grafana Loki logs and Grafana Tempo traces. Use whenever the user provides a trace id or W3C traceparent and wants to know why a request failed, hung, was slow or misbehaved. Evidence-first - timeline, first anomalous event, causal chain, confidence, gaps. Optionally renders the span tree as an interactive sequence diagram (archify), evidence only. Read-only. The skill returns a finished report; present it to the user exactly as returned, in full, without summarizing or reformatting it.

trace-diagramskills/trace-diagram/SKILL.md

Draw a trace as an interactive, self-contained sequence diagram (archify) from its Grafana Tempo spans, without investigating it. Use when the user wants to see, share or export the call sequence of a trace id - who called whom, where the time went, which span failed first - and does not ask why it failed. Evidence only. Read-only.

Plugin manifests1

sherlock-holmes/.claude-plugin/plugin.json
{
  "name": "sherlock-holmes",
  "displayName": "Sherlock Holmes",
  "version": "0.4.0",
  "description": "Evidence-first incident investigation by trace ID using Grafana Loki logs and Grafana Tempo traces. Read-only: it reconstructs the timeline, finds the first anomalous event, separates cause from consequence and states its confidence and gaps.",
  "author": {
    "name": "Whitebeard",
    "email": "[email protected]"
  },
  "homepage": "https://github.com/whitebeardit/claude-plugins/tree/main/sherlock-holmes",
  "repository": "https://github.com/whitebeardit/claude-plugins",
  "license": "MIT",
  "keywords": [
    "observability",
    "loki",
    "tempo",
    "grafana",
    "incident",
    "trace",
    "debugging",
    "sre"
  ],
  "userConfig": {
    "grafana_url": {
      "type": "string",
      "title": "Grafana URL",
      "description": "Your Grafana, e.g. https://your-stack.grafana.net. Leave blank if you reach Loki and Tempo directly instead, via the LOKI_URL and TEMPO_URL environment variables."
    },
    "grafana_loki_uid": {
      "type": "string",
      "title": "Loki datasource UID",
      "description": "UID of the Loki datasource in that Grafana. Don't know it? Leave this blank, finish the install, then ask Claude to run the trace-debug doctor: it lists every Loki and Tempo datasource with its UID."
    },
    "grafana_tempo_uid": {
      "type": "string",
      "title": "Tempo datasource UID",
      "description": "UID of the Tempo datasource. The doctor lists this one too."
    },
    "loki_selector": {
      "type": "string",
      "title": "Loki stream selector",
      "description": "Which streams to search, e.g. {namespace=\"prod\"}. Use labels your own Loki has; the doctor reports a sample of them. Never left as {} - the collector refuses to scan every stream."
    },
    "loki_trace_filter": {
      "type": "string",
      "title": "How logs carry the trace id",
      "description": "One of: substring (searches the raw line, works with any format), metadata (Loki 3 structured metadata), json (parses JSON logs first).",
      "default": "substring"
    },
    "loki_trace_field": {
      "type": "string",
      "title": "Trace id field name",
      "description": "Only used by the metadata and json modes. Common values: trace_id, traceId, traceID.",
      "default": "trace_id"
    }
  }
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[sherlock-holmes on Agent Plugins Marketplace](https://pluginsmp.com/plugins/sherlock-holmes)