Alibaba Cloud SLS Adds Agent-Native SessionStore, Semantic Layer & MCP Server

Agent-Native Upgrade for SLS

At the 2026 Yunqi Conference, Alibaba Cloud Log Service (SLS) announced a major upgrade to become an intelligent data engine serving both humans and AI agents. The upgrade centers on four core traits: high-efficiency real-time processing, agent data objects, business semantic context, and agent-native interfaces. SLS continues to strengthen its real-time data foundation covering ingestion, unified storage and indexing, real-time analysis and computation, and real-time processing — delivering real-time, unified, correlatable, and verifiable data. This foundation now uniformly carries traditional observability data (logs, metrics, traces, events), agent runtime data (messages, tool calls, steps), and business data (users, orders, assets).

SLS SessionStore: Organizing Agent Runtime Data into Reusable Session Assets

As agents enter production systems, the relationship between applications and data changes. Traditional apps serve human users via consoles or APIs with predictable flows; agents continuously read data and invoke tools, producing multi-step decision trajectories. Data shape expands from single log lines to sessions and trajectories spanning multiple rounds, models, and tools. Understanding depth shifts from technical events (fields, status codes) to business objects, relationships, rules, task goals, process states, and judgment evidence.

Previously, agent reasoning, model calls, and tool calls were scattered across traces and logs with inconsistent fields and unpaired events, making full task reconstruction difficult. The new SLS SessionStore organizes agent data at the session level. Raw process data enters SessionStore, where the system automatically normalizes fields, pairs events, and reconstructs task processes into reusable session fact assets.

Data organization layers:

Raw fact layer — supports Managed direct write and Ref association with existing Logstores (no migration needed).

Normalization layer — Schema Profiler and Mapping Profile handle field normalization, event pairing, and task reconstruction.

Semantic views — outputs three views: Trajectory view (messages, models, tools, steps), Session view (multi-turn interactions and task results), and Feature view (cost, efficiency, tool and resource characteristics).

SessionStore ingests OTel Trace, OTel Log, and LLM Gateway Log, automatically mapping, pairing, and sorting fields. SQL can query Session, Trajectory, and Raw data for observability, audit, annotation, and evaluation. Compared to self-built session processing from raw traces, SessionStore offers zero modification, automatic field normalization and event pairing, and one-time organization supporting multiple downstream views (troubleshooting, evaluation, cost analysis).

Key outcome: Every agent run is restored as a reviewable, evaluable, reusable data asset, providing ready-to-consume input for downstream observability, quality assessment, and continuous optimization without re-stitching tasks from raw traces each time.

SLS Semantic Layer: Enabling Agents to Understand Business Meaning

Even with organized data, general agents cannot interpret what fields mean in a specific business, which metric definition to use, or where anomaly thresholds lie — leading to inconsistent answers. The new SLS Semantic Layer bridges this gap by automatically extracting fact models from runtime data, organizing unified semantics by business domain, and forming a complete path from SLS data assets → fact models → business models → accurate agent answers.

Four-step path:

Runtime fact entry — auto-discovers fields, metrics, and terms from SLS data assets (index configs, dashboards, alerts, Scheduled SQL).

Fact model — LLM automatically extracts every Logstore's schema (field definitions), metrics (calculation definitions), and terms (business terminology).

Business model (Context Model) — selects Logstores by business domain, inherits fact semantics, and adds scenario-specific business context, unifying cross-project business definitions.

Agent integration — SLS DataAgent works out of the box; enterprise agents connect via APIs; Copilots and tools consume via tool calls.

Advantages: automatic and reusable. Fact models are LLM-extracted from real runtime data (no manual per-field definition). Business models inherit fact semantics and add scenario context — one model serves multiple agents.

Result: Enterprises no longer maintain separate business definitions per agent; the same question yields consistent, explainable, traceable answers across DataAgent, custom agents, and third-party tools.

SLS DataAgent: Natural Language to Verifiable Business Conclusions

Built on the semantic layer, SLS DataAgent is a conversational data query and analysis capability for business users. It runs on SLS real-time operational data, backed by ContextModel, within enterprise governance, converting natural language questions into query plans, analysis results, and verifiable conclusions.

Differentiation — data-native: General agents have strong reasoning but lack context about field meanings, metric definitions, service-resource-business relationships, and anomaly thresholds. DataAgent grows where data originates, turning continuously changing operational data into understandable, trustworthy real-time context.

Game customer-service example: Player asks "Why didn't my recharge arrive?"

Raw log query: Agent sees fragmented fields: pay_status=success, deliver_status=failed, error_code=BAG_FULL, item_id=WPN_LEG_001. Cross-Logstore correlation is complex, business definitions inconsistent → vague answer: "possibly delivery failure, cause and retry uncertain."

DataAgent via semantic layer: Semantic layer translates BAG_FULL → "bag full", WPN_LEG_001 → "Sky-Rending Blade". Conclusion with evidence: payment succeeded; delivery failed due to full bag; cleanup bag then retry per rules.

Three-layer capability structure:

Perception base — rooted in SLS real-time operational data (logs, metrics, traces, events, alerts, resource states).

Understanding hub — bound to ContextModel, understands entities, metric definitions, relationships, anomalies, and verified analysis paths.

Action runtime — executes tasks within governance: multi-source triggers, dynamic context assembly, tool calls, tiered audit. Three action levels: (1) analysis and suggestions only, (2) execute after human confirmation, (3) auto-execute under explicit rules and permissions.

ContextModel is not static; user confirmations, corrections, new queries, and handling experiences flow into Context Evidence, validated and governed, then incrementally update the model — making DataAgent more accurate over time. In business scenarios, a ContextModel-bound DataAgent continuously outputs business progress, trend explanations, opportunities, and risk alerts, reusable by marketing agents, operations Copilots, and business workflows.

Ecosystem Collaboration: AgentLoop & STAROps Built on SLS

AgentLoop builds an enterprise agent quality evaluation and tuning loop on SLS. It collects agent runtime logs and traces via probes or OpenTelemetry; SLS handles real-time storage, data processing, and query analysis; SessionStore organizes sessions and reasoning trajectories; continuously accumulates reusable runtime data assets; forms a closed loop of observation, evaluation, experimentation, and continuous optimization — covering coding, operations, customer service, gaming, and other agentic applications.

STAROps builds a full-domain intelligent operations loop on SLS. SLS provides real-time operational data and query analysis, unifying logs, traces, events, and changes with real-time storage, processing, and retrieval. UModel organizes entities, relationship topology, and data associations on top, providing traceable context for reasoning, diagnosis, and recovery verification — supporting natural language queries, alert root-cause analysis, change impact analysis, and cross-product fault localization.

Shared foundation value: Both AgentLoop and STAROps leverage SLS's ready-made real-time data and query analysis capabilities, avoiding duplicate data pipeline construction and focusing effort on evaluation and operations logic.

SLS MCP Server & Skills System: Standard Protocol Access for Agents

Previously, agents calling SLS had to wrap OpenAPIs, manage AccessKeys, handle regions and permissions — high integration barrier and key leakage risk. The new SLS MCP Server lets agents use SLS securely via standard protocol with OAuth passwordless authentication.

Runs a local proxy with OAuth login; uses OAuth credentials to call SLS OpenAPI on behalf of the agent.

RAM controls permissions; no AccessKey entry; sensitive configs auto-desensitized; auto-matches region, no region restrictions.

Provides three standard capability groups: resource discovery, log analysis, alert diagnosis.

Advantages over self-wrapped OpenAPI: security (OAuth proxy, RAM auth, desensitization) and zero modification — any MCP-supporting agent connects via standard protocol without managing keys or adapting integration logic.

On top of MCP, SLS releases an orchestration Skills system . A single orchestration skill ( alibabacloud-sls-agent-workflow) acts as entry point, handling intent recognition, flow orchestration, security gates, and evidence collection, chaining multiple professional skills for domain-specific execution: LoongCollector collection ops, index config management, query analysis, intelligent analysis, and SDK guidance. Instead of agents exploring each operation ad-hoc, the Skills system codifies expert experience into orchestratable standard flows. Users describe goals in natural language; the orchestration skill continuously decomposes tasks; professional skills execute per domain and return status, evidence, and resource results — turning user goals into executable, confirmable, verifiable complete tasks.

Conclusion

From a continuously upgraded real-time data foundation to the newly released agent-native capabilities, SLS completes a key upgrade for the agent era. On one side, SessionStore makes agent runtime data organizable and reconstructable; the semantic layer makes data facts business-understandable; DataAgent lets business users reach verifiable conclusions via natural language. On the other side, MCP Server and the Skills system let agents call SLS securely through standard protocols. AgentLoop and STAROps exemplify intelligent applications built on the same foundation. When every piece of runtime data has an agent that understands it, enterprises gain a real-time, unified, correlatable, verifiable foundation for building AI-native data platforms.