diff --git a/internal/monitoring/handlers.go b/internal/monitoring/handlers.go
index e50e8db..21bc207 100644
--- a/internal/monitoring/handlers.go
+++ b/internal/monitoring/handlers.go
@@ -589,9 +589,15 @@ func makeQueryLogsHandler(loki *LokiClient) mcp.ToolHandler {
 		if l, ok := args["limit"].(float64); ok && l > 0 {
 			limit = int(l)
 		}
+		if limit > 5000 {
+			limit = 5000
+		}
 
 		direction := "backward"
 		if d, ok := args["direction"].(string); ok && d != "" {
+			if d != "backward" && d != "forward" {
+				return mcp.ErrorContent(fmt.Errorf("direction must be 'backward' or 'forward'")), nil
+			}
 			direction = d
 		}