← Back to directory
G

Grafana MCP Server

Official
Query and manage Grafana dashboards, alerts, and observability data via MCP
Category
Other #6 of 230
Stars
★ 3.6k Very popular
Transport
stdio (local process) · SSE · Streamable HTTP
Runtime
Hosted (no local runtime) · Prebuilt binary · Docker · Python 3.10+
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
92
72FMRS · B

mcp-grafana is officially maintained by Grafana Labs and offers broad coverage of the Grafana ecosystem — dashboards, alerting, many datasource types, incident management, OnCall, annotations, snapshots, and rendering — with fine-grained per-category tool toggles and a read-only mode. The main risks center on credential handling and scoping write access appropriately: configure least-privilege RBAC for the service account, avoid enabling write tools unless needed, and selectively enable only the datasource/tool categories actually in use to limit context usage and attack surface.

Strongest · Documentation 18/20 Weakest · Reliability 11/20

Reliability
11/20
Security and permissions
14/20
Maintenance
16/20
Documentation
18/20
Setup experience
13/20
Why each score
Reliability 11/20
The README shows Unit/Integration/E2E GitHub Actions badges, indicating a CI pipeline is configured, and the server.json tool declarations broadly line up with the README's feature list and tool table across many subsystems (Prometheus, Loki, CloudWatch, Snowflake, etc.). However, this review only has access to the README and manifest text, not the actual workflow files or test contents, so the correspondence between declared tool behavior and real implementation, plus error-handling/diagnosability under failure, cannot be verified. Per the static calibration rule, without directly verifiable execution evidence the score cannot exceed 12.
Security and permissions 14/20
Credential handling is reasonably sound: the service account token and password fields are marked secret, and a token-file option is supported (enabling rotation without embedding secrets in env vars); no real secrets appear in examples. Documentation of fine-grained RBAC permissions/scopes, a `--disable-write` read-only mode, and Host/Origin validation for SSE/streamable-http (anti DNS-rebinding) show meaningful least-privilege and boundary controls. Deductions: the default-enabled tool set includes several side-effecting write operations (dashboard updates, annotation writes, alert-rule create/update/delete) that execute without an additional confirmation step by default, relying on the operator to pass `--disable-write` or scope the service account tightly; GRAFANA_EXTRA_HEADERS/GRAFANA_FORWARD_HEADERS allow forwarding arbitrary headers (e.g. cookies), which is documented but still a residual risk. No red-line issues were found (no malware, no forced irreversible actions, no fabricated identity or test results).
Maintenance 16/20
The repository belongs to the official Grafana GitHub org, uses the Apache-2.0 license, is not archived, and shows meaningful community engagement (134 open issues). The manifest's `$VERSION` placeholder implies a structured release process, and the README documents the deprecation/migration path for `GRAFANA_API_KEY`, showing governance discipline. CI badges (unit/integration/e2e) indicate an ongoing testing practice. Full marks are withheld absent direct access to commit history or release records as independent evidence.
Documentation 18/20
Documentation is extensive: quick start, multiple install paths (uvx, Docker, binary, Helm), feature descriptions organized by category, detailed RBAC permission/scope tables, a full CLI flag reference, read-only mode explanation, TLS configuration, multi-org support, custom header forwarding, and token-file rotation are all covered with layered detail and ample examples. Minor deduction: there is no dedicated troubleshooting section, and cost/rate-limit implications of various queries are not explicitly discussed.
Setup experience 13/20
Multiple installation paths are offered (a one-line uvx command, Docker OCI image, binary, Helm chart, and a hosted streamable-http remote endpoint), with configuration examples for mainstream clients (Claude Desktop/Cursor); the manifest structure (packages/remotes/environmentVariables) is complete and well-formed. Since this review is purely static, it cannot confirm the installation steps actually succeed or that dependencies resolve cleanly, so per the calibration rule the setup score cannot exceed 15.

Static review · not runListed 2026-08-06

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account dataConnects to a database

Best for

  • Teams running a Grafana instance (self-hosted or Grafana Cloud) who want an AI assistant to help with observability workflows
  • DevOps/SRE engineers who want to automate querying alerts, logs, and metrics as part of incident response
  • Scenarios where monitoring data access needs to be exposed to an AI assistant safely in read-only mode

Not for

  • Teams with no Grafana ecosystem in place (no Prometheus/Loki/etc. datasources configured)
  • Fully offline or network-isolated environments (the remote endpoint and most datasource queries require network access)
  • Situations where write access must be tightly scoped but the team is unwilling to configure fine-grained RBAC (the built-in Editor role, while convenient, is broad)

Required permissions

  • GRAFANA_URL (required): the target Grafana instance address
  • GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_USERNAME/GRAFANA_PASSWORD: authentication credentials (the service account token is sensitive)
  • Grafana RBAC permissions matching the enabled tool categories, e.g. dashboards:read/write, datasources:query, alert.rules:read/write, annotations:read/write, or the built-in Editor role as a simpler but broader alternative
  • Grafana Incident and Sift tools use basic roles (Viewer for reads, Editor for writes) rather than fine-grained RBAC
  • Optional GRAFANA_ORG_ID or X-Grafana-Org-Id header for multi-organization support
  • Optional GRAFANA_EXTRA_HEADERS and GRAFANA_FORWARD_HEADERS to add or forward HTTP headers (e.g. Cookie) to the Grafana API

Risks and side effects

  • Service account tokens, passwords, and other credentials are supplied via environment variables or headers and must be safeguarded from leakage
  • Write tools (update_dashboard, alerting_manage_rules, create_incident, create_annotation, create_snapshot, etc.) can directly modify or delete dashboards, alert rules, and incident data — misuse can damage production configuration
  • Using the built-in Editor role for convenience grants broad access beyond least-privilege
  • Fetching full dashboard JSON (get_dashboard_by_uid, update_dashboard) can consume significant context window space and may expose sensitive queries or variables embedded in the dashboard
  • GRAFANA_FORWARD_HEADERS forwarding of headers like Cookie, if misconfigured, risks leaking session information
  • The hosted remote endpoint https://mcp.grafana.com/mcp is a third-party managed service — using it to reach a Grafana Cloud instance routes requests through that service
  • SSE/streamable-http transport misconfiguration (e.g. --allowed-hosts or --allowed-origins set to * while exposed on an untrusted network) carries DNS-rebinding-style risk

Setup

Before you start

Runtime:Hosted (no local runtime) · Prebuilt binary · Docker · Python 3.10+

GRAFANA_URL required URL of your Grafana instance, e.g. http://localhost:3000 or https://<instance>.grafana.net
GRAFANA_SERVICE_ACCOUNT_TOKEN optionalsecret Service account token created in Grafana under Service accounts administration
GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE optionalsecret Path to a file holding the token, re-read on every request to support rotation in Kubernetes
GRAFANA_PASSWORD optionalsecret Grafana password for basic auth
GRAFANA_API_KEY optionalsecret Deprecated legacy API key variable; migrate to GRAFANA_SERVICE_ACCOUNT_TOKEN
Other optional settings (4)
GRAFANA_USERNAME optional Grafana username for basic auth
GRAFANA_ORG_ID optional Numeric organization ID for multi-org support
GRAFANA_EXTRA_HEADERS optional JSON object of extra HTTP headers sent with all Grafana API requests
GRAFANA_FORWARD_HEADERS optional Comma-separated HTTP header names forwarded from the incoming request to Grafana in SSE/streamable-http mode
  1. Install uv (which provides the uvx command).
  2. In Grafana, create a service account and generate a token (or use the built-in Editor role for convenience, or configure minimal RBAC scopes for least-privilege access).
  3. Add an mcpServers entry to your MCP client config (e.g. Claude Desktop, Cursor) with command 'uvx', args ['mcp-grafana'], and env vars GRAFANA_URL and GRAFANA_SERVICE_ACCOUNT_TOKEN (Grafana Cloud users replace GRAFANA_URL with their instance URL, e.g. https://<instance>.grafana.net).
  4. Alternatively run the Docker image docker.io/grafana/mcp-grafana over stdio, or connect directly to the hosted remote endpoint https://mcp.grafana.com/mcp (streamable-http, with an optional X-Grafana-URL header to target a Grafana Cloud instance).
  5. Use --enabled-tools or --disable-<category> flags to control which tool categories are exposed, and --disable-write to run in read-only mode.
claude_desktop_config.json
{"mcpServers":{"grafana":{"command":"uvx","args":["mcp-grafana"],"env":{"GRAFANA_URL":"http://localhost:3000","GRAFANA_SERVICE_ACCOUNT_TOKEN":"<your service account token>"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "grafana": {
      "command": "uvx",
      "args": [
        "mcp-grafana"
      ],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add grafana -e GRAFANA_URL=http://localhost:3000 -e 'GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token>' -- uvx mcp-grafana

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After connecting, the client's tool list should include tools like search_dashboards and list_datasources from the grafana server; running a query_prometheus call that returns data confirms the connection works.

Troubleshooting

  1. Verify GRAFANA_URL is correctly formatted and reachable; Grafana Cloud users should use https://<instance>.grafana.net
  2. If a tool call returns a permission error, check that the service account token's RBAC permissions and scopes cover the operation, or temporarily test with the Editor role to isolate a permissions issue
  3. For datasource-related failures, confirm the Grafana instance is version 9.0 or later
  4. If an expected tool is missing, check whether its category is disabled by default (e.g. admin, clickhouse, cloudwatch, snowflake) and add it via --enabled-tools
  5. A 403 on SSE/streamable-http requests usually means the Host or Origin header isn't covered by --allowed-hosts / --allowed-origins
  6. Use the --debug flag to enable detailed HTTP request/response logging when diagnosing connectivity issues
  7. If token rotation isn't taking effect in Kubernetes, confirm GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE (not an inline token) is used and that the mounted Secret has actually updated
  8. If get_panel_image fails, confirm the Grafana Image Renderer service is installed and configured on the target instance

Things to try

Once connected, you can ask your AI assistant things like:

  • Search my Grafana instance for dashboards mentioning CPU and give me a summary
  • Query Prometheus for the per-minute request rate over the last hour
  • List all unresolved incidents in Grafana Incident
  • Render panel 5 of dashboard uid abc123 as a PNG image

Tools 92

list_teams read-only
List all teams
list_users_by_org read-only
List all users in an organization
list_all_roles read-only
List all Grafana roles
get_role_details read-only
Get details for a Grafana role
get_role_assignments read-only
List assignments for a role
list_user_roles read-only
List roles assigned to users
list_team_roles read-only
List roles assigned to teams
get_resource_permissions read-only
List permissions defined for a resource (dashboard, datasource, folder, etc.)
Show 84 more tools
get_resource_description read-only
Describe available permissions and assignment capabilities for a resource type
search_dashboards read-only
Search for dashboards by title or other metadata
get_dashboard_by_uid read-only
Retrieve full dashboard details using its unique identifier
update_dashboard writes
Update an existing dashboard or create a new one
get_dashboard_panel_queries read-only
Get panel title, query, and datasource UID/type from every panel in a dashboard
run_panel_query read-only
Execute one or more dashboard panel queries with custom time ranges and variable overrides (disabled by default)
get_dashboard_property read-only
Extract specific parts of a dashboard using JSONPath expressions
get_dashboard_summary read-only
Get a compact overview of a dashboard without the full JSON
list_datasources read-only
List configured datasources
get_datasource read-only
Get a datasource by UID or name
get_query_examples read-only
Get example queries for a datasource type (disabled by default)
query_prometheus read-only
Execute an instant or range PromQL query against a Prometheus datasource
list_prometheus_metric_metadata read-only
List metric metadata
list_prometheus_metric_names read-only
List available metric names
list_prometheus_label_names read-only
List label names matching a selector
list_prometheus_label_values read-only
List values for a specific label
query_prometheus_histogram read-only
Calculate histogram percentile values (p50, p90, p95, p99)
list_incidents read-only
List incidents in Grafana Incident
create_incident writes
Create an incident in Grafana Incident
add_activity_to_incident writes
Add an activity item to an incident
get_incident read-only
Get a single incident by ID
query_loki_logs read-only
Run log or metric queries using LogQL against Loki
list_loki_label_names read-only
List all available label names in logs
list_loki_label_values read-only
List values for a specific log label
query_loki_stats read-only
Get statistics about log streams
query_loki_patterns read-only
Query detected log patterns to identify common structures and anomalies
analyze_loki_labels read-only
Audit a Loki label strategy (live or static) and optionally diagnose query performance
suggest_loki_alloy_label_config read-only
Generate an Alloy loki.process snippet enforcing approved labels
query_influxdb read-only
Query InfluxDB using InfluxQL (v1) or Flux (v2) (disabled by default)
list_clickhouse_tables read-only
List tables in a ClickHouse database with row counts and sizes (disabled by default)
describe_clickhouse_table read-only
Get column names, types, and metadata for a ClickHouse table (disabled by default)
query_clickhouse read-only
Execute SQL queries with Grafana macro and variable substitution (disabled by default)
list_cloudwatch_namespaces read-only
Discover available AWS CloudWatch namespaces (disabled by default)
list_cloudwatch_metrics read-only
List metrics available in a namespace (disabled by default)
list_cloudwatch_dimensions read-only
Get dimensions for filtering metric queries (disabled by default)
query_cloudwatch read-only
Execute CloudWatch metric queries with time range support (disabled by default)
list_athena_catalogs read-only
Discover available Athena data catalogs (disabled by default)
list_athena_databases read-only
List databases in an Athena catalog (disabled by default)
list_athena_tables read-only
List tables in an Athena database (disabled by default)
describe_athena_table read-only
Get column names for an Athena table (disabled by default)
query_athena read-only
Execute SQL queries against Athena with macro substitution and limit enforcement (disabled by default)
query_elasticsearch read-only
Query Elasticsearch or OpenSearch using Lucene syntax or Query DSL (disabled by default)
query_quickwit read-only
Query Quickwit using Lucene syntax or Elasticsearch-compatible Query DSL (disabled by default)
list_snowflake_tables read-only
Discover Snowflake tables via INFORMATION_SCHEMA.TABLES, with optional database/schema filters (disabled by default)
describe_snowflake_table read-only
Get column names, types, nullability, defaults, and comments for a Snowflake table (disabled by default)
query_snowflake read-only
Execute SQL queries against Snowflake with macro and template variable substitution (disabled by default)
alerting_manage_rules writes
Manage alert rules (list, get, versions, create, update, delete)
alerting_manage_routing read-only
Manage notification policies, contact points, and time intervals
list_oncall_schedules read-only
List schedules from Grafana OnCall
get_oncall_shift read-only
Get details for a specific OnCall shift
get_current_oncall_users read-only
Get users currently on-call for a schedule
list_oncall_teams read-only
List teams from Grafana OnCall
list_oncall_users read-only
List users from Grafana OnCall
list_alert_groups read-only
List and filter alert groups from Grafana OnCall
get_alert_group read-only
Get a specific alert group from Grafana OnCall by its ID
get_sift_investigation read-only
Retrieve an existing Sift investigation by its UUID
get_sift_analysis read-only
Retrieve a specific analysis from a Sift investigation
list_sift_investigations read-only
Retrieve a list of Sift investigations with an optional limit
find_error_pattern_logs writes
Detect elevated error patterns in Loki logs using Sift
find_slow_requests writes
Detect slow requests using Sift (Tempo)
list_pyroscope_label_names read-only
List label names matching a selector
list_pyroscope_label_values read-only
List label values matching a selector for a label name
list_pyroscope_profile_types read-only
List available profile types
query_pyroscope read-only
Query profiles, metrics, or both from Pyroscope
get_assertions read-only
Get assertion summary for a given entity
agento11y_manage_conversations read-only
List, search, and fetch LLM conversations from Grafana Agent Observability
agento11y_manage_generations read-only
Fetch a single LLM generation and its evaluation scores
agento11y_manage_agents read-only
Read the agent catalog: list agents, fetch a full agent version, view version history, and compare per-version score aggregates
agento11y_manage_evaluators writes
Manage evaluators, evaluator templates, and the judge catalog (list, get, upsert, fork, test, delete)
agento11y_manage_eval_rules writes
Manage eval rules that bind evaluators to production traffic, and inline guards (list, get, create, update, preview, delete)
agento11y_manage_eval_collections writes
Manage saved conversations and the collections that group them
ask_assistant writes
Send a natural-language prompt to Grafana Assistant and wait for the full text reply, with multi-turn support via contextId
generate_deeplink read-only
Generate accurate deeplink URLs for Grafana dashboards, panels, and Explore views
get_annotations read-only
Query annotations with filters (time range, dashboard UID, tags, match mode)
create_annotation writes
Create a new annotation, standard or Graphite format
update_annotation writes
Update specific fields of an existing annotation (partial update)
get_annotation_tags read-only
List available annotation tags with optional filtering
list_snapshots read-only
List dashboard snapshots with optional query and limit filters
get_snapshot read-only
Retrieve snapshot metadata and dashboard payload by snapshot key
create_snapshot writes
Create a dashboard snapshot from a full dashboard payload
delete_snapshot destructive
Delete a snapshot by snapshot key
get_panel_image read-only
Render a stored dashboard/panel, or a provisioning preview from a repository branch, as a PNG image
list_provisioning_repositories read-only
List provisioning repositories (e.g. git-sync sources) with source URL, branch, sync state, and health
validate_provisioning_file read-only
Dry-run-apply a file from a provisioning repository and report admission validation errors

Use cases

AI-assisted incident triage: query Prometheus/Loki metrics and logs, run Sift root-cause analysis, and create a Grafana Incident
Natural-language dashboard discovery and lightweight editing without manually hunting through the Grafana UI
Unified querying and exploration across many datasource types (Prometheus, Loki, ClickHouse, CloudWatch, Athena, Snowflake, and more)
Automatically generating deeplinks to specific dashboards, panels, or Explore views for reports and tickets

Supported clients

Claude Desktop
Cursor

Listed from the project's documentation, not tested by this site.

Overview

mcp-grafana is the official Model Context Protocol server maintained by Grafana Labs, giving AI assistants access to a Grafana instance and its surrounding ecosystem. It covers dashboard search and editing, querying across many datasource types (Prometheus, Loki, InfluxDB, ClickHouse, CloudWatch, Elasticsearch/OpenSearch, Athena, Snowflake, Graphite, Quickwit, Pyroscope), alert rule and notification routing management, Grafana Incident management, Sift root-cause investigations, OnCall scheduling, annotations, snapshots, panel/dashboard image rendering, Agent Observability, Grafana Assistant, and provisioning-repository validation. Tools are grouped into categories that can be enabled or disabled via CLI flags, and the server can run in read-only mode with --disable-write.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 672 · Tools 11 Compare with this →

Source revision a57860b54b4e Data synced 2026-11-04 Read the FMRS scoring method