Grafana MCP Server

Grafana MCP server

A [Model Context Protocol][mcp] (MCP) server for Grafana.

This provides access to your Grafana instance and the surrounding ecosystem.

Quick Start

Requires uv. Add the following to your MCP client configuration (e.g. Claude Desktop, Cursor):

{
  "mcpServers": {
    "grafana": {
      "command": "uvx",
      "args": ["mcp-grafana"],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

For Grafana Cloud, replace GRAFANA_URL with your instance URL (e.g. https://myinstance.grafana.net). See Usage for more installation options including Docker, binary, and Helm.

Requirements

• Grafana version 9.0 or later is required for full functionality. Some features, particularly datasource-related operations, may not work correctly with earlier versions due to missing API endpoints.

Features

The following features are currently available in MCP server. This list is for informational purposes only and does not represent a roadmap or commitment to future features.

Dashboards

• Search for dashboards: Find dashboards by title or other metadata
• Get dashboard by UID: Retrieve full dashboard details using its unique identifier. Warning: Large dashboards can consume significant context window space.
• Get dashboard summary: Get a compact overview of a dashboard including title, panel count, panel types, variables, and metadata without the full JSON to minimize context window usage
• Get dashboard property: Extract specific parts of a dashboard using JSONPath expressions (e.g., $.title, $.panels[*].title) to fetch only needed data and reduce context window consumption
• Update or create a dashboard: Modify existing dashboards or create new ones. Warning: Requires full dashboard JSON which can consume large amounts of context window space.
• Patch dashboard: Apply specific changes to a dashboard without requiring the full JSON, significantly reducing context window usage for targeted modifications
• Get panel queries and datasource info: Get the title, query string, and datasource information (including UID and type, if available) from every panel in a dashboard

Run Panel Query

Note: Run panel query tools are disabled by default. To enable them, add runpanelquery to your --enabled-tools flag.

• Run panel query: Execute a dashboard panel's query with custom time ranges and variable overrides.

Context Window Management

The dashboard tools now include several strategies to manage context window usage effectively (issue #101):

• Use get_dashboard_summary for dashboard overview and planning modifications
• Use get_dashboard_property with JSONPath when you only need specific dashboard parts
• Avoid get_dashboard_by_uid unless you specifically need the complete dashboard JSON

Datasources

• List and fetch datasource information: View all configured datasources and retrieve detailed information about each.
  • Supported datasource types: Prometheus, Loki, ClickHouse, CloudWatch, Elasticsearch, OpenSearch, Snowflake.

Query Examples

Note: Query examples tools are disabled by default. To enable them, add examples to your --enabled-tools flag.

• Get query examples: Retrieve example queries for different datasource types to learn query syntax.

Prometheus Querying

• Query Prometheus: Execute PromQL queries (supports both instant and range metric queries) against Prometheus datasources.
• Query Prometheus metadata: Retrieve metric metadata, metric names, label names, and label values from Prometheus datasources.
• Query histogram percentiles: Calculate histogram percentile values (p50, p90, p95, p99) using histogram_quantile.

Loki Querying

• Query Loki logs and metrics: Run both log queries and metric queries using LogQL against Loki datasources.
• Query Loki metadata: Retrieve label names, label values, and stream statistics from Loki datasources.
• Query Loki patterns: Retrieve log patterns detected by Loki to identify common log structures and anomalies.

InfluxDB Querying

Note: InfluxDB tools are disabled by default. To enable them, add influxdb to your --enabled-tools flag.

• Query InfluxDB: Execute queries against InfluxDB datasources using either InfluxQL (v1.x) or Flux (v2.x). The dialect is inferred from the datasource configuration, or can be set explicitly via the dialect parameter.

ClickHouse Querying

Note: ClickHouse tools are disabled by default. To enable them, add clickhouse to your --enabled-tools flag.

• List ClickHouse tables: List all tables in a ClickHouse database with row counts and sizes.
• Describe table schema: Get column names, types, and metadata for a ClickHouse table.
• Query ClickHouse: Execute SQL queries with Grafana macro and variable substitution support.

CloudWatch Querying

Note: CloudWatch tools are disabled by default. To enable them, add cloudwatch to your --enabled-tools flag.

• List CloudWatch namespaces: Discover available AWS CloudWatch namespaces.
• List CloudWatch metrics: List metrics available in a specific namespace.
• List CloudWatch dimensions: Get dimensions for filtering metric queries.
• Query CloudWatch: Execute CloudWatch metric queries with time range support.

Graphite Querying

Note: Graphite tools are disabled by default. To enable them, add graphite to your --enabled-tools flag.

• Query Graphite: Execute Graphite render API queries against a Graphite datasource.
• List Graphite metrics: Browse and discover Graphite metric paths.
• List Graphite tags: List available Graphite tags and tag values.
• Query Graphite density: Query Graphite metric density for a given pattern.

Snowflake Querying

Note: Snowflake tools are disabled by default. To enable them, add snowflake to your --enabled-tools flag.

Queries go through Grafana's Snowflake datasource (Grafana Enterprise plugin grafana-snowflake-datasource), so authentication is handled by the datasource configuration in Grafana — credentials are never seen by the MCP server. This is the same model used for the ClickHouse tools.

• List Snowflake tables: Discover tables (with database, schema, kind, row count, and size) via INFORMATION_SCHEMA.TABLES. Optional database/schema filters.
• Describe table schema: Get column names, data types, nullability, defaults, and comments for a Snowflake table.
• Query Snowflake: Execute SQL queries with macro and variable substitution support. Useful for querying Snowflake's event tables (e.g. SNOWFLAKE.TELEMETRY.EVENTS) for logs and traces, or any user table.
  • Supported macros: $__timeFilter(column), $__timeFrom, $__timeTo, $__from, $__to (Unix ms), $__interval (seconds), $__interval_ms, and ${varname} for template variable substitution.

Elasticsearch/OpenSearch Querying

Note: Elasticsearch/OpenSearch tools are disabled by default. To enable them, add elasticsearch to your --enabled-tools flag.

• Query Elasticsearch/OpenSearch: Execute search queries against Elasticsearch or OpenSearch datasources using either Lucene query syntax or Elasticsearch Query DSL. Supports filtering by time range and retrieving logs, metrics, or any indexed data. Returns documents with their index, ID, source fields, and optional relevance score.

Incidents

• Search, create, and update incidents: Manage incidents in Grafana Incident, including searching, creating, and adding activities to incidents.

Sift Investigations

• List Sift investigations: Retrieve a list of Sift investigations, with support for a limit parameter.
• Get Sift investigation: Retrieve details of a specific Sift investigation by its UUID.
• Get Sift analyses: Retrieve a specific analysis from a Sift investigation.
• Find error patterns in logs: Detect elevated error patterns in Loki logs using Sift.
• Find slow requests: Detect slow requests using Sift (Tempo).

Alerting

• List and fetch alert rule information: View alert rules and their statuses (firing/normal/error/etc.) in Grafana. Supports both Grafana-managed rules and datasource-managed rules from Prometheus or Loki datasources.
• Create and update alert rules: Create new alert rules or modify existing ones.
• Delete alert rules: Remove alert rules by UID.
• Manage alerting routing: View notification policies, contact points, and time intervals. Supports both Grafana-managed contact points and receivers from external Alertmanager datasources (Prometheus Alertmanager, Mimir, Cortex).

Grafana OnCall

• List and manage schedules: View and manage on-call schedules in Grafana OnCall.
• Get shift details: Retrieve detailed information about specific on-call shifts.
• Get current on-call users: See which users are currently on call for a schedule.
• List teams and users: View all OnCall teams and users.
• List alert groups: View and filter alert groups from Grafana OnCall by various criteria including state, integration, labels, and time range.
• Get alert group details: Retrieve detailed information about a specific alert group by its ID.

Admin

Note: Admin tools are disabled by default. To enable them, include admin in your --enabled-tools flag.

• List teams: View all configured teams in Grafana.
• List Users: View all users in an organization in Grafana.
• List all roles: List all Grafana roles, with an optional filter for delegatable roles.
• Get role details: Get details for a specific Grafana role by UID.
• List assignments for a role: List all users, teams, and service accounts assigned to a role.
• List roles for users: List all roles assigned to one or more users.
• List roles for teams: List all roles assigned to one or more teams.
• List permissions for a resource: List all permissions defined for a specific resource (dashboard, datasource, folder, etc.).
• Describe a Grafana resource: List available permissions and assignment capabilities for a resource type.

Navigation

• Generate deeplinks: Create accurate deeplink URLs for Grafana resources instead of relying on LLM URL guessing.
  • Dashboard links: Generate direct links to dashboards using their UID (e.g., http://localhost:3000/d/dashboard-uid)
  • Panel links: Create links to specific panels within dashboards with viewPanel parameter (e.g., http://localhost:3000/d/dashboard-uid?viewPanel=5)
  • Explore links: Generate links to Grafana Explore with pre-configured datasources (e.g., http://localhost:3000/explore?left={"datasource":"prometheus-uid"})
  • Time range support: Add time range parameters to links (from=now-1h&to=now)
  • Custom parameters: Include additional query parameters like dashboard variables or refresh intervals

Annotations

• Get Annotations: Query annotations with filters. Supports time range, dashboard UID, tags, and match mode.
• Create Annotation: Create a new annotation on a dashboard or panel.
• Create Graphite Annotation: Create annotations using Graphite format (what, when, tags, data).
• Update Annotation: Replace all fields of an existing annotation (full update).
• Patch Annotation: Update only specific fields of an annotation (partial update).
• Get Annotation Tags: List available annotation tags with optional filtering.

Rendering

• Get panel or dashboard image: Render a Grafana dashboard panel or full dashboard as a PNG image. Returns the image as base64 encoded data for use in reports, alerts, or presentations. Supports customizing dimensions, time range, theme, scale, and dashboard variables.
  • Note: Requires the Grafana Image Renderer service to be installed and configured.

The list of tools is configurable, so you can choose which tools you want to make available to the MCP client. This is useful if you don't use certain functionality or if you don't want to take up too much of the context window. To disable a category of tools, use the --disable-<category> flag when starting the server. For example, to disable the OnCall tools, use --disable-oncall, or to disable navigation deeplink generation, use --disable-navigation.

RBAC Permissions

Each tool requires specific RBAC permissions to function properly. When creating a service account for the MCP server, ensure it has the necessary permissions based on which tools you plan to use. The permissions listed are the minimum required actions - you may also need appropriate scopes (e.g., datasources:*, dashboards:*, folders:*) depending on your use case.

Tip: If you're not familiar with Grafana RBAC or you want a quicker, simpler setup instead of configuring many granular scopes, you can assign a built-in role such as Editor to the service account. The Editor role grants broad read/write access that will allow most MCP server operations; it is less granular (and therefore less restrictive) than manually-applied scopes, so use it only when convenience is more important than strict least-privilege access.

Note: Grafana Incident and Sift tools use basic Grafana roles instead of fine-grained RBAC permissions:

• Viewer role: Required for read-only operations (list incidents, get investigations)
• Editor role: Required for write operations (create incidents, modify investigations)

For more information about Grafana RBAC, see the official documentation.

RBAC Scopes

Scopes define the specific resources that permissions apply to. Each action requires both the appropriate permission and scope combination.

Common Scope Patterns:

• Broad access: Use * wildcards for organization-wide access

  • datasources:* - Access to all datasources
  • dashboards:* - Access to all dashboards
  • folders:* - Access to all folders
  • teams:* - Access to all teams

• Limited access: Use specific UIDs or IDs to restrict access to individual resources

  • datasources:uid:prometheus-uid - Access only to a specific Prometheus datasource
  • dashboards:uid:abc123 - Access only to dashboard with UID abc123
  • folders:uid:xyz789 - Access only to folder with UID xyz789
  • teams:id:5 - Access only to team with ID 5
  • global.users:id:123 - Access only to user with ID 123

Examples:

• Full MCP server access: Grant broad permissions for all tools

  datasources:* (datasources:read, datasources:query)
  dashboards:* (dashboards:read, dashboards:create, dashboards:write)
  folders:* (for dashboard creation and alert rules)
  teams:* (teams:read)
  global.users:* (users:read)
  

• Limited datasource access: Only query specific Prometheus and Loki instances

  datasources:uid:prometheus-prod (datasources:query)
  datasources:uid:loki-prod (datasources:query)
  

• Dashboard-specific access: Read only specific dashboards

  dashboards:uid:monitoring-dashboard (dashboards:read)
  dashboards:uid:alerts-dashboard (dashboards:read)
  

Tools

* Disabled by default. Add category to --enabled-tools to enable.

CLI Flags Reference

The mcp-grafana binary supports various command-line flags for configuration:

Transport Options:

• -t, --transport: Transport type (stdio, sse, or streamable-http) - default: stdio
• --address: The host and port for SSE/streamable-http server - default: localhost:8000
• --base-path: Base path for the SSE/streamable-http server
• --endpoint-path: Endpoint path for the streamable-http server - default: /

Debug and Logging:

• --debug: Enable debug mode for detailed HTTP request/response logging
• --log-level: Log level (debug, info, warn, error) - default: info

Observability:

• --metrics: Enable Prometheus metrics endpoint at /metrics
• --metrics-address: Separate address for metrics server (e.g., :9090). If empty, metrics are served on the main server
• --slow-request-threshold: Log an event when any MCP request (tool invocation, list, resource read, etc.) takes longer than this duration. Accepts Go duration strings (e.g., 500ms, 5s). Default 0 disables slow-request logging. See the Slow-request logging section.
• --slow-request-log-level: Log level for slow-request events (info or warn) - default: warn.

Session Management:

• --session-idle-timeout-minutes: Session idle timeout in minutes. Sessions with no activity for this duration are automatically reaped - default: 30. Set to 0 to disable session reaping. Only relevant for SSE and streamable-http transports.

Tool Configuration:

• --enabled-tools: Comma-separated list of enabled categories - default: all categories except admin, clickhouse, cloudwatch, elasticsearch, examples, graphite, runpanelquery, and snowflake. To enable disabled categories, add them to the list (e.g., "search,datasource,...,snowflake")
• --max-loki-log-limit: Maximum number of log lines returned per query_loki_logs call - default: 100. Note: Set this at least 1 below Loki's server-side max_entries_limit_per_query to allow truncation detection (the tool requests limit+1 internally to detect if more data exists).
• --disable-search: Disable search tools
• --disable-datasource: Disable datasource tools
• --disable-incident: Disable incident tools
• --disable-prometheus: Disable prometheus tools
• --disable-write: Disable write tools (create/update operations)
• --disable-loki: Disable loki tools
• --disable-elasticsearch: Disable elasticsearch and opensearch tools
• --disable-influxdb: Disable InfluxDB tools
• --disable-alerting: Disable alerting tools
• --disable-dashboard: Disable dashboard tools
• --disable-oncall: Disable oncall tools
• --disable-asserts: Disable asserts tools
• --disable-sift: Disable sift tools
• --disable-admin: Disable admin tools
• --disable-pyroscope: Disable pyroscope tools
• --disable-navigation: Disable navigation tools
• --disable-rendering: Disable rendering tools (panel/dashboard image export)
• --disable-cloudwatch: Disable CloudWatch tools
• --disable-examples: Disable query examples tools
• --disable-clickhouse: Disable ClickHouse tools
• --disable-snowflake: Disable Snowflake tools
• --disable-runpanelquery: Disable run panel query tools
• --disable-graphite: Disable Graphite tools

Read-Only Mode

The --disable-write flag provides a way to run the MCP server in read-only mode, preventing any write operations to your Grafana instance. This is useful for scenarios where you want to provide safe, read-only access such as:

• Using service accounts with limited read-only permissions
• Providing AI assistants with observability data without modification capabilities
• Running in production environments where write access should be restricted
• Testing and development scenarios where you want to prevent accidental modifications

When --disable-write is enabled, the following write operations are disabled:

Dashboard Tools:

• update_dashboard

Folder Tools:

• create_folder

Incident Tools:

• create_incident
• add_activity_to_incident

Alerting Tools:

• alerting_manage_rules (create, update, delete operations)

Annotation Tools:

• create_annotation
• update_annotation

Sift Tools:

• find_error_pattern_logs (creates investigations)
• find_slow_requests (creates investigations)

All read operations remain available, allowing you to query dashboards, run PromQL/LogQL queries, list resources, and retrieve data.

Client TLS Configuration (for Grafana connections):

• --tls-cert-file: Path to TLS certificate file for client authentication
• --tls-key-file: Path to TLS private key file for client authentication
• --tls-ca-file: Path to TLS CA certificate file for server verification
• --tls-skip-verify: Skip TLS certificate verification (insecure)

Server TLS Configuration (streamable-http transport only):

• --server.tls-cert-file: Path to TLS certificate file for server HTTPS
• --server.tls-key-file: Path to TLS private key file for server HTTPS

Usage

This MCP server works with both local Grafana instances and Grafana Cloud. For Grafana Cloud, use your instance URL (e.g., https://myinstance.grafana.net) instead of http://localhost:3000 in the configuration examples below.

1. If using service account token authentication, create a service account in Grafana with enough permissions to use the tools you want to use, generate a service account token, and copy it to the clipboard for use in the configuration file. Follow the [Grafana service account documentation][service-account] for details on creating service account tokens. Tip: If you're not comfortable configuring fine-grained RBAC scopes, a simpler (but less restrictive) option is to assign the built-in Editor role to the service account. This grants broad read/write access that covers most MCP server operations — use it when convenience outweighs strict least-privilege requirements.

   Note: The environment variable GRAFANA_API_KEY is deprecated and will be removed in a future version. Please migrate to using GRAFANA_SERVICE_ACCOUNT_TOKEN instead. The old variable name will continue to work for backward compatibility but will show deprecation warnings.

Multi-Organization Support

You can specify which organization to interact with using either:

• Environment variable: Set GRAFANA_ORG_ID to the numeric organization ID
• HTTP header: Set X-Grafana-Org-Id when using SSE or streamable HTTP transports (header takes precedence over environment variable - meaning you can set a default org as well).

When an organization ID is provided, the MCP server will set the X-Grafana-Org-Id header on all requests to Grafana, ensuring that operations are performed within the specified organization context.

Example with organization ID:

{
  "mcpServers": {
    "grafana": {
      "command": "mcp-grafana",
      "args": [],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_USERNAME": "<your username>",
        "GRAFANA_PASSWORD": "<your password>",
        "GRAFANA_ORG_ID": "2"
      }
    }
  }
}

Custom HTTP Headers

You can add arbitrary HTTP headers to all Grafana API requests using the GRAFANA_EXTRA_HEADERS environment variable. The value should be a JSON object mapping header names to values.

Example with custom headers:

{
  "mcpServers": {
    "grafana": {
      "command": "mcp-grafana",
      "args": [],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your token>",
        "GRAFANA_EXTRA_HEADERS": "{\"X-Custom-Header\": \"custom-value\", \"X-Tenant-ID\": \"tenant-123\"}"
      }
    }
  }
}

Forwarding Headers from the Client (SSE/Streamable-HTTP Only)

Documentation truncated — see the full README on GitHub.