Grafana
Run Grafana's MCP server read-only, so the agent can query Prometheus and Loki through Grafana, read dashboards, alerts and incidents.
mcp-grafana is Grafana's official MCP server. Through your Grafana, the agent can search dashboards, run PromQL and LogQL against your datasources, and read alert rules, incidents and on-call schedules. It works with self-managed Grafana and Grafana Cloud.
| Setting | Value |
|---|---|
| Runs | In your network, next to Grafana (Docker, binary or Helm) |
| Endpoint URL | https://<your hostname>/mcp |
| Transport | Streamable HTTP |
| Authentication | Bearer token (MCP_GRAFANA_SERVER_TOKEN) |
Create a read-only service account
In Grafana, Administration → Users and access → Service accounts → Add service account, role Viewer. Then Add service account token and copy it.
The Viewer role covers reading dashboards, running queries, and the read side of alerting, on-call and incidents.
Run the server read-only
# The key sremcp will send. Keep it: it's the Secret you enter in sremcp.
MCP_KEY=$(openssl rand -hex 32); echo "$MCP_KEY"
docker run -d --name mcp-grafana -p 8000:8000 \
-e GRAFANA_URL=https://grafana.example.com \
-e GRAFANA_SERVICE_ACCOUNT_TOKEN=<service account token> \
-e MCP_GRAFANA_SERVER_TOKEN="$MCP_KEY" \
grafana/mcp-grafana \
-t streamable-http --disable-write --allowed-hosts mcp-grafana.example.com-t streamable-httpserves MCP at/mcpon port 8000.--disable-writeremoves every tool that creates or changes something. It also removes raw-SQL query tools, which could write through a datasource.MCP_GRAFANA_SERVER_TOKENmakes the server requireAuthorization: Bearer <key>.--allowed-hostslists the hostname sremcp will use. The server rejects otherHostheaders with403.
On Kubernetes, the grafana-mcp Helm chart
runs the same server: set the Grafana URL and token in its values, and the flags above as its extra arguments.
Expose it over https
Give it a hostname and a certificate: https://mcp-grafana.example.com/mcp. See
Expose a self-hosted server.
Onboard in sremcp
| Field | Value |
|---|---|
| Display name / Slug | Grafana (prod) / grafana-prod |
| Endpoint URL | https://mcp-grafana.example.com/mcp |
| Transport | Streamable HTTP |
| Authentication | Bearer token, Secret = the MCP_KEY above |
Approve tools
After Test connection, a good start is:
search_dashboards,get_dashboard_summary,get_dashboard_by_uid,list_datasourcesquery_prometheus,list_prometheus_metric_namesquery_loki_logs,query_loki_statslist_incidents,list_oncall_schedules
Try it
- Is the checkout error rate up compared with yesterday? Use the Checkout dashboard's queries.
- Show me error logs from payments-api in Loki for the last 30 minutes, grouped by message.
- Who's on call for platform right now, and are there open incidents?
Troubleshooting
403on Test connection: the hostname isn't in--allowed-hosts.401: the Secret doesn't matchMCP_GRAFANA_SERVER_TOKEN.- Tools fail with permission errors: the service account needs more read access for that tool. Keep it at Viewer or below.