mcpgrafana

README

Grafana MCP server

A Model Context Protocol (MCP) server for Grafana.

This provides access to your Grafana instance and the surrounding ecosystem.

Requirements

• Grafana version 9.0 or later is required for full functionality. Some features, particularly datasource-related operations, may not work correctly with earlier versions due to missing API endpoints.

Features

The following features are currently available in MCP server. This list is for informational purposes only and does not represent a roadmap or commitment to future features.

Dashboards

• Search for dashboards: Find dashboards by title or other metadata
• Get dashboard by UID: Retrieve full dashboard details using its unique identifier. Warning: Large dashboards can consume significant context window space.
• Get dashboard summary: Get a compact overview of a dashboard including title, panel count, panel types, variables, and metadata without the full JSON to minimize context window usage
• Get dashboard property: Extract specific parts of a dashboard using JSONPath expressions (e.g., $.title, $.panels[*].title) to fetch only needed data and reduce context window consumption
• Update or create a dashboard: Modify existing dashboards or create new ones. Warning: Requires full dashboard JSON which can consume large amounts of context window space.
• Patch dashboard: Apply specific changes to a dashboard without requiring the full JSON, significantly reducing context window usage for targeted modifications
• Get panel queries and datasource info: Get the title, query string, and datasource information (including UID and type, if available) from every panel in a dashboard

Context Window Management

The dashboard tools now include several strategies to manage context window usage effectively (issue #101):

• Use get_dashboard_summary for dashboard overview and planning modifications
• Use get_dashboard_property with JSONPath when you only need specific dashboard parts
• Avoid get_dashboard_by_uid unless you specifically need the complete dashboard JSON

Datasources

• List and fetch datasource information: View all configured datasources and retrieve detailed information about each.
  • Supported datasource types: Prometheus, Loki.

Prometheus Querying

• Query Prometheus: Execute PromQL queries (supports both instant and range metric queries) against Prometheus datasources.
• Query Prometheus metadata: Retrieve metric metadata, metric names, label names, and label values from Prometheus datasources.

Loki Querying

• Query Loki logs and metrics: Run both log queries and metric queries using LogQL against Loki datasources.
• Query Loki metadata: Retrieve label names, label values, and stream statistics from Loki datasources.

Incidents

• Search, create, and update incidents: Manage incidents in Grafana Incident, including searching, creating, and adding activities to incidents.

Sift Investigations

• List Sift investigations: Retrieve a list of Sift investigations, with support for a limit parameter.
• Get Sift investigation: Retrieve details of a specific Sift investigation by its UUID.
• Get Sift analyses: Retrieve a specific analysis from a Sift investigation.
• Find error patterns in logs: Detect elevated error patterns in Loki logs using Sift.
• Find slow requests: Detect slow requests using Sift (Tempo).

Alerting

• List and fetch alert rule information: View alert rules and their statuses (firing/normal/error/etc.) in Grafana.
• List contact points: View configured notification contact points in Grafana.

Grafana OnCall

• List and manage schedules: View and manage on-call schedules in Grafana OnCall.
• Get shift details: Retrieve detailed information about specific on-call shifts.
• Get current on-call users: See which users are currently on call for a schedule.
• List teams and users: View all OnCall teams and users.
• List alert groups: View and filter alert groups from Grafana OnCall by various criteria including state, integration, labels, and time range.
• Get alert group details: Retrieve detailed information about a specific alert group by its ID.

Admin

• List teams: View all configured teams in Grafana.
• List Users: View all users in an organization in Grafana.

Navigation

• Generate deeplinks: Create accurate deeplink URLs for Grafana resources instead of relying on LLM URL guessing.
  • Dashboard links: Generate direct links to dashboards using their UID (e.g., http://localhost:3000/d/dashboard-uid)
  • Panel links: Create links to specific panels within dashboards with viewPanel parameter (e.g., http://localhost:3000/d/dashboard-uid?viewPanel=5)
  • Explore links: Generate links to Grafana Explore with pre-configured datasources (e.g., http://localhost:3000/explore?left={"datasource":"prometheus-uid"})
  • Time range support: Add time range parameters to links (from=now-1h&to=now)
  • Custom parameters: Include additional query parameters like dashboard variables or refresh intervals

The list of tools is configurable, so you can choose which tools you want to make available to the MCP client. This is useful if you don't use certain functionality or if you don't want to take up too much of the context window. To disable a category of tools, use the --disable-<category> flag when starting the server. For example, to disable the OnCall tools, use --disable-oncall, or to disable navigation deeplink generation, use --disable-navigation.

RBAC Permissions

Each tool requires specific RBAC permissions to function properly. When creating a service account for the MCP server, ensure it has the necessary permissions based on which tools you plan to use. The permissions listed are the minimum required actions - you may also need appropriate scopes (e.g., datasources:*, dashboards:*, folders:*) depending on your use case.

Note: Grafana Incident and Sift tools use basic Grafana roles instead of fine-grained RBAC permissions:

• Viewer role: Required for read-only operations (list incidents, get investigations)
• Editor role: Required for write operations (create incidents, modify investigations)

For more information about Grafana RBAC, see the official documentation.

RBAC Scopes

Scopes define the specific resources that permissions apply to. Each action requires both the appropriate permission and scope combination.

Common Scope Patterns:

• Broad access: Use * wildcards for organization-wide access

  • datasources:* - Access to all datasources
  • dashboards:* - Access to all dashboards
  • folders:* - Access to all folders
  • teams:* - Access to all teams

• Limited access: Use specific UIDs or IDs to restrict access to individual resources

  • datasources:uid:prometheus-uid - Access only to a specific Prometheus datasource
  • dashboards:uid:abc123 - Access only to dashboard with UID abc123
  • folders:uid:xyz789 - Access only to folder with UID xyz789
  • teams:id:5 - Access only to team with ID 5
  • global.users:id:123 - Access only to user with ID 123

Examples:

• Full MCP server access: Grant broad permissions for all tools

  datasources:* (datasources:read, datasources:query)
  dashboards:* (dashboards:read, dashboards:create, dashboards:write)
  folders:* (for dashboard creation and alert rules)
  teams:* (teams:read)
  global.users:* (users:read)
  

• Limited datasource access: Only query specific Prometheus and Loki instances

  datasources:uid:prometheus-prod (datasources:query)
  datasources:uid:loki-prod (datasources:query)
  

• Dashboard-specific access: Read only specific dashboards

  dashboards:uid:monitoring-dashboard (dashboards:read)
  dashboards:uid:alerts-dashboard (dashboards:read)
  

Tools

Tool	Category	Description	Required RBAC Permissions	Required Scopes
list_teams	Admin	List all teams	teams:read	teams:* or teams:id:1
list_users_by_org	Admin	List all users in an organization	users:read	global.users:* or global.users:id:123
search_dashboards	Search	Search for dashboards	dashboards:read	dashboards:* or dashboards:uid:abc123
get_dashboard_by_uid	Dashboard	Get a dashboard by uid	dashboards:read	dashboards:uid:abc123
update_dashboard	Dashboard	Update or create a new dashboard	dashboards:create, dashboards:write	dashboards:*, folders:* or folders:uid:xyz789
get_dashboard_panel_queries	Dashboard	Get panel title, queries, datasource UID and type from a dashboard	dashboards:read	dashboards:uid:abc123
get_dashboard_property	Dashboard	Extract specific parts of a dashboard using JSONPath expressions	dashboards:read	dashboards:uid:abc123
get_dashboard_summary	Dashboard	Get a compact summary of a dashboard without full JSON	dashboards:read	dashboards:uid:abc123
list_datasources	Datasources	List datasources	datasources:read	datasources:*
get_datasource_by_uid	Datasources	Get a datasource by uid	datasources:read	datasources:uid:prometheus-uid
get_datasource_by_name	Datasources	Get a datasource by name	datasources:read	datasources:* or datasources:uid:loki-uid
query_prometheus	Prometheus	Execute a query against a Prometheus datasource	datasources:query	datasources:uid:prometheus-uid
list_prometheus_metric_metadata	Prometheus	List metric metadata	datasources:query	datasources:uid:prometheus-uid
list_prometheus_metric_names	Prometheus	List available metric names	datasources:query	datasources:uid:prometheus-uid
list_prometheus_label_names	Prometheus	List label names matching a selector	datasources:query	datasources:uid:prometheus-uid
list_prometheus_label_values	Prometheus	List values for a specific label	datasources:query	datasources:uid:prometheus-uid
list_incidents	Incident	List incidents in Grafana Incident	Viewer role	N/A
create_incident	Incident	Create an incident in Grafana Incident	Editor role	N/A
add_activity_to_incident	Incident	Add an activity item to an incident in Grafana Incident	Editor role	N/A
get_incident	Incident	Get a single incident by ID	Viewer role	N/A
query_loki_logs	Loki	Query and retrieve logs using LogQL (either log or metric queries)	datasources:query	datasources:uid:loki-uid
list_loki_label_names	Loki	List all available label names in logs	datasources:query	datasources:uid:loki-uid
list_loki_label_values	Loki	List values for a specific log label	datasources:query	datasources:uid:loki-uid
query_loki_stats	Loki	Get statistics about log streams	datasources:query	datasources:uid:loki-uid
list_alert_rules	Alerting	List alert rules	alert.rules:read	folders:* or folders:uid:alerts-folder
get_alert_rule_by_uid	Alerting	Get alert rule by UID	alert.rules:read	folders:uid:alerts-folder
list_contact_points	Alerting	List notification contact points	alert.notifications:read	Global scope
list_oncall_schedules	OnCall	List schedules from Grafana OnCall	grafana-oncall-app.schedules:read	Plugin-specific scopes
get_oncall_shift	OnCall	Get details for a specific OnCall shift	grafana-oncall-app.schedules:read	Plugin-specific scopes
get_current_oncall_users	OnCall	Get users currently on-call for a specific schedule	grafana-oncall-app.schedules:read	Plugin-specific scopes
list_oncall_teams	OnCall	List teams from Grafana OnCall	grafana-oncall-app.user-settings:read	Plugin-specific scopes
list_oncall_users	OnCall	List users from Grafana OnCall	grafana-oncall-app.user-settings:read	Plugin-specific scopes
list_alert_groups	OnCall	List alert groups from Grafana OnCall with filtering options	grafana-oncall-app.alert-groups:read	Plugin-specific scopes
get_alert_group	OnCall	Get a specific alert group from Grafana OnCall by its ID	grafana-oncall-app.alert-groups:read	Plugin-specific scopes
get_sift_investigation	Sift	Retrieve an existing Sift investigation by its UUID	Viewer role	N/A
get_sift_analysis	Sift	Retrieve a specific analysis from a Sift investigation	Viewer role	N/A
list_sift_investigations	Sift	Retrieve a list of Sift investigations with an optional limit	Viewer role	N/A
find_error_pattern_logs	Sift	Finds elevated error patterns in Loki logs.	Editor role	N/A
find_slow_requests	Sift	Finds slow requests from the relevant tempo datasources.	Editor role	N/A
list_pyroscope_label_names	Pyroscope	List label names matching a selector	datasources:query	datasources:uid:pyroscope-uid
list_pyroscope_label_values	Pyroscope	List label values matching a selector for a label name	datasources:query	datasources:uid:pyroscope-uid
list_pyroscope_profile_types	Pyroscope	List available profile types	datasources:query	datasources:uid:pyroscope-uid
fetch_pyroscope_profile	Pyroscope	Fetches a profile in DOT format for analysis	datasources:query	datasources:uid:pyroscope-uid
get_assertions	Asserts	Get assertion summary for a given entity	Plugin-specific permissions	Plugin-specific scopes
generate_deeplink	Navigation	Generate accurate deeplink URLs for Grafana resources	None (read-only URL generation)	N/A

CLI Flags Reference

The mcp-grafana binary supports various command-line flags for configuration:

Transport Options:

• -t, --transport: Transport type (stdio, sse, or streamable-http) - default: stdio
• --address: The host and port for SSE/streamable-http server - default: localhost:8000
• --base-path: Base path for the SSE/streamable-http server
• --endpoint-path: Endpoint path for the streamable-http server - default: /

Debug and Logging:

• --debug: Enable debug mode for detailed HTTP request/response logging

Tool Configuration:

• --enabled-tools: Comma-separated list of enabled tools - default: all tools enabled
• --disable-search: Disable search tools
• --disable-datasource: Disable datasource tools
• --disable-incident: Disable incident tools
• --disable-prometheus: Disable prometheus tools
• --disable-loki: Disable loki tools
• --disable-alerting: Disable alerting tools
• --disable-dashboard: Disable dashboard tools
• --disable-oncall: Disable oncall tools
• --disable-asserts: Disable asserts tools
• --disable-sift: Disable sift tools
• --disable-admin: Disable admin tools
• --disable-pyroscope: Disable pyroscope tools
• --disable-navigation: Disable navigation tools

Client TLS Configuration (for Grafana connections):

• --tls-cert-file: Path to TLS certificate file for client authentication
• --tls-key-file: Path to TLS private key file for client authentication
• --tls-ca-file: Path to TLS CA certificate file for server verification
• --tls-skip-verify: Skip TLS certificate verification (insecure)

Server TLS Configuration (streamable-http transport only):

• --server.tls-cert-file: Path to TLS certificate file for server HTTPS
• --server.tls-key-file: Path to TLS private key file for server HTTPS

Usage

This MCP server works with both local Grafana instances and Grafana Cloud. For Grafana Cloud, use your instance URL (e.g., https://myinstance.grafana.net) instead of http://localhost:3000 in the configuration examples below.

1. If using service account token authentication, create a service account in Grafana with enough permissions to use the tools you want to use, generate a service account token, and copy it to the clipboard for use in the configuration file. Follow the Grafana service account documentation for details on creating service account tokens.

   Note: The environment variable GRAFANA_API_KEY is deprecated and will be removed in a future version. Please migrate to using GRAFANA_SERVICE_ACCOUNT_TOKEN instead. The old variable name will continue to work for backward compatibility but will show deprecation warnings.

2. You have several options to install mcp-grafana:

   • Docker image: Use the pre-built Docker image from Docker Hub.

     Important: The Docker image's entrypoint is configured to run the MCP server in SSE mode by default, but most users will want to use STDIO mode for direct integration with AI assistants like Claude Desktop:

     1. STDIO Mode: For stdio mode you must explicitly override the default with -t stdio and include the -i flag to keep stdin open:

     docker pull mcp/grafana
     # For local Grafana:
     docker run --rm -i -e GRAFANA_URL=http://localhost:3000 -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> mcp/grafana -t stdio
     # For Grafana Cloud:
     docker run --rm -i -e GRAFANA_URL=https://myinstance.grafana.net -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> mcp/grafana -t stdio
     

     1. SSE Mode: In this mode, the server runs as an HTTP server that clients connect to. You must expose port 8000 using the -p flag:

     docker pull mcp/grafana
     docker run --rm -p 8000:8000 -e GRAFANA_URL=http://localhost:3000 -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> mcp/grafana
     

     1. Streamable HTTP Mode: In this mode, the server operates as an independent process that can handle multiple client connections. You must expose port 8000 using the -p flag: For this mode you must explicitly override the default with -t streamable-http

     docker pull mcp/grafana
     docker run --rm -p 8000:8000 -e GRAFANA_URL=http://localhost:3000 -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> mcp/grafana -t streamable-http
     

     For HTTPS streamable HTTP mode with server TLS certificates:

     docker pull mcp/grafana
     docker run --rm -p 8443:8443 \
       -v /path/to/certs:/certs:ro \
       -e GRAFANA_URL=http://localhost:3000 \
       -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> \
       mcp/grafana \
       -t streamable-http \
       -addr :8443 \
       --server.tls-cert-file /certs/server.crt \
       --server.tls-key-file /certs/server.key
     

   • Download binary: Download the latest release of mcp-grafana from the releases page and place it in your $PATH.

   • Build from source: If you have a Go toolchain installed you can also build and install it from source, using the GOBIN environment variable to specify the directory where the binary should be installed. This should also be in your PATH.

     GOBIN="$HOME/go/bin" go install github.com/grafana/mcp-grafana/cmd/mcp-grafana@latest
     

   • Deploy to Kubernetes using Helm: use the Helm chart from the Grafana helm-charts repository

     helm repo add grafana https://grafana.github.io/helm-charts
     helm install --set grafana.apiKey=<Grafana_ApiKey> --set grafana.url=<GrafanaUrl> my-release grafana/grafana-mcp
     

3. Add the server configuration to your client configuration file. For example, for Claude Desktop:

   If using the binary:

   {
     "mcpServers": {
       "grafana": {
         "command": "mcp-grafana",
         "args": [],
         "env": {
           "GRAFANA_URL": "http://localhost:3000",  // Or "https://myinstance.grafana.net" for Grafana Cloud
           "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>",
           // If using username/password authentication
           "GRAFANA_USERNAME": "<your username>",
           "GRAFANA_PASSWORD": "<your password>"
         }
       }
     }
   }
   

Note: if you see Error: spawn mcp-grafana ENOENT in Claude Desktop, you need to specify the full path to mcp-grafana.

If using Docker:

{
  "mcpServers": {
    "grafana": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "GRAFANA_URL",
        "-e",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN",
        "mcp/grafana",
        "-t",
        "stdio"
      ],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",  // Or "https://myinstance.grafana.net" for Grafana Cloud
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>",
        // If using username/password authentication
        "GRAFANA_USERNAME": "<your username>",
        "GRAFANA_PASSWORD": "<your password>"
      }
    }
  }
}

Note: The -t stdio argument is essential here because it overrides the default SSE mode in the Docker image.

Using VSCode with remote MCP server

If you're using VSCode and running the MCP server in SSE mode (which is the default when using the Docker image without overriding the transport), make sure your .vscode/settings.json includes the following:

"mcp": {
  "servers": {
    "grafana": {
      "type": "sse",
      "url": "http://localhost:8000/sse"
    }
  }
}

For HTTPS streamable HTTP mode with server TLS certificates:

"mcp": {
  "servers": {
    "grafana": {
      "type": "sse",
      "url": "https://localhost:8443/sse"
    }
  }
}

Debug Mode

You can enable debug mode for the Grafana transport by adding the -debug flag to the command. This will provide detailed logging of HTTP requests and responses between the MCP server and the Grafana API, which can be helpful for troubleshooting.

To use debug mode with the Claude Desktop configuration, update your config as follows:

If using the binary:

{
  "mcpServers": {
    "grafana": {
      "command": "mcp-grafana",
      "args": ["-debug"],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",  // Or "https://myinstance.grafana.net" for Grafana Cloud
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

If using Docker:

{
  "mcpServers": {
    "grafana": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "GRAFANA_URL",
        "-e",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN",
        "mcp/grafana",
        "-t",
        "stdio",
        "-debug"
      ],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",  // Or "https://myinstance.grafana.net" for Grafana Cloud
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

Note: As with the standard configuration, the -t stdio argument is required to override the default SSE mode in the Docker image.

TLS Configuration

If your Grafana instance is behind mTLS or requires custom TLS certificates, you can configure the MCP server to use custom certificates. The server supports the following TLS configuration options:

• --tls-cert-file: Path to TLS certificate file for client authentication
• --tls-key-file: Path to TLS private key file for client authentication
• --tls-ca-file: Path to TLS CA certificate file for server verification
• --tls-skip-verify: Skip TLS certificate verification (insecure, use only for testing)

Example with client certificate authentication:

{
  "mcpServers": {
    "grafana": {
      "command": "mcp-grafana",
      "args": [
        "--tls-cert-file",
        "/path/to/client.crt",
        "--tls-key-file",
        "/path/to/client.key",
        "--tls-ca-file",
        "/path/to/ca.crt"
      ],
      "env": {
        "GRAFANA_URL": "https://secure-grafana.example.com",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

Example with Docker:

{
  "mcpServers": {
    "grafana": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-v",
        "/path/to/certs:/certs:ro",
        "-e",
        "GRAFANA_URL",
        "-e",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN",
        "mcp/grafana",
        "-t",
        "stdio",
        "--tls-cert-file",
        "/certs/client.crt",
        "--tls-key-file",
        "/certs/client.key",
        "--tls-ca-file",
        "/certs/ca.crt"
      ],
      "env": {
        "GRAFANA_URL": "https://secure-grafana.example.com",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

The TLS configuration is applied to all HTTP clients used by the MCP server, including:

• The main Grafana OpenAPI client
• Prometheus datasource clients
• Loki datasource clients
• Incident management clients
• Sift investigation clients
• Alerting clients
• Asserts clients

Direct CLI Usage Examples:

For testing with self-signed certificates:

./mcp-grafana --tls-skip-verify -debug

With client certificate authentication:

./mcp-grafana \
  --tls-cert-file /path/to/client.crt \
  --tls-key-file /path/to/client.key \
  --tls-ca-file /path/to/ca.crt \
  -debug

With custom CA certificate only:

./mcp-grafana --tls-ca-file /path/to/ca.crt

Programmatic Usage:

If you're using this library programmatically, you can also create TLS-enabled context functions:

// Using struct literals
tlsConfig := &mcpgrafana.TLSConfig{
    CertFile: "/path/to/client.crt",
    KeyFile:  "/path/to/client.key",
    CAFile:   "/path/to/ca.crt",
}
grafanaConfig := mcpgrafana.GrafanaConfig{
    Debug:     true,
    TLSConfig: tlsConfig,
}
contextFunc := mcpgrafana.ComposedStdioContextFunc(grafanaConfig)

// Or inline
grafanaConfig := mcpgrafana.GrafanaConfig{
    Debug: true,
    TLSConfig: &mcpgrafana.TLSConfig{
        CertFile: "/path/to/client.crt",
        KeyFile:  "/path/to/client.key",
        CAFile:   "/path/to/ca.crt",
    },
}
contextFunc := mcpgrafana.ComposedStdioContextFunc(grafanaConfig)

Server TLS Configuration (Streamable HTTP Transport Only)

When using the streamable HTTP transport (-t streamable-http), you can configure the MCP server to serve HTTPS instead of HTTP. This is useful when you need to secure the connection between your MCP client and the server itself.

The server supports the following TLS configuration options for the streamable HTTP transport:

• --server.tls-cert-file: Path to TLS certificate file for server HTTPS (required for TLS)
• --server.tls-key-file: Path to TLS private key file for server HTTPS (required for TLS)

Note: These flags are completely separate from the client TLS flags documented above. The client TLS flags configure how the MCP server connects to Grafana, while these server TLS flags configure how clients connect to the MCP server when using streamable HTTP transport.

Example with HTTPS streamable HTTP server:

./mcp-grafana \
  -t streamable-http \
  --server.tls-cert-file /path/to/server.crt \
  --server.tls-key-file /path/to/server.key \
  -addr :8443

This would start the MCP server on HTTPS port 8443. Clients would then connect to https://localhost:8443/ instead of http://localhost:8000/.

Docker example with server TLS:

docker run --rm -p 8443:8443 \
  -v /path/to/certs:/certs:ro \
  -e GRAFANA_URL=http://localhost:3000 \
  -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<your service account token> \
  mcp/grafana \
  -t streamable-http \
  -addr :8443 \
  --server.tls-cert-file /certs/server.crt \
  --server.tls-key-file /certs/server.key

Troubleshooting

Grafana Version Compatibility

If you encounter the following error when using datasource-related tools:

get datasource by uid : [GET /datasources/uid/{uid}][400] getDataSourceByUidBadRequest {"message":"id is invalid"}

This typically indicates that you are using a Grafana version earlier than 9.0. The /datasources/uid/{uid} API endpoint was introduced in Grafana 9.0, and datasource operations will fail on earlier versions.

Solution: Upgrade your Grafana instance to version 9.0 or later to resolve this issue.

Development

Contributions are welcome! Please open an issue or submit a pull request if you have any suggestions or improvements.

This project is written in Go. Install Go following the instructions for your platform.

To run the server locally in STDIO mode (which is the default for local development), use:

make run

To run the server locally in SSE mode, use:

go run ./cmd/mcp-grafana --transport sse

You can also run the server using the SSE transport inside a custom built Docker image. Just like the published Docker image, this custom image's entrypoint defaults to SSE mode. To build the image, use:

make build-image

And to run the image in SSE mode (the default), use:

docker run -it --rm -p 8000:8000 mcp-grafana:latest

If you need to run it in STDIO mode instead, override the transport setting:

docker run -it --rm mcp-grafana:latest -t stdio

Testing

There are three types of tests available:

1. Unit Tests (no external dependencies required):

make test-unit

You can also run unit tests with:

make test

1. Integration Tests (requires docker containers to be up and running):

make test-integration

1. Cloud Tests (requires cloud Grafana instance and credentials):

make test-cloud

Note: Cloud tests are automatically configured in CI. For local development, you'll need to set up your own Grafana Cloud instance and credentials.

More comprehensive integration tests will require a Grafana instance to be running locally on port 3000; you can start one with Docker Compose:

docker-compose up -d

The integration tests can be run with:

make test-all

If you're adding more tools, please add integration tests for them. The existing tests should be a good starting point.

Linting

To lint the code, run:

make lint

This includes a custom linter that checks for unescaped commas in jsonschema struct tags. The commas in description fields must be escaped with \\, to prevent silent truncation. You can run just this linter with:

make lint-jsonschema

See the JSONSchema Linter documentation for more details.

License

This project is licensed under the Apache License, Version 2.0.

Documentation

Index

• Variables
• func ComposeHTTPContextFuncs(funcs ...httpContextFunc) server.HTTPContextFunc
• func ComposeSSEContextFuncs(funcs ...httpContextFunc) server.SSEContextFunc
• func ComposeStdioContextFuncs(funcs ...server.StdioContextFunc) server.StdioContextFunc
• func ComposedHTTPContextFunc(config GrafanaConfig) server.HTTPContextFunc
• func ComposedSSEContextFunc(config GrafanaConfig) server.SSEContextFunc
• func ComposedStdioContextFunc(config GrafanaConfig) server.StdioContextFunc
• func ConvertTool[T any, R any](name, description string, toolHandler ToolHandlerFunc[T, R], ...) (mcp.Tool, server.ToolHandlerFunc, error)
• func GrafanaClientFromContext(ctx context.Context) *client.GrafanaHTTPAPI
• func IncidentClientFromContext(ctx context.Context) *incident.Client
• func MustWithOnBehalfOfAuth(ctx context.Context, accessToken, userToken string) context.Context
• func NewGrafanaClient(ctx context.Context, grafanaURL, apiKey string, auth *url.Userinfo) *client.GrafanaHTTPAPI
• func UserAgent() string
• func WithGrafanaClient(ctx context.Context, client *client.GrafanaHTTPAPI) context.Context
• func WithGrafanaConfig(ctx context.Context, config GrafanaConfig) context.Context
• func WithIncidentClient(ctx context.Context, client *incident.Client) context.Context
• func WithOnBehalfOfAuth(ctx context.Context, accessToken, userToken string) (context.Context, error)
• type GrafanaConfig
  • func GrafanaConfigFromContext(ctx context.Context) GrafanaConfig
• type TLSConfig
  • func (tc *TLSConfig) CreateTLSConfig() (*tls.Config, error)
  • func (tc *TLSConfig) HTTPTransport(defaultTransport *http.Transport) (http.RoundTripper, error)
• type Tool
  • func MustTool[T any, R any](name, description string, toolHandler ToolHandlerFunc[T, R], ...) Tool
  • func (t *Tool) Register(mcp *server.MCPServer)
• type ToolHandlerFunc
• type UserAgentTransport
  • func NewUserAgentTransport(rt http.RoundTripper, userAgent ...string) *UserAgentTransport
  • func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error)

Variables

var ExtractGrafanaClientFromEnv server.StdioContextFunc = func(ctx context.Context) context.Context {

	grafanaURL, apiKey := urlAndAPIKeyFromEnv()
	if grafanaURL == "" {
		grafanaURL = defaultGrafanaURL
	}
	auth := userAndPassFromEnv()
	grafanaClient := NewGrafanaClient(ctx, grafanaURL, apiKey, auth)
	return context.WithValue(ctx, grafanaClientKey{}, grafanaClient)
}

ExtractGrafanaClientFromEnv is a StdioContextFunc that creates and injects a Grafana client into the context. It uses configuration from GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN (or deprecated GRAFANA_API_KEY), GRAFANA_USERNAME/PASSWORD environment variables to initialize the client with proper authentication.

var ExtractGrafanaClientFromHeaders httpContextFunc = func(ctx context.Context, req *http.Request) context.Context {

	u, apiKey, basicAuth := extractKeyGrafanaInfoFromReq(req)

	grafanaClient := NewGrafanaClient(ctx, u, apiKey, basicAuth)
	return WithGrafanaClient(ctx, grafanaClient)
}

ExtractGrafanaClientFromHeaders is a HTTPContextFunc that creates and injects a Grafana client into the context. It prioritizes configuration from HTTP headers (X-Grafana-URL, X-Grafana-API-Key) over environment variables for multi-tenant scenarios.

var ExtractGrafanaInfoFromEnv server.StdioContextFunc = func(ctx context.Context) context.Context {
	u, apiKey, basicAuth := extractKeyGrafanaInfoFromEnv()
	parsedURL, err := url.Parse(u)
	if err != nil {
		panic(fmt.Errorf("invalid Grafana URL %s: %w", u, err))
	}

	slog.Info("Using Grafana configuration", "url", parsedURL.Redacted(), "api_key_set", apiKey != "", "basic_auth_set", basicAuth != nil)

	config := GrafanaConfigFromContext(ctx)
	config.URL = u
	config.APIKey = apiKey
	config.BasicAuth = basicAuth
	return WithGrafanaConfig(ctx, config)
}

ExtractGrafanaInfoFromEnv is a StdioContextFunc that extracts Grafana configuration from environment variables. It reads GRAFANA_URL and GRAFANA_SERVICE_ACCOUNT_TOKEN (or deprecated GRAFANA_API_KEY) environment variables and adds the configuration to the context for use by Grafana clients.

var ExtractGrafanaInfoFromHeaders httpContextFunc = func(ctx context.Context, req *http.Request) context.Context {
	u, apiKey, basicAuth := extractKeyGrafanaInfoFromReq(req)

	config := GrafanaConfigFromContext(ctx)
	config.URL = u
	config.APIKey = apiKey
	config.BasicAuth = basicAuth
	return WithGrafanaConfig(ctx, config)
}

ExtractGrafanaInfoFromHeaders is a HTTPContextFunc that extracts Grafana configuration from HTTP request headers. It reads X-Grafana-URL and X-Grafana-API-Key headers, falling back to environment variables if headers are not present.

var ExtractIncidentClientFromEnv server.StdioContextFunc = func(ctx context.Context) context.Context {
	grafanaURL, apiKey := urlAndAPIKeyFromEnv()
	if grafanaURL == "" {
		grafanaURL = defaultGrafanaURL
	}
	incidentURL := fmt.Sprintf("%s/api/plugins/grafana-irm-app/resources/api/v1/", grafanaURL)
	parsedURL, err := url.Parse(incidentURL)
	if err != nil {
		panic(fmt.Errorf("invalid incident URL %s: %w", incidentURL, err))
	}
	slog.Debug("Creating Incident client", "url", parsedURL.Redacted(), "api_key_set", apiKey != "")
	client := incident.NewClient(incidentURL, apiKey)

	if tlsConfig := GrafanaConfigFromContext(ctx).TLSConfig; tlsConfig != nil {
		transport, err := tlsConfig.HTTPTransport(http.DefaultTransport.(*http.Transport))
		if err != nil {
			slog.Error("Failed to create custom transport for incident client, using default", "error", err)
		} else {
			client.HTTPClient.Transport = wrapWithUserAgent(transport)
			slog.Debug("Using custom TLS configuration and user agent for incident client",
				"cert_file", tlsConfig.CertFile,
				"ca_file", tlsConfig.CAFile,
				"skip_verify", tlsConfig.SkipVerify)
		}
	} else {

		client.HTTPClient.Transport = wrapWithUserAgent(http.DefaultTransport)
	}

	return context.WithValue(ctx, incidentClientKey{}, client)
}

ExtractIncidentClientFromEnv is a StdioContextFunc that creates and injects a Grafana Incident client into the context. It configures the client using environment variables and applies any custom TLS settings from the context.

var ExtractIncidentClientFromHeaders httpContextFunc = func(ctx context.Context, req *http.Request) context.Context {
	grafanaURL, apiKey, _ := extractKeyGrafanaInfoFromReq(req)
	incidentURL := fmt.Sprintf("%s/api/plugins/grafana-irm-app/resources/api/v1/", grafanaURL)
	client := incident.NewClient(incidentURL, apiKey)

	if tlsConfig := GrafanaConfigFromContext(ctx).TLSConfig; tlsConfig != nil {
		transport, err := tlsConfig.HTTPTransport(http.DefaultTransport.(*http.Transport))
		if err != nil {
			slog.Error("Failed to create custom transport for incident client, using default", "error", err)
		} else {
			client.HTTPClient.Transport = wrapWithUserAgent(transport)
			slog.Debug("Using custom TLS configuration and user agent for incident client",
				"cert_file", tlsConfig.CertFile,
				"ca_file", tlsConfig.CAFile,
				"skip_verify", tlsConfig.SkipVerify)
		}
	} else {

		client.HTTPClient.Transport = wrapWithUserAgent(http.DefaultTransport)
	}

	return context.WithValue(ctx, incidentClientKey{}, client)
}

ExtractIncidentClientFromHeaders is a HTTPContextFunc that creates and injects a Grafana Incident client into the context. It uses HTTP headers for configuration with environment variable fallbacks, enabling per-request incident management configuration.

var Version = sync.OnceValue(func() string {

	v := "(devel)"
	if bi, ok := debug.ReadBuildInfo(); ok && bi.Main.Version != "" {
		v = bi.Main.Version
	}
	return v
})

Version returns the version of the mcp-grafana binary. It uses runtime/debug to fetch version information from the build, returning "(devel)" for local development builds. The version is computed once and cached for performance.

Functions

func ComposeHTTPContextFuncs

func ComposeHTTPContextFuncs(funcs ...httpContextFunc) server.HTTPContextFunc

ComposeHTTPContextFuncs composes multiple HTTPContextFuncs into a single one. This enables chaining of context modifications for HTTP transport, allowing modular setup of authentication, clients, and configuration.

func ComposeSSEContextFuncs

func ComposeSSEContextFuncs(funcs ...httpContextFunc) server.SSEContextFunc

ComposeSSEContextFuncs composes multiple SSEContextFuncs into a single one. This enables chaining of context modifications for Server-Sent Events transport, such as extracting headers and setting up clients.

func ComposeStdioContextFuncs

func ComposeStdioContextFuncs(funcs ...server.StdioContextFunc) server.StdioContextFunc

ComposeStdioContextFuncs composes multiple StdioContextFuncs into a single one. Functions are applied in order, allowing each to modify the context before passing it to the next.

func ComposedHTTPContextFunc

func ComposedHTTPContextFunc(config GrafanaConfig) server.HTTPContextFunc

ComposedHTTPContextFunc returns a HTTPContextFunc that comprises all predefined HTTPContextFuncs. It provides the complete context setup for HTTP transport, including header-based authentication and client configuration.

func ComposedSSEContextFunc

func ComposedSSEContextFunc(config GrafanaConfig) server.SSEContextFunc

ComposedSSEContextFunc returns a SSEContextFunc that comprises all predefined SSEContextFuncs. It sets up the complete context for SSE transport, extracting configuration from HTTP headers with environment variable fallbacks.

func ComposedStdioContextFunc

func ComposedStdioContextFunc(config GrafanaConfig) server.StdioContextFunc

ComposedStdioContextFunc returns a StdioContextFunc that comprises all predefined StdioContextFuncs. It sets up the complete context for stdio transport including Grafana configuration, client initialization from environment variables, and incident management support.

func ConvertTool

func ConvertTool[T any, R any](name, description string, toolHandler ToolHandlerFunc[T, R], options ...mcp.ToolOption) (mcp.Tool, server.ToolHandlerFunc, error)

ConvertTool converts a toolHandler function to an MCP Tool and ToolHandlerFunc. The toolHandler must accept a context.Context and a struct with jsonschema tags for parameter documentation. The struct fields define the tool's input schema, while the return value can be a string, struct, or *mcp.CallToolResult. This function automatically generates JSON schema from the struct type and wraps the handler with OpenTelemetry instrumentation.

func GrafanaClientFromContext

func GrafanaClientFromContext(ctx context.Context) *client.GrafanaHTTPAPI

GrafanaClientFromContext retrieves the Grafana client from the context. Returns nil if no client has been set, which tools should handle gracefully with appropriate error messages.

func IncidentClientFromContext

func IncidentClientFromContext(ctx context.Context) *incident.Client

IncidentClientFromContext retrieves the Grafana Incident client from the context. Returns nil if no client has been set, indicating that incident management features are not available.

func MustWithOnBehalfOfAuth

func MustWithOnBehalfOfAuth(ctx context.Context, accessToken, userToken string) context.Context

MustWithOnBehalfOfAuth adds the access and user tokens to the context, panicking if either are empty. This is a convenience wrapper around WithOnBehalfOfAuth for cases where token validation has already occurred.

func NewGrafanaClient

func NewGrafanaClient(ctx context.Context, grafanaURL, apiKey string, auth *url.Userinfo) *client.GrafanaHTTPAPI

NewGrafanaClient creates a Grafana client with the provided URL and API key. The client is automatically configured with the correct HTTP scheme, debug settings from context, custom TLS configuration if present, and OpenTelemetry instrumentation for distributed tracing.

func UserAgent

func UserAgent() string

UserAgent returns the user agent string for HTTP requests. It includes the mcp-grafana identifier and version number for proper request attribution and debugging.

func WithGrafanaClient

func WithGrafanaClient(ctx context.Context, client *client.GrafanaHTTPAPI) context.Context

WithGrafanaClient sets the Grafana client in the context. The client can be retrieved using GrafanaClientFromContext and will be used by all Grafana-related tools in the MCP server.

func WithGrafanaConfig

func WithGrafanaConfig(ctx context.Context, config GrafanaConfig) context.Context

WithGrafanaConfig adds Grafana configuration to the context. This configuration includes API credentials, debug settings, and TLS options that will be used by all Grafana clients created from this context.

func WithIncidentClient

func WithIncidentClient(ctx context.Context, client *incident.Client) context.Context

WithIncidentClient sets the Grafana Incident client in the context. This client is used for managing incidents, activities, and other IRM (Incident Response Management) operations.

func WithOnBehalfOfAuth

func WithOnBehalfOfAuth(ctx context.Context, accessToken, userToken string) (context.Context, error)

WithOnBehalfOfAuth adds the Grafana access token and user token to the Grafana config. These tokens enable on-behalf-of authentication in Grafana Cloud, allowing the MCP server to act on behalf of a specific user with their permissions.

Types

type GrafanaConfig

type GrafanaConfig struct {
	// Debug enables debug mode for the Grafana client.
	Debug bool

	// IncludeArgumentsInSpans enables logging of tool arguments in OpenTelemetry spans.
	// This should only be enabled in non-production environments or when you're certain
	// the arguments don't contain PII. Defaults to false for safety.
	// Note: OpenTelemetry spans are always created for context propagation, but arguments
	// are only included when this flag is enabled.
	IncludeArgumentsInSpans bool

	// URL is the URL of the Grafana instance.
	URL string

	// APIKey is the API key or service account token for the Grafana instance.
	// It may be empty if we are using on-behalf-of auth.
	APIKey string

	// Credentials if user is using basic auth
	BasicAuth *url.Userinfo

	// AccessToken is the Grafana Cloud access policy token used for on-behalf-of auth in Grafana Cloud.
	AccessToken string
	// IDToken is an ID token identifying the user for the current request.
	// It comes from the `X-Grafana-Id` header sent from Grafana to plugin backends.
	// It is used for on-behalf-of auth in Grafana Cloud.
	IDToken string

	// TLSConfig holds TLS configuration for all Grafana clients.
	TLSConfig *TLSConfig
}

GrafanaConfig represents the full configuration for Grafana clients. It includes connection details, authentication credentials, debug settings, and TLS options used throughout the MCP server's lifecycle.

func GrafanaConfigFromContext

func GrafanaConfigFromContext(ctx context.Context) GrafanaConfig

GrafanaConfigFromContext extracts Grafana configuration from the context. If no config is found, returns a zero-value GrafanaConfig. This function is typically used by internal components to access configuration set earlier in the request lifecycle.

type TLSConfig

type TLSConfig struct {
	CertFile   string
	KeyFile    string
	CAFile     string
	SkipVerify bool
}

TLSConfig holds TLS configuration for Grafana clients. It supports mutual TLS authentication with client certificates, custom CA certificates for server verification, and development options like skipping certificate verification.

func (*TLSConfig) CreateTLSConfig

func (tc *TLSConfig) CreateTLSConfig() (*tls.Config, error)

CreateTLSConfig creates a *tls.Config from TLSConfig. It supports client certificates, custom CA certificates, and the option to skip TLS verification for development environments.

func (*TLSConfig) HTTPTransport

func (tc *TLSConfig) HTTPTransport(defaultTransport *http.Transport) (http.RoundTripper, error)

HTTPTransport creates an HTTP transport with custom TLS configuration. It clones the provided transport and applies the TLS settings, preserving other transport configurations like timeouts and connection pools.

type Tool

type Tool struct {
	Tool    mcp.Tool
	Handler server.ToolHandlerFunc
}

Tool represents a tool definition and its handler function for the MCP server. It encapsulates both the tool metadata (name, description, schema) and the function that executes when the tool is called. The simplest way to create a Tool is to use MustTool for compile-time tool creation, or ConvertTool if you need runtime tool creation with proper error handling.

func MustTool

func MustTool[T any, R any](
	name, description string,
	toolHandler ToolHandlerFunc[T, R],
	options ...mcp.ToolOption,
) Tool

MustTool creates a new Tool from the given name, description, and toolHandler. It panics if the tool cannot be created, making it suitable for compile-time tool definitions where creation errors indicate programming mistakes.

func (*Tool) Register

func (t *Tool) Register(mcp *server.MCPServer)

Register adds the Tool to the given MCPServer. It is a convenience method that calls server.MCPServer.AddTool with the Tool's metadata and handler, allowing fluent tool registration in a single statement:

mcpgrafana.MustTool(name, description, toolHandler).Register(server)

type ToolHandlerFunc

type ToolHandlerFunc[T any, R any] = func(ctx context.Context, request T) (R, error)

ToolHandlerFunc is the type of a handler function for a tool. T is the request parameter type (must be a struct with jsonschema tags), and R is the response type which can be a string, struct, or *mcp.CallToolResult.

type UserAgentTransport

type UserAgentTransport struct {
	UserAgent string
	// contains filtered or unexported fields
}

UserAgentTransport wraps an http.RoundTripper to add a custom User-Agent header. This ensures all HTTP requests from the MCP server are properly identified with version information for debugging and analytics.

func NewUserAgentTransport

func NewUserAgentTransport(rt http.RoundTripper, userAgent ...string) *UserAgentTransport

NewUserAgentTransport creates a new UserAgentTransport with the specified user agent. If no user agent is provided, it uses the default UserAgent() with version information. The transport wraps the provided RoundTripper, defaulting to http.DefaultTransport if nil.

func (*UserAgentTransport) RoundTrip

func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error)