Grafana MCP server: setup, auth, production
Last verified: June 2026· Grafana MCP integration
Community MCP servers existDashboards and alerting over your metrics and logs.
What is the Grafana MCP server?
A Grafana MCP server implements the Model Context Protocol and exposes Grafana's capabilities as typed tools an agent can discover and call in the middle of a task. Dashboards and alerting over your metrics and logs.
Observability systems are the highest-value, lowest-risk first MCP connection: an agent that can read your metrics, traces, and logs debugs alongside you instead of asking you to paste graphs. Keep it strictly read-only and the blast radius is near zero.
A real Grafana workflow
You describe a symptom in plain English; the agent finds the dashboards already alerting, pulls the relevant panel data, and reasons about which datasource explains the regression — turning a scramble across tabs into one answer.
What an agent can do with Grafana
- Ask which dashboards are alerting right now
- Pull panel data to reason about a regression
- Generate a query for a metric you describe in plain English
Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.
Setting up the Grafana MCP server
Provision a Grafana service account with the Viewer role. The subtlety is datasource credentials: the service account can query datasources it shouldn’t necessarily expose, so review its datasource access, not just its Grafana role.
Auth: Grafana service-account token with viewer role. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.
The risk to watch with Grafana
A Viewer role in Grafana can still reach production datasources behind panels. Audit which datasources the service account can query, not just what it can see in the UI.
More broadly, a production-grade Grafana integration needs read-only service accounts and safe handling of datasource credentials. The MCP security checklist applies to every integration — we build servers with these controls baked in.
Troubleshooting
If the Grafana tools don't appear after setup, it's almost always auth or transport. See MCP server not connecting for the step-by-step fix — and note that hosted servers often need OAuth, not a plain API key. To understand how MCP relates to ordinary tool use, see MCP vs function calling.
Frequently asked questions
Is there an official MCP server for Grafana?
Community MCP servers exist. Whichever you use, a production setup needs read-only service accounts and safe handling of datasource credentials.
How does authentication work for Grafana over MCP?
Grafana service-account token with viewer role. Credentials should never live in the sandbox or the repo; route them through your client's secret handling or a vaulted credential.
What can an agent actually do with Grafana?
Ask which dashboards are alerting right now; Pull panel data to reason about a regression; Generate a query for a metric you describe in plain English. Start read-only and add write access deliberately, behind audit logging.
Is it safe to give agents access to Grafana?
Yes, when scoped correctly: least-privilege credentials, read-only by default, audit logs on every call, and human approval for any high-impact action. Read-only service accounts and safe handling of datasource credentials.