mcp-grafana for Grafana: safety score
B 76 Provisional Not reviewed Not tested
mcp-grafana is a vendor MCP server for Grafana with 65 read, 13 write and 8 destructive tools. It does not have a read-only mode and needs to run as a remote MCP endpoint and a secret in an environment variable; its provisional OpsMCP grade is B (76%), last checked 16 Oct 2026.
An MCP server giving access to Grafana dashboards, data and more.
Tool capability partly scored. Access partly scored. 2 of 4 factors scored.
Can it change or delete things?
Yes. The extracted tools include at least one destructive tool, so it can change or delete things.
| Tool | Class |
|---|---|
add_activity_to_incident Add a note (userNote activity) to an existing incident's timeline using its ID. The note body can include URLs which will be attached as context. Use this to add context to an incident.
from the name (add) | Write |
analyze_loki_labels annotation disagrees Audits a Loki label strategy and optionally diagnoses query performance. Returns per-label verdicts, missing base labels, normalisation issues, and a recommended set. Pass datasourceUid for live cardinality or labels for static scoring; both may be combined.
from the description (set) | Write |
check_datasources_health annotation disagrees Check datasource health. Filter by type or UIDs; omit both to check all.
from the name | Unknown |
create_annotation Create a new annotation on a dashboard or panel. Set format to 'graphite' and provide 'what' for Graphite-format annotations.
from the name (create) | Write |
create_datasource Create a datasource in two steps. Called with only the type, it returns the plugin's field schema and creates nothing. Called with the type, the display name in the top-level name argument, schemaReviewed=true, and field values in the fields map, it creates the datasource. The...
from the name (create) | Write |
create_incident Create a new Grafana incident. Requires title, severity, and room prefix. Allows setting status, labels and custom fields. Creating an incident may notify or page many people.
from the name (create) | Write |
create_snapshot Create a Grafana snapshot from a full dashboard payload. Supports optional expiration and external snapshot fields.
from the name (create) | Write |
delete_annotation Permanently delete an annotation by ID. The annotation cannot be recovered afterwards.
from the name (delete) | Destructive |
delete_snapshot Delete a Grafana snapshot by snapshot key.
from the name (delete) | Destructive |
describe_sql_table Get column schema for a table in a supported SQL datasource (ClickHouse, Snowflake, Athena, MySQL, PostgreSQL, MSSQL). Returns column names and types.
from the description (get) | Read |
diff_tempo_traces annotation disagrees Compare two complete traces. Returns a compact summary and includes the full span-level patch when it is at most 64 KiB. Request trace-patch-v0 only when full details are required; full patches are not size-bounded.
from the name | Unknown |
generate_deeplink Generate deeplink URLs for Grafana resources. Supports dashboards (requires dashboardUid or provisioningPreview), panels (requires dashboardUid or provisioningPreview, plus panelId), and Explore queries (requires datasourceUid and optionally queries). For dashboard and panel l...
from the description (set) | Write |
get_alert_group Get a specific alert group from Grafana OnCall by its ID. Returns the full alert group details, including the most recent alert and its raw payload when the OnCall API provides them. Alert payloads carry integration-specific fingerprints (for example Sentry's payload.data.even...
from the name (get) | Read |
get_annotation_tags Returns annotation tags with optional filtering by tag name. Only the provided filters are applied.
from the name (get) | Read |
get_annotations Fetch Grafana annotations using filters such as dashboard UID, time range and tags.
from the name (get) | Read |
get_assertions Get assertion summary for a given entity with its type, name, env, site, namespace, and a time range
from the name (get) | Read |
get_current_oncall_users Get the list of users currently on-call for a specific Grafana OnCall schedule ID. Returns the schedule ID, name, and a list of detailed user objects for those currently on call.
from the name (get) | Read |
get_dashboard_by_uid Retrieves the complete dashboard, including panels, variables, and settings, for a specific dashboard identified by its UID. Pass optional version to load a saved snapshot instead of the current dashboard. Saved snapshots are fetched through Grafana's legacy versions API, so '...
from the name (get) | Read |
get_dashboard_panel_queries Retrieve panel queries from a Grafana dashboard. Supports all datasource types (Prometheus, Loki, CloudWatch, SQL, etc.) and row-nested panels. Optionally filter to a specific panel by ID with `panelId`. Optionally provide `variables` for template variable substitution, which ...
from the name (get) | Read |
get_dashboard_property Get specific parts of a dashboard using JSONPath expressions to minimize context window usage. JSONPath targets the dashboard's native schema. Classic v1 paths: '$.title' (title), '$.panels[*].title' (all panel titles), '$.panels[0]' (first panel), '$.templating.list' (variabl...
from the name (get) | Read |
get_dashboard_summary Get a compact summary of a dashboard including title, panel count, panel types, variables, and other metadata without the full JSON. Use this for dashboard overview and planning modifications without consuming large context windows.
from the name (get) | Read |
get_datasource Retrieves detailed information about a specific datasource by UID or name. Returns the full datasource model, including name, type, URL, access settings, JSON data, and secure JSON field status. Provide either uid or name; uid takes priority if both are given.
from the name (get) | Read |
get_doc Fetch a Grafana documentation page. Set outline_only=true to get the heading structure first, then call again with a section name for bounded retrieval.
from the name (get) | Read |
get_incident Get a single incident by ID. Returns the full incident details including title, status, severity, labels, custom fields, timestamps, and other metadata.
from the name (get) | Read |
get_oncall_shift Get detailed information for a specific Grafana OnCall shift using its ID. A shift represents a designated time period within a schedule when users are actively on-call. Returns the full shift details.
from the name (get) | Read |
get_panel_image Render a Grafana dashboard panel, full dashboard or Explore view as a PNG image. Returns the image as base64 encoded data. Requires the Grafana Image Renderer service to be installed.
from the name (get) | Read |
get_plugin Check whether a Grafana plugin is installed and retrieve its details (name, version, type, enabled status). Returns installed=false when the plugin is not found.
from the name (get) | Read |
get_query_examples Get example queries for a specific datasource type. Provides sample queries with descriptions for Prometheus (PromQL), Loki (LogQL), ClickHouse (SQL with Grafana macros), CloudWatch (metric configurations), and InfluxDB (Flux and InfluxQL). Use this to understand query syntax ...
from the name (get) | Read |
get_resource_description List available permissions and assignment capabilities for a Grafana resource type.
from the name (get) | Read |
get_resource_permissions List all permissions set on a specific Grafana resource (e.g., dashboard, datasource, folder) by its type and ID.
from the name (get) | Read |
get_role_assignments List all assignments for a specific role, showing which users, teams, and service accounts have been assigned this role.
from the name (get) | Read |
get_role_details Get detailed information about a specific Grafana role by its UID, including permissions, metadata, and configuration.
from the name (get) | Read |
get_snapshot Get a Grafana snapshot by key, including snapshot metadata and dashboard payload.
from the name (get) | Read |
get_tempo_trace Retrieve a specific trace by ID
from the name (get) | Read |
get_tempo_traceql_docs Retrieve TraceQL reference documentation with examples, covering attribute filters, aggregates, structural operators, and metrics queries. Consult this before writing a non-trivial TraceQL query, or after one returns an error or no results.
from the name (get) | Read |
grafana_api_request annotation disagrees Make an authenticated HTTP request to the Grafana API. Similar to 'gh api' for GitHub.
from the name | Unknown |
install_plugin Install a Grafana plugin by its plugin ID. When version is omitted, the tool looks up the latest version and returns it without installing; supplying a version installs that version.
from the name | Unknown |
list_alert_groups List alert groups from Grafana OnCall with filtering options. Supports filtering by alert group ID, route ID, integration ID, state (new, acknowledged, resolved, silenced), team ID, time range, labels, and name. For time ranges, use format '{start}_{end}' ISO 8601 timestamp ra...
from the name (list) | Read |
list_all_roles List all roles in Grafana. Optionally filter to show only roles that can be delegated by the current user. Returns role details including UID, name, permissions, and metadata.
from the name (list) | Read |
list_cloud_logging_buckets List the log buckets in a GCP project, as '<location>/buckets/<name>' (e.g. global/buckets/_Default). Each value is a valid bucketId as-is.
from the name (list) | Read |
list_cloud_logging_projects List the GCP project IDs the Google Cloud Logging datasource's credentials can read logs from (at most 100; 'query' narrows the list).
from the name (list) | Read |
list_cloud_logging_views List the log views in a log bucket (e.g. _AllLogs, _Default). Each value is a valid viewId for the same bucketId.
from the name (list) | Read |
list_cloudwatch_dimension_values List values for a CloudWatch dimension key (e.g. the specific cluster names behind a ClusterName dimension). Requires region. Supports cross-account monitoring via optional accountId parameter.
from the name (list) | Read |
list_cloudwatch_dimensions List dimension keys for a CloudWatch metric. Requires region. Supports cross-account monitoring via optional accountId parameter.
from the name (list) | Read |
list_cloudwatch_metrics List metrics for a CloudWatch namespace. Requires region. Supports cross-account monitoring via optional accountId parameter.
from the name (list) | Read |
list_cloudwatch_namespaces List available CloudWatch namespaces (AWS/EC2, AWS/ECS, AWS/RDS, etc.). Requires region. Supports cross-account monitoring via optional accountId parameter.
from the name (list) | Read |
list_dashboard_versions List saved versions of a Grafana dashboard. Returns compact metadata: version number, author, timestamp, and save message. A version number can be passed to the dashboard fetch to load that snapshot.
from the name (list) | Read |
list_datasources List all configured datasources in Grafana. Use this to discover available datasources and their UIDs. Supports filtering by type and/or name (case-insensitive substring match) and pagination.
from the name (list) | Read |
list_graphite_metrics Discover available metric paths in a Graphite datasource by browsing the metric tree. Returns nodes matching the query pattern, each indicating whether it is a leaf metric (has data) or an expandable branch (has children). Use '*' as a wildcard at any level to enumerate the tr...
from the name (list) | Read |
list_graphite_tags List available tag names in a Graphite datasource that uses tag-based metrics. Returns a list of tag name strings (e.g. ["name", "env", "region"]). These tags can be used to build tag-based target expressions (e.g. seriesByTag('name=cpu.load,env=prod')). Optionally filter by a...
from the name (list) | Read |
list_incident_custom_fields List the custom fields configured for Grafana incidents, including their type and, for select fields, the options that may be chosen.
from the name (list) | Read |
list_incidents List Grafana incidents. Allows filtering by status ('active', 'resolved') and optionally including drill incidents. Returns a preview list with basic details, and custom field values if requested.
from the name (list) | Read |
list_loki_label_names Lists all available label/field names (keys) found in logs within a specified Loki or VictoriaLogs datasource and time range. Returns a list of unique label strings (e.g., `["app", "env", "pod"]`). If the time range is not provided, it defaults to the last hour. Optionally nar...
from the name (list) | Read |
list_loki_label_values Retrieves all unique values associated with a specific `labelName` within a Loki or VictoriaLogs datasource and time range. Returns a list of string values (e.g., for `labelName="env"`, might return `["prod", "staging", "dev"]`). Useful for discovering filter options. Defaults...
from the name (list) | Read |
list_oncall_schedules List Grafana OnCall schedules, optionally filtering by team ID. If a specific schedule ID is provided, retrieves details for only that schedule. Returns a list of schedule summaries including ID, name, team ID, timezone, and shift IDs. Supports pagination.
from the name (list) | Read |
list_oncall_teams List teams configured in Grafana OnCall. Returns a list of team objects with their details. Supports pagination.
from the name (list) | Read |
list_oncall_users List users from Grafana OnCall. These are OnCall users (separate from Grafana users). Can retrieve all users in the OnCall directory, a specific user by ID, or filter by username. Returns a list of user objects with their details. Supports pagination.
from the name (list) | Read |
list_prometheus_label_names List label names in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Allows filtering by series selectors and time range.
from the name (list) | Read |
list_prometheus_label_values Gets the values for a specific label name in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Allows filtering by series selectors and time range.
from the name (list) | Read |
list_prometheus_metric_metadata List Prometheus metric metadata. Returns metadata about metrics currently scraped from targets. Note: This endpoint is experimental.
from the name (list) | Read |
list_prometheus_metric_names Lists metric names in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Filters metric names using the provided regex. Supports pagination (page * limit must not exceed 10000) and an optional time range to restrict results to metrics active wi...
from the name (list) | Read |
list_provisioning_repositories List provisioning repositories (e.g. git-sync sources) configured for this Grafana instance.
from the name (list) | Read |
list_snapshots List Grafana dashboard snapshots with optional query and result limit filters.
from the name (list) | Read |
list_sql_databases List databases, schemas, or catalogs from a supported SQL datasource. Returns the organizational units (databases, schemas, or catalogs) that contain tables. For Athena: omit catalog to list catalogs, or pass catalog to list databases in it.
from the name (list) | Read |
list_sql_tables List tables from a supported SQL datasource (ClickHouse, Snowflake, Athena, MySQL, PostgreSQL, MSSQL). Returns table names, schemas, and metadata.
from the name (list) | Read |
list_team_roles List all roles assigned to one or more teams. Returns a map of team IDs to their assigned roles.
from the name (list) | Read |
list_teams Search for Grafana teams by a query string. Returns a list of matching teams with details like name, ID, and URL.
from the name (list) | Read |
list_tempo_attribute_names List available attribute names for TraceQL queries. Without a scope (resource, span, etc.) the response can be very large.
from the name (list) | Read |
list_tempo_attribute_values List values for a fully scoped attribute name (e.g. resource.service.name). Useful for discovering what values exist for a specific attribute.
from the name (list) | Read |
list_user_roles List all roles assigned to one or more users. Returns a map of user IDs to their assigned roles, excluding built-in roles and team-inherited roles.
from the name (list) | Read |
list_users_by_org List users in the Grafana organization, optionally filtered by a search query. Results are paginated; the response includes totalCount, page and perPage alongside organization users with details like userid, email, role etc.
from the name (list) | Read |
query_elasticsearch Executes a search query against an Elasticsearch or OpenSearch datasource and retrieves matching documents. Supports Lucene query syntax (e.g., 'status:200 AND host:server1') for both Elasticsearch and OpenSearch. Elasticsearch Query DSL JSON is also supported for Elasticsearc...
from the description (executes) | Destructive |
query_graphite Executes a Graphite render API query against a Graphite datasource and returns matching metric series with their datapoints. Supports the full Graphite target expression language including wildcard patterns (e.g. 'servers.web*.cpu.load5'), aggregation functions (e.g. 'sumSerie...
from the description (executes) | Destructive |
query_graphite_density Analyses metric data density for one or more Graphite series over a time window.
from the name | Unknown |
query_loki_logs Executes a log query against a Loki or VictoriaLogs datasource and returns matching log entries (or metric samples on Loki). Defaults to the last hour, a limit of 10 entries, and 'backward' direction (newest first). The `logql` parameter takes LogQL on Loki and LogsQL on Victo...
from the description (executes) | Destructive |
query_loki_patterns Retrieves detected log patterns from a Loki datasource for a given stream selector and time range. Returns a list of patterns, each containing a pattern string and a total count of occurrences. Patterns help identify common log structures and anomalies. The `logql` parameter m...
from the description (list) | Read |
query_loki_stats Retrieves index-level statistics about log streams matching a given selector within a Loki or VictoriaLogs datasource and time range. Returns an object containing the count of streams, chunks, entries, and total bytes (e.g., `{"streams": 5, "chunks": 50, "entries": 10000, "byt...
from the name | Unknown |
query_prometheus Query a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.) using a PromQL expression. Supports instant queries (single point) and range queries (time range). Time: RFC3339 or relative expressions like 'now', 'now-1h'.
from the name | Unknown |
query_quickwit Executes a search query against a Quickwit datasource and retrieves matching documents. Supports Lucene query syntax (e.g., 'severity_text:ERROR AND service_name:api') and partial Elasticsearch-compatible Query DSL JSON. The timestamp field is resolved from Quickwit index meta...
from the description (executes) | Destructive |
query_tempo_metrics annotation disagrees Compute trace-derived metrics using a TraceQL metrics query. The syntax is unlike PromQL. Use type 'instant' for a single value or 'range' for a time series (default). Instant queries over large time ranges may timeout — keep the window under 15 minutes for instant, or use ran...
from the name | Unknown |
run_panel_query Executes one or more dashboard panel queries with optional time range and variable overrides. Accepts an array of panel IDs to query in a single call. Fetches the dashboard, extracts queries from the specified panels, substitutes template variables and Grafana macros ($__range...
from the name (run) | Destructive |
search_dashboards Search Grafana dashboards by query and/or folderUid, tag, and starred. Returns matching dashboards with title, UID, folder, tags, and URL.
from the name (search) | Read |
search_docs Search Grafana documentation. Returns matching pages with title, URL, description, and product. Call with no query to list available product groups.
from the name (search) | Read |
search_folders Search for Grafana folders by a query string. Returns matching folders with details like title, UID, and URL.
from the name (search) | Read |
search_plugin_information Search the Grafana plugin catalog by keyword, purpose, or partial name (e.g. 'azure monitoring', 'loki', 'database').
from the name (search) | Read |
search_tempo_traces Search for traces using TraceQL queries
from the name (search) | Read |
suggest_loki_alloy_label_config annotation disagrees Generates an Alloy loki.process snippet enforcing an approved label set via stage.label_keep, with optional log-level normalisation and soft-enforcement placeholders.
from the description (set) | Write |
update_alert_group Update the state of a Grafana OnCall alert group: acknowledge, unacknowledge, resolve, or unresolve it by ID. Returns the alert group's resulting OnCall state (one of new, acknowledged, resolved, silenced), or a stateWarning explaining why that state could not be read back aft...
from the name (update) | Write |
update_annotation annotation disagrees Updates the provided properties of an annotation by ID. Only fields included in the request are modified; omitted fields are left unchanged.
from the name (update) | Write |
update_dashboard Create or update a dashboard. Returns the saved dashboard UID and dashboard link in the 'url' field, using the instance public URL when available. Two modes: (1) Full JSON — provide 'dashboard' for new dashboards or complete replacements. (2) Patch — provide 'uid' + 'operation...
from the name (update) | Write |
update_datasource Update non-secret datasource fields by UID in two steps. Called with only the uid, it returns the datasource's field schema and changes nothing. Called with the uid, schemaReviewed=true, and the changed values in the fields map, it applies the update. Omitted fields are preser...
from the name (update) | Write |
update_incident Update an existing Grafana incident by ID. Allows changing the status ('active' or 'resolved'), the severity, the title, and custom field values. Only the provided fields are changed. Use this to resolve an incident, to correct its severity or title, or to fill in custom field...
from the name (update) | Write |
user_info Get information about the current Grafana identity: login, email, name, whether it is a Grafana (server) admin, the current organization, and the organizations it can access (with roles). Call this to discover which orgId values are valid before targeting a specific organizati...
from the description (get) | Read |
validate_provisioning_file Validate a file in a provisioning repository at a given branch or commit by dry-run applying it.
from the description (run) | Destructive |
Score
76 of 100 points (76%). A factor that was not scored counts as 0 of its full weight.
| Factor | Points | Full weight | Status |
|---|---|---|---|
| Tool capability | 27 | 35 | Partly scored |
| Access | 9 | 25 | Partly scored |
| Maintenance | 20 | 20 | Scored |
| Publisher | 20 | 20 | Scored |
Tool capability
65 read, 13 write, 8 destructive, 8 unknown.
Access
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Scope | unknown | unknown | unknown |
| Where it runs | Remote MCP endpoint | 3 of 8 | Registry lists remote transport: streamable-http. |
| Credentials | Secret in an environment variable | 6 of 7 | Registry marked isSecret true for GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_PASSWORD |
Maintenance
| Part | Value | Points |
|---|---|---|
| Last commit | 2 days | 8 of 8 |
| Releases | 8 days | 6 of 6 |
| Issues | 300 closed / 359 issues (0.84) | 6 of 6 |
Publisher
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Who publishes it | Official vendor | 8 of 8 | GitHub owner 'grafana' is on the vendor allowlist (Grafana Labs). |
| Registry listing | Listed | 5 of 5 | Official registry server io.github.grafana/mcp-grafana (status active). |
| License | Apache-2.0 | 4 of 4 | GitHub SPDX license Apache-2.0. |
| Stars | 3569 | 2 of 2 | 3569 GitHub stars. |
| Repository age | 661 days | 1 of 1 | Repository created 2024-12-24T15:44:23Z. |
What this score does not cover
This score is not a code audit and it is not a human review. It has not been hands-on tested. Nothing on this page is a certification.
Access needed
| Variable | Required | Secret | Default | Description |
|---|---|---|---|---|
GRAFANA_URL | yes | unknown | unset | URL to your Grafana instance |
GRAFANA_SERVICE_ACCOUNT_TOKEN | unknown | yes | unset | Service account token used to authenticate with your Grafana instance |
GRAFANA_USERNAME | unknown | unknown | unset | Username to authenticate with your Grafana instance |
GRAFANA_PASSWORD | unknown | yes | unset | Password to authenticate with your Grafana instance |
GRAFANA_ORG_ID | unknown | unknown | unset | Organization ID for multi-org support. Can also be set via X-Grafana-Org-Id header in SSE/streamable HTTP transports. |
GRAFANA_EXTRA_HEADERS | unknown | unknown | unset | JSON object of additional HTTP headers to send with all Grafana API requests |
GRAFANA_FORWARD_HEADERS | unknown | unknown | unset | Comma-separated list of HTTP header names to forward from the incoming request to Grafana (SSE/streamable-http only). Example: Cookie,X-Session-Id |
Remote MCP endpoints: streamable-http https://mcp.grafana.com/mcp
Maintenance
- Archived
- no
- Last commit
- 14 Oct 2026 · 5ea0cc3
- Latest release
- v2.0.2 · 7 Oct 2026
- Issues
- 59 open · 300 closed
- Stars
- 3,569
- License
- Apache-2.0
- Repository created
- 24 Dec 2024
npm and PyPI
- npm
- No npm package in the registry entry.
- PyPI
- No PyPI package in the registry entry.
- Maintainers
- unknown
Install
# requires GRAFANA_URL: URL to your Grafana instance
docker run docker.io/grafana/mcp-grafana:2.0.2Other Grafana servers
Badge
Sources for this listing
registry:grafanagithub:grafana mcp in:name