Grafana MCP Server

Official

Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.

Local serverstdiossestreamable-httpGoApache-2.0 1.7k

What is the Grafana MCP server?

The Grafana MCP server (maintained by Grafana Labs, written in Go) connects assistants to the observability stack most infrastructure teams already run: dashboards, datasources, Prometheus metrics, Loki logs, alert rules, and Grafana's incident and OnCall tooling.

Its defining capability is query without query-language fluency. PromQL and LogQL are powerful and nobody's favourite; being able to ask "what's the p95 latency on the API over the last six hours?" or "show error-level logs from the payments service around 14:30" and have correct queries generated, executed and interpreted lowers the barrier to data most teams underuse. The assistant handles rate windows, label matchers and histogram quantiles — the parts humans get subtly wrong.

Incident workflows benefit next. During an investigation the assistant can pull the relevant dashboard panels, correlate a metric spike with matching log lines, check which alerts fired and when, and draft the incident timeline — the toil half of incident response, automated where it's most resented. Alert-rule management and on-call schedule queries round out the operational surface.

It runs as a local binary/Docker container against any Grafana instance (Cloud or self-hosted) with a service-account token, and tool categories can be disabled selectively — a nice touch when you want read-only observability without alert-editing capability. For teams whose single pane of glass is Grafana, this makes that pane conversational.

Tuning the connection

  • Service-account tokens (glsa_) inherit a Grafana role. A Viewer token still answers dashboard, Prometheus and Loki questions while being unable to edit an alert rule — the sensible starting posture.
  • Wide time ranges are the usual cause of a slow or failed Loki call. Narrowing to a suspected window first is what makes log questions reliably answerable.
  • Per-category flags such as --disable-alerting or --disable-oncall trim the tool surface. The full set spans dashboards, alerting, Incident, OnCall, Pyroscope and Sift, which is a lot to carry if you only came for metrics.
  • Ask it to print the generated PromQL next to the answer. Checking the rate window and label matchers takes seconds and catches the quiet mistakes that still return a plausible number.

What you can do with it

PromQL/LogQL without the syntax

Metrics and log questions in English, correct queries underneath.

Incident correlation

Spikes, logs and alert timings pulled together into a coherent story.

Alert hygiene

Which rules exist, which fire noisily, which silences are stale — audited by asking.

Available tools

ToolWhat it does
search_dashboards / get_dashboard_by_uidFind and read dashboards
query_prometheusRun PromQL queries against Prometheus datasources
query_loki_logsRun LogQL queries against Loki
list_alert_rules / get_alert_rule_by_uidInspect alerting rules and states
list_incidents / create_incidentGrafana Incident workflows
list_datasourcesEnumerate configured datasources
get_current_oncall_usersWho's on call right now (OnCall)

How to install the Grafana MCP server

{
  "mcpServers": {
    "grafana": {
      "command": "docker",
      "args": ["run", "--rm", "-i",
               "-e", "GRAFANA_URL", "-e", "GRAFANA_SERVICE_ACCOUNT_TOKEN",
               "mcp/grafana", "-t", "stdio"],
      "env": {
        "GRAFANA_URL": "https://your-org.grafana.net",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "glsa_your_token"
      }
    }
  }
}

Create a service account token in Grafana with the viewer/editor roles you're comfortable delegating.

Configuration

A Grafana instance (Cloud or self-hosted) and a service-account token. Binary or Docker to run the server.

VariableDescriptionRequired
GRAFANA_URLYour Grafana instance URLe.g. https://your-org.grafana.netYes
GRAFANA_SERVICE_ACCOUNT_TOKENService-account token with appropriate rolese.g. glsa_...Yes

Example prompts to try

  • What's the p95 latency for the API service over the last 6 hours? Any correlated error spike?
  • Show error logs from the payments namespace around 14:30 UTC and summarise the pattern.
  • Which alert rules fired in the last 24 hours, and who's on call now?

Frequently asked questions

Both — point GRAFANA_URL at either. Capabilities follow what your instance has enabled (Incident and OnCall tools require those products).