> mcp integration
Grafana MCP Server: What It Does & How to Use It with Claude
What the Grafana MCP server does: query metrics and logs, search dashboards, manage alerts and incidents, and connect it to Claude Cowork, Code, or Desktop.
The Grafana MCP server lets an AI assistant read and act on your Grafana instance: running PromQL and LogQL queries, searching dashboards, and inspecting alerts and incidents without you leaving the chat. It is an official, open-source server from Grafana that connects to any MCP client, including Claude Cowork, Claude Code, and Claude Desktop.
What can the Grafana MCP server do?
The official server (grafana/mcp-grafana) groups its tools by category. You can enable or disable each category, so the assistant only sees what you allow.
| Capability | What it enables |
|---|---|
| Dashboards | Search dashboards, fetch summaries, extract panel queries and properties, and update or patch dashboard JSON. |
| Datasources | List configured datasources and retrieve their details. |
| Prometheus | Run PromQL queries (instant and range), pull metric metadata, and calculate histogram percentiles. |
| Loki | Run LogQL queries, list labels and label values, and detect log patterns. |
| Alerting | List and inspect alert rules and notification routing. |
| Incidents | Search, create, and manage incidents in Grafana Incident. |
| OnCall | View schedules, shifts, teams, users, and alert groups. |
| Sift | Run investigations to detect error patterns and slow requests. |
| Navigation | Generate deeplinks to dashboards, panels, and Explore queries. |
| Annotations | Get, create, and update dashboard annotations. |
| Rendering | Export dashboard and panel images as PNG. |
| Admin | Manage teams, users, roles, and permissions. |
Additional datasource tooling for ClickHouse, CloudWatch, Elasticsearch, InfluxDB, and others ships disabled by default and can be turned on with the --enabled-tools flag when you need it.
Is there an official Grafana MCP server?
Yes, and unlike many tools, you do not have to fall back on a community fork. Grafana ships and maintains grafana/mcp-grafana under the Apache 2.0 license, with docs hosted in the official Grafana developer resources. That is the right default. Community servers exist (for example dashboard-focused forks), but the official server already covers metrics, logs, dashboards, alerting, incidents, and OnCall, so reach for a third-party option only if you have a narrow need the official one does not cover.
How do you connect it to Claude (Cowork / Code / Desktop)?
- In Grafana, create a service account and generate a token. Grafana 9.0 or later is required for full functionality.
- Install the server. The recommended path is
uvx mcp-grafana(needs theuvpackage manager); a Docker image (grafana/mcp-grafana) and binary releases are also published. - Add it to your MCP client config:
{
"mcpServers": {
"grafana": {
"command": "uvx",
"args": ["mcp-grafana"],
"env": {
"GRAFANA_URL": "https://your-instance.grafana.net",
"GRAFANA_SERVICE_ACCOUNT_TOKEN": "<token>"
}
}
}
}
- Start read-only. Pass
--disable-writeso the assistant can query and inspect but not modify dashboards or create incidents until you trust it. For HTTP-based clients, the server also supports SSE and streamable-HTTP transports instead of stdio.
How we use it: good for letting an assistant triage an incident (“pull the error rate from this Prometheus datasource over the last hour and link me the dashboard panel”) and for drafting LogQL it would otherwise take three Explore tabs to write. Bad for blind dashboard edits: the patch tools work, but JSON dashboards are easy to corrupt and you want a human reviewing the diff. One real gotcha: tools fail silently or partially if the service account lacks the right RBAC permission for that category, so a missing OnCall or alerting scope looks like “the tool doesn’t exist” rather than a clear error. Check the service account before you debug the prompt.
How do you keep it secure?
Scope the service account to exactly the categories you enable, start with --disable-write for read-only access, and keep the token in env vars, not committed config. Disabling whole tool categories (for example --disable-oncall) is the cleanest way to limit blast radius.
Wiring Grafana into your stack
Hooking Grafana into an assistant is rarely the hard part. Getting it to query the right datasource, respect RBAC, and stay read-only where it should is. If you want a setup that an on-call engineer can trust, we can help you wire it up safely alongside your other MCP integrations. Book a discovery call.
Sources: grafana/mcp-grafana · Grafana MCP server docs · Enable and disable tools