MCP server Official

Grafana MCP Server

Official Grafana MCP server: dashboards, datasources, Prometheus, Loki, alerting, incidents and more for AI agents.

Author: Grafana Labs
Works with: Any MCP client, Cursor
License: Apache-2.0
Last release: Oct 1, 2026
Documented: Oct 2, 2026

What Grafana MCP Server is

A Model Context Protocol server for Grafana, giving access to your Grafana instance and the surrounding ecosystem. It runs via uvx, Docker, binary or Helm and authenticates with a service account token. Tool categories can be disabled individually, and a read-only mode is available.

What it does

Where Grafana MCP Server runs and what it adds, from its documentation

Search, summarize, patch and create dashboards
List and query datasources (Prometheus, Loki, ClickHouse, CloudWatch, Elasticsearch and others)
Work with alerting, incidents and OnCall
Generate navigation deeplinks for Grafana resources
Disable tool categories with --disable- flags

When to use it

Good fit

You want an agent to investigate dashboards, metrics and logs in Grafana
You need a read-only observability assistant (--disable-write)
You use Grafana Cloud or self-hosted Grafana 9.0+

Not for

Grafana older than 9.0 (some features may not work)

How to install Grafana MCP Server

You need: uv for the uvx install; Grafana 9.0 or later; A Grafana service account token

Install uv
Create a Grafana service account token
Add the server to your MCP client config with command uvx and args mcp-grafana
Set GRAFANA_URL and GRAFANA_SERVICE_ACCOUNT_TOKEN
Optionally use Docker, binary or Helm per the Usage section

Configuration example (from the official docs)

{
  "mcpServers": {
    "grafana": {
      "command": "uvx",
      "args": ["mcp-grafana"],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

Permissions and security

What it can access

Each tool needs specific Grafana RBAC permissions of the service account
Write tools can modify dashboards and other resources unless --disable-write is set

Security notes from the maintainers

README advises least-privilege RBAC scopes for the service account (Editor role is broader than needed)
For SSE/streamable-http on non-loopback addresses, set --server-auth-token and use TLS

Review the source before granting an agent access to credentials or production systems. We document what the maintainers state; we do not audit code.