Grafana MCP server

Grafana MCP server is the Grafana Labs-maintained Model Context Protocol bridge for dashboards, data sources, metrics, logs, alerts, incidents, and related observability objects. It can help developers diagnose production issues and platform teams inspect dashboards or coordinate response workflows. The real security boundary remains Grafana RBAC, the service-account credential, and the deployment network: begin with a least-privilege identity and a read-only or query-free tool set instead of granting a broad Editor role.

Prefer the README's uvx and STDIO path. Create a narrowly scoped Grafana service-account token first, then place GRAFANA_URL and the token in the client's environment configuration. Start with --disable-write and add --disable-query or category filters when the initial workflow needs even less access.

Help me connect Grafana MCP server safely. Project: https://github.com/grafana/mcp-grafana. First read README.md, CHANGELOG.md, LICENSE, Grafana's organization SECURITY.md, server.json, and the latest v1.3.0 release, then confirm the target is Grafana 9.0+. Prefer the README's uvx + STDIO configuration. Do not overwrite existing MCP settings or put credentials in chat, logs, or version control. Ask me for the target GRAFANA_URL and guide me to create a purpose-specific, least-privilege Grafana service-account token. Start with --disable-write and add --disable-query when metadata discovery is enough. Ask before downloading dependencies, making external requests, expanding Grafana RBAC, enabling write or query tools, forwarding headers, exposing SSE/HTTP listeners, weakening TLS, or enabling detailed debug logs. Verify the handshake, tool list, and user_info first, then read only a test dashboard summary; do not perform the first write against production objects.

{
  "mcpServers": {
    "grafana": {
      "command": "uvx",
      "args": ["mcp-grafana"],
      "env": {
        "GRAFANA_URL": "http://localhost:3000",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "<your service account token>"
      }
    }
  }
}

1. 1
   Define the data and action boundary

   List the organizations, folders, data sources, and actions the agent needs. If it only discovers and diagnoses, begin with --disable-write and consider --disable-query as well.

2. 2
   Create a least-privilege service account

   Create a dedicated Grafana service account for this workflow and grant only required dashboard-read, data-source-query, or alert permissions; do not reuse a personal administrator token.

3. 3
   Add the uvx STDIO configuration

   Set command to `uvx`, args to `["mcp-grafana"]`, and provide GRAFANA_URL plus the service-account token through env. Confirm the edit preserves other MCP server entries.

4. 4
   Run a minimal read-only verification

   Restart the client, inspect the tool list, and call user_info, search_dashboards, and get_dashboard_summary. Confirm the instance and organization before gradually enabling query or write categories.

Grafana MCP server stands out not merely for breadth but because Grafana maintains it and places dashboards, metrics, logs, and response workflows behind one MCP boundary. The README gives actionable guidance for installation, RBAC, read-only mode, query isolation, and network transport security, while recent releases continue to improve multi-org support, query controls, and security. Adoption should start with a least-privilege service account and reduced tool set. This assessment is based on public evidence rather than a live deployment test.