Axiom MCP Server vs Grafana MCP Server

Axiom MCP Server 72

Scored as a hosted MCP server. status.axiom.co is an incident.io page with six US and six EU components (API, ingest, querying, alerting, endpoints, app) and uptime per component for August to November 2026, with no MCP component (20). feed.rss holds nine incidents in the 90 days to 3 November 2026, among them elevated query errors in the US from 18:05 to 19:15 UTC on 14 October with missed monitor runs, a metrics ingestion and query disruption on 15 October, elevated query errors after a deployment on 21 October, metrics query error rates on 25 October, query errors and monitor delays on 27 October, metrics ingest on 30 October, EU monitor alerting degraded on 7 October, and console authentication through GitHub degraded on 12 August. US querying shows 99.90 per cent uptime. One incident over an hour on the query path and several shorter ones, so one major (10). Rate limits are published as headers (X-RateLimit-Scope, -Limit, -Remaining, -Reset) and plan limits on the limits page, but the per-minute numbers aren't printed (12). 429 with a message and reset headers, query cost caps that answer 429 with the reset time, and provisioning 429 with backoff guidance; no idempotency keys for the write tools (10). A published SLA of 99.9 per cent monthly uptime for Axiom Cloud with 10 and 25 per cent credits (10). Not marked beta; registry version 1.0.0 (10). 20 + 10 + 12 + 10 + 10 + 10 = 72.

Grafana MCP Server 91

Scored as local software, since the owner runs it over stdio, SSE or streamable HTTP. Official PyPI package mcp-grafana (a wheel that carries the Go binary, Python 3.10 or later), a Docker image, release binaries and a Helm chart, with Grafana 9.0 or later stated as the requirement (20). Unit, integration and end-to-end workflows all concluded in success on main on 8 October 2026, per the 8 October check, not re-read on 1 November (25). Per the 8 October check, not re-read on 1 November, 54 open issues, none labelled bug, and 38 closed in the 30 days before that check. Three bug reports remained open from July and August (#992 run_panel_query 422, #1005 grafana_api_request 500 on plugin resources, #1049 a dropped table row in get_panel_image), each with replies. A stale issue and pull request workflow was added on 27 October (19 of 25). The changelog follows Keep a Changelog and semantic versioning and labels breaking changes, and 1.6.2 announced that 2.0 came next. Patch release 1.4.1 carried a breaking parameter change on the Sift tools, 2.0.0 followed 1.0.0 by two months, and minor release 2.1.0 on 20 October changed the output of list_users_by_org, labelled on the day (12 of 15). Version 2.1.1, the latest release on 1 November (15).

Axiom MCP Server 62

The server is closed source (axiomhq/mcp isn't public) and tools/list needs a session, so the input schemas couldn't be read; partial credit for a contract that exists (10). llms.txt on axiom.co and a Markdown twin of every docs page (10). The tools reference gives each tool a purpose, an example request and a Read or Write label, says to use queryMetrics for metrics datasets instead of queryDataset, and the 29 October 2026 changelog adds session instructions on finding dataset and field names first (15). No parameters, types or enums are published for the tools (4). An example per tool, the REST docs' error shapes and the 429 bodies; no MCP error list (8). A dated changelog with MCP entries and a protocol version stated (2026-07-28 alongside the session transport), and a registry version (15). 10 + 10 + 15 + 4 + 8 + 15 = 62.

Grafana MCP Server 81

Read from source at tag v2.0.2, without running it, and unchanged in count at v2.1.1. All 79 default tools build their JSON Schema input by reflection from a typed Go parameter struct, and buildInputSchema in tools.go sets additionalProperties to false. No tool sets an output schema, which issue #1278 asks for (23 of 25). grafana.com serves llms.txt and a Markdown form of every docs page, the MCP pages included (10). Descriptions state purpose and inputs. Version 2.0.2 removed model directives and references to other tools from descriptions to meet connector directory rules, so guidance on when to use a tool is thinner than it was (14 of 20). Nearly every parameter field in the source structs carries a description tag, but few declare an enum. Values such as queryType ('range' or 'instant') and incident status are named in prose, and some parameters are free-form objects (9 of 15). The docs have client configuration examples, task guides and a troubleshooting page, and empty results return hints. No catalogue of error responses was found (10 of 15). Semantic versions, tagged releases and a dated changelog (15).

Axiom MCP Server 83

Read as a closed service. Changelog entry of 29 October 2026 covering the MCP server (30). Dated entries on 7 August, 23 September and 16, 21, 22, 28 and 29 October 2026 (20). A Discord community linked from the company page, support@axiom.co in the docs and email support on paid plans; no public issue tracker for the hosted server (12 of 15). co.axiom/mcp in the official registry under a DNS-verified namespace since 30 September 2025, though the entry still points at the SSE URL and version 1.0.0 (15). No package to assess for a hosted server; Axiom keeps SDKs in eight languages for the API (6). 30 + 20 + 12 + 15 + 6 = 83.

Grafana MCP Server 96

v2.1.1 tagged on 20 October 2026, 12 days before the check, after v2.1.0 the same day, with commits on main to 31 October (30). 17 tagged releases from 1.1.0 on 10 August to 2.1.1 in the 90 days to 1 November (20). Per the 8 October check, not re-read on 1 November, 38 issues closed in the 30 days before that check against 54 open and 22 open pull requests, and several feature requests from March and April without a reply (21 of 25). Listed in the official MCP registry as io.github.grafana/mcp-grafana, a GitHub-verified namespace, with v2.1.1 published on 20 October and marked latest (15). Renovate, a Docker image scan workflow, cosign signing with SPDX SBOMs for releases from 2.1.0, and Go toolchain and dependency bumps for CVEs on 21 and 28 October (10).

Axiom MCP Server 63

31 tools in the reference, 28 without service map, so the 11-to-30 band with no toolset switch (15). APL queries take their own limits and time ranges, and the REST API documents timestamp pagination; nothing documents page sizes for the list tools (15). 429 bodies state the limit and reset, the REST docs describe error shapes, and a sendFeedback tool reports unclear descriptions to Axiom (12). Reads and writes are labelled in the docs, but delete tools have no confirmation step, no idempotency keys exist for writes, and annotations weren't confirmed (8). One-command setup for 16 clients with OAuth, a setup prompt for agents, and official SDKs in eight languages for the API behind it (13). 15 + 15 + 12 + 8 + 13 = 63.

Grafana MCP Server 74

79 tools load by default and 119 with every category on, counted from the registration code in cmd/mcp-grafana/main.go and tools/*.go at tag v2.0.2, with no tool added or removed by v2.1.1. That is 5 of 25 by count, plus 9 for --enabled-tools, per-category --disable-* flags, 12 opt-in categories and --disable-write, which leaves 62 (14). limit and page on searches, get_dashboard_summary, JSONPath reads through get_dashboard_property, a jq filter on grafana_api_request, and a 100-line default on query_loki_logs with an optional byte and time-range guardrail (18 of 20). Unknown argument keys are rejected with the valid ones listed, empty results carry likely causes and next steps, and TraceQL errors return correction hints. No documented error list (16 of 20). In source every default tool sets readOnlyHint and destructiveHint (60 read-only, 9 marked destructive), and 73 of 79 also set idempotentHint. The six that leave it unset are writes, for which the protocol default is false. No idempotency keys on creates (17 of 20). Most parameters are optional in the source structs. The Go module is the only library, with a Python wrapper for install (9 of 15).

Axiom MCP Server 70

Closed service with clear terms naming Axiom, Inc. (15). A privacy policy with retention by data category, a DPA that names the sub-processor page and US or EU processing, and per-plan retention on the pricing page; the sub-processor list itself renders through a script and the terms carry no date (20). The changelog has a deprecation category and the docs mark the legacy query endpoint, but no notice period is written down (10). US and EU edge deployments are documented and the DPA says data may be processed in either, with the sub-processor list unread (12). 15 + 20 + 10 + 12 = 57.

Grafana MCP Server 80

Apache-2.0 (30). Local software that talks to the configured Grafana. A docs page lists every field in the usage report, the destination, and the region and network name the receiving service adds, and the Grafana Labs privacy policy (last updated 10 July 2026) covers usage statistics from its open-source software. No retention period for the reports was found (24 of 30). No deprecation policy. Notices come without dates, such as GRAFANA_API_KEY to be removed 'in a future version', and the Sift tools were marked deprecated before 2.0.0 removed them (10 of 20). Usage statistics are documented with three opt-outs and a log mode that prints the report without sending it. They arrived off by default in 1.5.0 on 17 September 2026 and were switched on by default in 2.0.0, noted in the changelog (17 of 20).

Axiom MCP Server 72

Browser OAuth creates a session the agent uses as the signed-in user, listed and revocable under Settings > Profile, and the docs say agents never see tokens; the header route uses a personal access token with full account rights, and the organisation id, not a secret, may go in the URL (26). Query cost limits on roles cap what an OAuth session can spend, scoped API tokens with expiry exist for the REST API, but the MCP server runs with the user's whole role and lists delete tools with no confirmation, and the AI agents page's read-only description contradicts the tools reference (12). Log, trace and event content is untrusted text and no injection guidance was found (2). An audit log on every organisation for 30 days, full history as an add-on, and session listing (12). ISO 27001, SOC 2 Type II, a security.txt on app.axiom.co, a bug bounty policy at axiom.co/security and annual penetration tests (20). 26 + 12 + 2 + 12 + 20 = 72.

Grafana MCP Server 67

The server holds a Grafana service account token, which Grafana RBAC can scope by action and resource and which can be revoked. GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE is re-read on each request for rotation. Username and password and a deprecated API key also work. The open-source server has no OAuth, and no secret travels in a URL (25 of 30). --disable-write, --disable-query, per-category flags, Loki enforced matchers and a per-tool RBAC table support least privilege. Writes are on by default, the default set includes grafana_api_request for any API path, and nothing asks for confirmation (14 of 20). Log lines, dashboards and annotations reach the model as stored. No injection guidance was found in the README or docs, and issue #680 on the subject has been open since 24 March 2026 (2 of 15). OpenTelemetry traces, metrics and logs per tool call and slow-request logging, with arguments left out of spans unless --include-args-in-spans is set (10 of 15). Grafana Labs runs a disclosure programme on Intigriti without bounties, lists ISO 27001 and SOC 2 Type 2, and publishes advisories on grafana.com, two of them for this server (CVE-2026-15583 on 15 July and CVE-2026-19516 on 11 August 2026). The repository has no SECURITY.md and grafana.com has no security.txt (16 of 20).