Cronitor MCP server vs Grafana MCP Server

Cronitor MCP server 37

robots.txt disallows the terms and privacy pages, so neither was read (5 of 30, terms exist but weren't readable). Data handling only from the security page (encryption, backups) (10 of 30). No deprecation policy found; the docs version the error codes by protocol revision (5 of 20). Subprocessors not found (5 of 20). 5 + 10 + 5 + 5 = 25.

Grafana MCP Server 80

Apache-2.0 (30). Local software that talks to the configured Grafana. A docs page lists every field in the usage report, the destination, and the region and network name the receiving service adds, and the Grafana Labs privacy policy (last updated 10 July 2026) covers usage statistics from its open-source software. No retention period for the reports was found (24 of 30). No deprecation policy. Notices come without dates, such as GRAFANA_API_KEY to be removed 'in a future version', and the Sift tools were marked deprecated before 2.0.0 removed them (10 of 20). Usage statistics are documented with three opt-outs and a log mode that prints the report without sending it. They arrived off by default in 1.5.0 on 17 September 2026 and were switched on by default in 2.0.0, noted in the changelog (17 of 20).

Cronitor MCP server 55

Registry entry io.cronitor/cronitor updated 3 November 2026 (30). No dated changelog found to count (0). Support page and docs; no public changelog (10 of 15). Official registry entry under its own namespace, and official SDKs (15). No package to read (0). 30 + 0 + 10 + 15 + 0 = 55. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Grafana MCP Server 96

v2.1.1 tagged on 20 October 2026, 12 days before the check, after v2.1.0 the same day, with commits on main to 31 October (30). 17 tagged releases from 1.1.0 on 10 August to 2.1.1 in the 90 days to 1 November (20). Per the 8 October check, not re-read on 1 November, 38 issues closed in the 30 days before that check against 54 open and 22 open pull requests, and several feature requests from March and April without a reply (21 of 25). Listed in the official MCP registry as io.github.grafana/mcp-grafana, a GitHub-verified namespace, with v2.1.1 published on 20 October and marked latest (15). Renovate, a Docker image scan workflow, cosign signing with SPDX SBOMs for releases from 2.1.0, and Go toolchain and dependency bumps for CVEs on 21 and 28 October (10).

Cronitor MCP server 55

Status page at status.cronitor.io with components for the APIs and telemetry regions (20). No history was readable (history.rss 404, uptime 'No data available') (5). Rate limits are returned with limit and window in the error data, but no numbers are published (5 of 15). Rate-limit errors carry retry_after_seconds, bulk deletes validate every key first, and the docs say which repeated calls are safe (15). No SLA found (0). Not labelled beta (10). 20 + 5 + 5 + 15 + 0 + 10 = 55.

Grafana MCP Server 91

Scored as local software, since the owner runs it over stdio, SSE or streamable HTTP. Official PyPI package mcp-grafana (a wheel that carries the Go binary, Python 3.10 or later), a Docker image, release binaries and a Helm chart, with Grafana 9.0 or later stated as the requirement (20). Unit, integration and end-to-end workflows all concluded in success on main on 8 October 2026, per the 8 October check, not re-read on 1 November (25). Per the 8 October check, not re-read on 1 November, 54 open issues, none labelled bug, and 38 closed in the 30 days before that check. Three bug reports remained open from July and August (#992 run_panel_query 422, #1005 grafana_api_request 500 on plugin resources, #1049 a dropped table row in get_panel_image), each with replies. A stale issue and pull request workflow was added on 27 October (19 of 25). The changelog follows Keep a Changelog and semantic versioning and labels breaking changes, and 1.6.2 announced that 2.0 came next. Patch release 1.4.1 carried a breaking parameter change on the Sift tools, 2.0.0 followed 1.0.0 by two months, and minor release 2.1.0 on 20 October changed the output of list_users_by_org, labelled on the day (12 of 15). Version 2.1.1, the latest release on 1 November (15).

Cronitor MCP server 40

No machine payment protocol (0). Per-monitor and per-user prices public (20). Free plan for 5 monitors, no card mentioned (20). A person signs up or signs in through a browser (0). 0 + 20 + 20 + 0 = 40.

Grafana MCP Server 60

Read with the self-hosted rule. The server is free under Apache-2.0 and needs no signup of its own, so 20 + 20 + 20. No x402, MPP or L402 (0). It needs a Grafana instance, which can be the free open-source Grafana. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage and is not what this listing grades.

Cronitor MCP server 58

OAuth bounded by role with no scope choice, or scoped API keys (22 of 30). Read-only users get only read tools; write tools follow the role (14 of 20). The docs warn that event messages, command output and request bodies can hold customer data or secrets, and tell the agent to ask before expanding them; secrets are redacted (12 of 15). No audit log of MCP calls found (0). The security page covers encryption and relies on AWS's certifications; no security.txt (404) and no disclosure policy found (10 of 20). 22 + 14 + 12 + 0 + 10 = 58.

Grafana MCP Server 67

The server holds a Grafana service account token, which Grafana RBAC can scope by action and resource and which can be revoked. GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE is re-read on each request for rotation. Username and password and a deprecated API key also work. The open-source server has no OAuth, and no secret travels in a URL (25 of 30). --disable-write, --disable-query, per-category flags, Loki enforced matchers and a per-tool RBAC table support least privilege. Writes are on by default, the default set includes grafana_api_request for any API path, and nothing asks for confirmation (14 of 20). Log lines, dashboards and annotations reach the model as stored. No injection guidance was found in the README or docs, and issue #680 on the subject has been open since 24 March 2026 (2 of 15). OpenTelemetry traces, metrics and logs per tool call and slow-request logging, with arguments left out of spans unless --include-args-in-spans is set (10 of 15). Grafana Labs runs a disclosure programme on Intigriti without bounties, lists ISO 27001 and SOC 2 Type 2, and publishes advisories on grafana.com, two of them for this server (CVE-2026-15583 on 15 July and CVE-2026-19516 on 11 August 2026). The repository has no SECURITY.md and grafana.com has no security.txt (16 of 20).