{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/datadog-mcp.json", "name": "Datadog MCP Server", "score": 56.6, "shared": [ "observability.metrics", "observability.logs", "observability.traces", "observability.incidents" ], "slug": "datadog-mcp" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/honeycomb-mcp.json", "name": "Honeycomb MCP", "score": 58.3, "shared": [ "observability.traces", "observability.metrics", "observability.logs" ], "slug": "honeycomb-mcp" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/render-mcp-server.json", "name": "Render MCP Server", "score": 63.6, "shared": [ "observability.logs", "observability.metrics" ], "slug": "render-mcp-server" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/pagerduty-mcp.json", "name": "PagerDuty MCP Server", "score": 48.4, "shared": [ "observability.incidents", "work.oncall" ], "slug": "pagerduty-mcp" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/launchdarkly.json", "name": "LaunchDarkly", "score": 69.2, "shared": [ "observability.logs" ], "slug": "launchdarkly" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/posthog.json", "name": "PostHog", "score": 68.4, "shared": [ "observability.logs" ], "slug": "posthog" } ], "tool": { "slug": "grafana-mcp-server", "name": "Grafana MCP Server", "vendor": "Grafana Labs", "vendorUrl": "https://grafana.com/docs/grafana/latest/developer-resources/mcp/", "kind": "mcp", "category": "observability", "summary": "Grafana Labs' open-source MCP server for Grafana. It runs locally or self-hosted and gives agents dashboards, datasource queries (Prometheus, Loki, Tempo, Pyroscope and others), alerting, incidents and OnCall on a self-managed Grafana or Grafana Cloud.", "url": "https://www.anchorterminal.com/tools/grafana-mcp-server", "markdownUrl": "https://www.anchorterminal.com/tools/grafana-mcp-server.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/grafana-mcp-server.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/grafana-mcp-server.json", "repo": "https://github.com/grafana/mcp-grafana", "license": "Apache-2.0", "transports": [ "stdio", "sse", "streamable-http" ], "packages": [ { "registry": "pypi", "name": "mcp-grafana" }, { "registry": "oci", "name": "grafana/mcp-grafana" }, { "registry": "go", "name": "github.com/grafana/mcp-grafana/v2" } ], "auth": "mixed", "authNotes": "The server signs in to Grafana with a service account token (`GRAFANA_SERVICE_ACCOUNT_TOKEN`, or a file path in `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE` that is re-read on each request), or with `GRAFANA_USERNAME` and `GRAFANA_PASSWORD`. An admin creates the token in Grafana, self-serve, and Grafana RBAC sets what it can do. The README lists the permissions each tool needs. Over streamable HTTP a caller can send its own token in `X-Grafana-Service-Account-Token`, and `--server-auth-token` makes callers present a bearer token to the server itself. stdio needs no caller credential.", "pricing": "free", "pricingNotes": "Free and open source under Apache-2.0, with nothing to buy for the server. It needs a Grafana instance, which can be self-managed open-source Grafana or Grafana Cloud. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs or the changelog (checked 2026-10-08).", "endpoints": [] }, "toolCount": 119, "popularity": { "githubStars": 3535, "npmWeekly": null, "pypiWeekly": 151923, "asOf": "2026-10-08" }, "docsUrl": "https://grafana.com/docs/grafana/latest/developer-resources/mcp/", "llmsTxt": "https://grafana.com/llms.txt", "registryName": "io.github.grafana/mcp-grafana", "capabilities": [ "observability.metrics", "observability.logs", "observability.traces", "observability.incidents", "work.oncall" ], "tags": [ "official", "local", "open-source", "self-hosted", "mcp", "go", "docker", "helm", "grafana", "llms-txt", "telemetry-default-on" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 74.5, "grade": "BB", "agentReady": true, "rank": 69, "ranked": true, "rankOf": 842, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 95, "payments": 60, "reliability": 91, "schema": 81, "security": 65, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 91, "points": 18.2, "reason": "Scored as local software, since the owner runs it over stdio, SSE or streamable HTTP. Official PyPI package `mcp-grafana` (a wheel that carries the Go binary, Python 3.10 or later), a Docker image, release binaries and a Helm chart, with Grafana 9.0 or later stated as the requirement (20). Unit, integration and end-to-end workflows all concluded in success on main on 8 October 2026 (25). 54 open issues, none labelled bug, and 38 closed in the 30 days before the check. Three bug reports remain open from July and August (#992 `run_panel_query` 422, #1005 `grafana_api_request` 500 on plugin resources, #1049 a dropped table row in `get_panel_image`), each with replies (19 of 25). The changelog follows Keep a Changelog and semantic versioning and labels breaking changes, and 1.6.2 announced that 2.0 came next. Patch release 1.4.1 carried a breaking parameter change on the Sift tools, and 2.0.0 followed 1.0.0 by two months (12 of 15). Version 2.0.2 (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "All 79 default tools declare typed JSON Schema inputs with `additionalProperties` false, read from `tools/list` on 2.0.2. No tool declares an output schema, which issue #1278 asks for (23 of 25). grafana.com serves llms.txt and a Markdown form of every docs page, the MCP pages included (10). Descriptions state purpose and inputs, with a median of 240 characters. Version 2.0.2 removed model directives and references to other tools from descriptions to meet connector directory rules, so guidance on when to use a tool is thinner than it was (14 of 20). 375 of 383 parameters carry a description, but only 14 are enums. Values such as `queryType` ('range' or 'instant') and incident `status` are named in prose, and 16 parameters are free-form objects (9 of 15). The docs have client configuration examples, task guides and a troubleshooting page, and empty results return hints. No catalogue of error responses was found (10 of 15). Semantic versions, tagged releases and a dated changelog (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "79 tools load by default in 2.0.2, about 107 KB of definitions as JSON, and 119 with every category on. That is 5 of 25 by count, plus 9 for `--enabled-tools`, per-category `--disable-*` flags, 13 opt-in categories and `--disable-write`, which leaves 62 (14). `limit` and `page` on searches, `get_dashboard_summary`, JSONPath reads through `get_dashboard_property`, a jq filter on `grafana_api_request`, and a 100-line default on `query_loki_logs` with an optional byte and time-range guardrail (18 of 20). Unknown argument keys are rejected with the valid ones listed, empty results carry likely causes and next steps, and TraceQL errors return correction hints. No documented error list (16 of 20). Every default tool sets `readOnlyHint`, `destructiveHint` and `idempotentHint` (60 read-only, 9 marked destructive). No idempotency keys on creates (17 of 20). 85 of 383 parameters are required and most have defaults. The Go module is the only library, with a Python wrapper for install (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "The server holds a Grafana service account token, which Grafana RBAC can scope by action and resource and which can be revoked. `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE` is re-read on each request for rotation. Username and password and a deprecated API key also work. The open-source server has no OAuth, and no secret travels in a URL (25 of 30). `--disable-write`, `--disable-query`, per-category flags, Loki enforced matchers and a per-tool RBAC table support least privilege. Writes are on by default, the default set includes `grafana_api_request` for any API path, and nothing asks for confirmation (14 of 20). Log lines, dashboards and annotations reach the model as stored. No injection guidance was found in the README or docs, and issue #680 on the subject has been open since 24 March 2026 (2 of 15). OpenTelemetry traces, metrics and logs per tool call and slow-request logging, with arguments left out of spans unless `--include-args-in-spans` is set (10 of 15). Grafana Labs runs a disclosure programme on Intigriti without bounties, lists ISO 27001 and SOC 2 Type 2, and publishes advisories for its products. This repository has no SECURITY.md and no published advisories, though its changelog records security fixes, and grafana.com has no security.txt (14 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. The server is free under Apache-2.0 and needs no signup of its own, so 20 + 20 + 20. No x402, MPP or L402 (0). It needs a Grafana instance, which can be the free open-source Grafana. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage and is not what this listing grades." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 95, "points": 8.31, "reason": "v2.0.2 tagged on 7 October 2026, one day before the check (30). 17 tagged releases from 0.17.2 on 13 July to 2.0.2 (20). 38 issues closed in the 30 days before the check against 54 open and 22 open pull requests, with commits on main most days. Several feature requests from March and April have no reply (21 of 25). Listed in the official MCP registry as `io.github.grafana/mcp-grafana`, a GitHub-verified namespace, with v2.0.1 of 6 October marked latest in the page we read (14 of 15). Renovate, a Docker image scan workflow and, from 8 October, cosign signing and SBOMs for releases (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 81, provenance 76", "reason": "Apache-2.0 (30). Local software that talks to the configured Grafana. A docs page lists every field in the usage report, the destination, and the region and network name the receiving service adds, and the Grafana Labs privacy policy (last updated 10 July 2026) covers usage statistics from its open-source software. No retention period for the reports was found (24 of 30). No deprecation policy. Notices come without dates, such as `GRAFANA_API_KEY` to be removed 'in a future version', and the Sift tools were marked deprecated before 2.0.0 removed them (10 of 20). Usage statistics are documented with three opt-outs and a `log` mode that prints the report without sending it. They arrived off by default in 1.5.0 on 17 September 2026 and were switched on by default in 2.0.0, noted in the changelog (17 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "high", "notes": { "ergonomics": "79 tools load by default in 2.0.2, about 107 KB of definitions as JSON, and 119 with every category on. That is 5 of 25 by count, plus 9 for `--enabled-tools`, per-category `--disable-*` flags, 13 opt-in categories and `--disable-write`, which leaves 62 (14). `limit` and `page` on searches, `get_dashboard_summary`, JSONPath reads through `get_dashboard_property`, a jq filter on `grafana_api_request`, and a 100-line default on `query_loki_logs` with an optional byte and time-range guardrail (18 of 20). Unknown argument keys are rejected with the valid ones listed, empty results carry likely causes and next steps, and TraceQL errors return correction hints. No documented error list (16 of 20). Every default tool sets `readOnlyHint`, `destructiveHint` and `idempotentHint` (60 read-only, 9 marked destructive). No idempotency keys on creates (17 of 20). 85 of 383 parameters are required and most have defaults. The Go module is the only library, with a Python wrapper for install (9 of 15).", "maintenance": "v2.0.2 tagged on 7 October 2026, one day before the check (30). 17 tagged releases from 0.17.2 on 13 July to 2.0.2 (20). 38 issues closed in the 30 days before the check against 54 open and 22 open pull requests, with commits on main most days. Several feature requests from March and April have no reply (21 of 25). Listed in the official MCP registry as `io.github.grafana/mcp-grafana`, a GitHub-verified namespace, with v2.0.1 of 6 October marked latest in the page we read (14 of 15). Renovate, a Docker image scan workflow and, from 8 October, cosign signing and SBOMs for releases (10).", "payments": "Read with the self-hosted rule. The server is free under Apache-2.0 and needs no signup of its own, so 20 + 20 + 20. No x402, MPP or L402 (0). It needs a Grafana instance, which can be the free open-source Grafana. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage and is not what this listing grades.", "reliability": "Scored as local software, since the owner runs it over stdio, SSE or streamable HTTP. Official PyPI package `mcp-grafana` (a wheel that carries the Go binary, Python 3.10 or later), a Docker image, release binaries and a Helm chart, with Grafana 9.0 or later stated as the requirement (20). Unit, integration and end-to-end workflows all concluded in success on main on 8 October 2026 (25). 54 open issues, none labelled bug, and 38 closed in the 30 days before the check. Three bug reports remain open from July and August (#992 `run_panel_query` 422, #1005 `grafana_api_request` 500 on plugin resources, #1049 a dropped table row in `get_panel_image`), each with replies (19 of 25). The changelog follows Keep a Changelog and semantic versioning and labels breaking changes, and 1.6.2 announced that 2.0 came next. Patch release 1.4.1 carried a breaking parameter change on the Sift tools, and 2.0.0 followed 1.0.0 by two months (12 of 15). Version 2.0.2 (15).", "schema": "All 79 default tools declare typed JSON Schema inputs with `additionalProperties` false, read from `tools/list` on 2.0.2. No tool declares an output schema, which issue #1278 asks for (23 of 25). grafana.com serves llms.txt and a Markdown form of every docs page, the MCP pages included (10). Descriptions state purpose and inputs, with a median of 240 characters. Version 2.0.2 removed model directives and references to other tools from descriptions to meet connector directory rules, so guidance on when to use a tool is thinner than it was (14 of 20). 375 of 383 parameters carry a description, but only 14 are enums. Values such as `queryType` ('range' or 'instant') and incident `status` are named in prose, and 16 parameters are free-form objects (9 of 15). The docs have client configuration examples, task guides and a troubleshooting page, and empty results return hints. No catalogue of error responses was found (10 of 15). Semantic versions, tagged releases and a dated changelog (15).", "security": "The server holds a Grafana service account token, which Grafana RBAC can scope by action and resource and which can be revoked. `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE` is re-read on each request for rotation. Username and password and a deprecated API key also work. The open-source server has no OAuth, and no secret travels in a URL (25 of 30). `--disable-write`, `--disable-query`, per-category flags, Loki enforced matchers and a per-tool RBAC table support least privilege. Writes are on by default, the default set includes `grafana_api_request` for any API path, and nothing asks for confirmation (14 of 20). Log lines, dashboards and annotations reach the model as stored. No injection guidance was found in the README or docs, and issue #680 on the subject has been open since 24 March 2026 (2 of 15). OpenTelemetry traces, metrics and logs per tool call and slow-request logging, with arguments left out of spans unless `--include-args-in-spans` is set (10 of 15). Grafana Labs runs a disclosure programme on Intigriti without bounties, lists ISO 27001 and SOC 2 Type 2, and publishes advisories for its products. This repository has no SECURITY.md and no published advisories, though its changelog records security fixes, and grafana.com has no security.txt (14 of 20).", "transparency": "Apache-2.0 (30). Local software that talks to the configured Grafana. A docs page lists every field in the usage report, the destination, and the region and network name the receiving service adds, and the Grafana Labs privacy policy (last updated 10 July 2026) covers usage statistics from its open-source software. No retention period for the reports was found (24 of 30). No deprecation policy. Notices come without dates, such as `GRAFANA_API_KEY` to be removed 'in a future version', and the Sift tools were marked deprecated before 2.0.0 removed them (10 of 20). Usage statistics are documented with three opt-outs and a `log` mode that prints the report without sending it. They arrived off by default in 1.5.0 on 17 September 2026 and were switched on by default in 2.0.0, noted in the changelog (17 of 20)." }, "sources": [ { "what": "README, flags, read-only mode, RBAC table and tool list", "url": "https://github.com/grafana/mcp-grafana", "seen": "2026-10-08" }, { "what": "changelog, 0.10.0 to 2.0.2", "url": "https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md", "seen": "2026-10-08" }, { "what": "tool definitions from `tools/list` on the 2.0.2 PyPI binary, run locally with usage statistics off", "url": "https://pypi.org/project/mcp-grafana/", "seen": "2026-10-08" }, { "what": "PyPI metadata and release dates", "url": "https://pypi.org/pypi/mcp-grafana/json", "seen": "2026-10-08" }, { "what": "PyPI weekly downloads", "url": "https://pypistats.org/api/packages/mcp-grafana/recent", "seen": "2026-10-08" }, { "what": "repository statistics", "url": "https://api.github.com/repos/grafana/mcp-grafana", "seen": "2026-10-08" }, { "what": "workflow runs on main", "url": "https://github.com/grafana/mcp-grafana/actions", "seen": "2026-10-08" }, { "what": "open issues", "url": "https://github.com/grafana/mcp-grafana/issues", "seen": "2026-10-08" }, { "what": "repository security advisories (none)", "url": "https://github.com/grafana/mcp-grafana/security/advisories", "seen": "2026-10-08" }, { "what": "open-source MCP server docs", "url": "https://grafana.com/docs/grafana/latest/developer-resources/mcp/", "seen": "2026-10-08" }, { "what": "anonymous usage statistics docs", "url": "https://grafana.com/docs/grafana/latest/developer-resources/mcp/anonymous-usage-statistics/", "seen": "2026-10-08" }, { "what": "hosted Grafana Cloud MCP server docs", "url": "https://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/", "seen": "2026-10-08" }, { "what": "hosted endpoint OAuth metadata", "url": "https://mcp.grafana.com/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=grafana", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://grafana.com/llms.txt", "seen": "2026-10-08" }, { "what": "security page and certifications", "url": "https://grafana.com/security/", "seen": "2026-10-08" }, { "what": "vulnerability reporting policy", "url": "https://grafana.com/legal/report-a-security-issue/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://grafana.com/legal/privacy-policy/", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://grafana.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/grafana.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead did not mention the hosted Grafana Cloud MCP server at mcp.grafana.com, a separate product with OAuth 2.1. This listing grades the open-source server only", "unchecked: Grafana Cloud pricing and its free tier, which matter only when the server points at Grafana Cloud", "unchecked: the Helm chart in grafana/helm-charts and the Docker Hub image page, which rest on the README", "unchecked: whether the MCP registry lists 2.0.2, since the page we read ended at v2.0.1 marked latest", "unchecked: the Intigriti programme page and its scope, and whether mcp-grafana is in scope", "The 0.17.2 changelog entry links pull request #XXX. The commit on 13 July 2026 names #995", "No retention period for usage reports was found in the usage statistics docs or the privacy policy" ] }, "negative": -3, "negativeNotes": [ "-3: before 0.17.2 (13 July 2026) a URL in the then undocumented `X-Grafana-URL` request header caused the server's environment service account token, API key, basic auth or extra headers to be sent to a host the caller chose, on the HTTP transports. Fixed and described in the changelog, whose entry links a placeholder pull request number, and no advisory was published, so a reduced deduction (https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md)." ], "verdict": "Every tool carries typed inputs and read-only, destructive and idempotent annotations, and `--disable-write` cuts the default 79 tools to 62. Writes and a general `grafana_api_request` tool are on by default, the default tool list is about 107 KB, and usage statistics have been sent to Grafana Labs by default since 2.0.0.", "bestFor": "Teams on Grafana, self-managed or Cloud, that want an agent to read dashboards and query Prometheus, Loki, Tempo and Pyroscope, and to work with alert rules, incidents and OnCall.", "strengths": [ "All 79 default tools in 2.0.2 declare typed JSON Schema inputs and `readOnlyHint`, `destructiveHint` and `idempotentHint` annotations", "`--disable-write`, `--disable-query`, per-category flags and Loki enforced matchers narrow what the server can do, with a per-tool table of required RBAC permissions", "17 tagged releases between 13 July and 7 October 2026, with a Keep a Changelog file that labels breaking changes", "Unit, integration and end-to-end workflows all passed on main on 8 October 2026", "Dashboard summary, JSONPath property reads, jq filtering and a 100-line Loki default keep responses small" ], "weaknesses": [ "The default set is 79 tools and about 107 KB of definitions, and 119 tools with every category on", "Write tools and `grafana_api_request`, which can call any Grafana API path, are enabled unless the operator turns them off", "Anonymous usage statistics went from off by default in 1.5.0 (17 September 2026) to on by default in 2.0.0", "A credential-forwarding flaw fixed in 0.17.2 on 13 July 2026 has no published advisory, and the repository has no SECURITY.md", "No prompt-injection guidance for log lines and dashboard content. Issue #680 on the subject has been open since 24 March 2026" ], "agentNotes": [ "Start with `--disable-write` unless the task needs writes, and add `--disable-api` to remove `grafana_api_request`", "Pass `--enabled-tools` with only the categories needed. The default list loads 79 tools", "Use `get_dashboard_summary` or `get_dashboard_property` with a JSONPath before `get_dashboard_by_uid`, which returns the whole dashboard JSON", "Set `GRAFANA_USAGE_STATS=disabled` or `DO_NOT_TRACK=1` to stop the four-hourly usage report to stats.grafana.org", "Use streamable HTTP, not SSE, when each caller needs its own token or organisation, and set `--server-auth-token` on any non-loopback address" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "high", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.5 } ], "editorialScores": { "ergonomics": 74, "maintenance": 95, "payments": 60, "reliability": 91, "schema": 81, "security": 65, "transparency": 81 }, "provenanceScore": 76 }, "connect": { "install": "uvx mcp-grafana", "config": { "mcpServers": { "grafana": { "args": [ "mcp-grafana" ], "command": "uvx", "env": { "GRAFANA_SERVICE_ACCOUNT_TOKEN": "\u003cyour service account token\u003e", "GRAFANA_URL": "http://localhost:3000" } } } } }, "letme": { "capability": "https://letme.dev/observability.metrics", "tool": "https://letme.dev/grafana-mcp-server" }, "notable": [ "79 tools load by default in 2.0.2 and 119 with every category on, each with typed inputs and read-only, destructive and idempotent annotations, measured from `tools/list` on the PyPI binary (https://github.com/grafana/mcp-grafana#tools)", "`--disable-write` removes write tools and the raw-SQL query tools, `--disable-query` removes every tool that runs a datasource query, and `--loki-enforced-matchers` pins LogQL label matchers on every Loki query (https://github.com/grafana/mcp-grafana#read-only-mode)", "Anonymous usage statistics were added off by default in 1.5.0 on 17 September 2026 and switched on by default in 2.0.0. The docs list every field sent and three opt-outs (https://grafana.com/docs/grafana/latest/developer-resources/mcp/anonymous-usage-statistics/)", "2.0.0 moved to the official MCP Go SDK, split the alerting tools into read and write tools, removed the Sift tools, and stopped per-request headers reaching tool calls over SSE (https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md)", "0.17.2 on 13 July 2026 stopped the server's own Grafana credentials being sent to a host named in a caller's `X-Grafana-URL` header. No advisory was published (https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md)", "Grafana Labs also runs a hosted Grafana Cloud MCP server at https://mcp.grafana.com/mcp with OAuth 2.1 and the scopes grafana:read, grafana:query and grafana:write, a separate product for Grafana Cloud only (https://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/)" ], "area": "developer", "details": [ { "label": "What is graded", "value": "The open-source server in grafana/mcp-grafana, version 2.0.2, which the owner runs. Grafana Labs also runs a separate hosted Grafana Cloud MCP server at https://mcp.grafana.com/mcp with OAuth 2.1, for Grafana Cloud only and counted towards Grafana Assistant usage" }, { "label": "Install", "value": "`uvx mcp-grafana` (PyPI wheel with the Go binary, Python 3.10 or later), Docker image `grafana/mcp-grafana` (SSE by default, pass `-t stdio`), release binaries, `go install github.com/grafana/mcp-grafana/v2/cmd/mcp-grafana@latest`, or the `grafana/grafana-mcp` Helm chart" }, { "label": "Transports", "value": "stdio (default), SSE and streamable HTTP on `localhost:8000`. Per-request credentials, organisation and URL headers work only over streamable HTTP since 2.0.0" }, { "label": "Tools", "value": "79 by default in 22 categories, 62 with `--disable-write`, 119 with all 35 categories. Off by default are admin, agento11y, assistant, athena, clickhouse, cloudlogging, cloudwatch, elasticsearch, examples, graphite, quickwit, runpanelquery, snowflake" }, { "label": "Tool definitions", "value": "106,672 bytes of JSON for the default 79, measured from `tools/list` on 2.0.2. Largest are `alerting_rules_write` (5.9 KB) and `update_dashboard` (5.3 KB)" }, { "label": "Credentials", "value": "`GRAFANA_SERVICE_ACCOUNT_TOKEN` or `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE`, or `GRAFANA_USERNAME` and `GRAFANA_PASSWORD`. `GRAFANA_API_KEY` is deprecated. `--server-auth-token` adds a bearer token callers must send on HTTP transports" }, { "label": "Restrictions", "value": "`--disable-write`, `--disable-query`, `--disable-\u003ccategory\u003e`, `--loki-enforced-matchers` (needs `--disable-api`), `--allowed-hosts` and `--allowed-origins` against DNS rebinding, cross-origin redirects refused by default since 1.6.3" }, { "label": "Requirements", "value": "Grafana 9.0 or later. Image rendering needs the Grafana Image Renderer. Incident, OnCall, Asserts and Assistant tools need those plugins or Grafana Cloud" }, { "label": "Usage statistics", "value": "On by default since 2.0.0. One POST to https://stats.grafana.org/mcp-grafana-usage-report every four hours and at exit, with tool names and call and error counts, version, OS, flag names and environment variable names. Off with `--usage-stats=disabled`, `GRAFANA_USAGE_STATS=disabled` or `DO_NOT_TRACK=1`" }, { "label": "Observability", "value": "Prometheus `/metrics`, OpenTelemetry traces and logs through `OTEL_*` variables, `/healthz`, slow-request logging" }, { "label": "Releases", "value": "1.0.0 on 28 July 2026, 2.0.0 tagged 1 October 2026 (move to the official MCP Go SDK, alerting tools split into read and write, Sift tools removed), 2.0.2 on 7 October 2026" } ], "provenance": { "legalEntity": "Raintank Inc., d/b/a Grafana Labs", "domain": "grafana.com", "domainRegistered": "2014-05-27", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://grafana.com/legal/privacy-policy/", "statusPage": "", "changelog": "https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "No terms document governs this software beyond the Apache-2.0 licence, so `terms` is left out.", "The privacy policy (last updated 10 July 2026) names Raintank Inc., d/b/a Grafana Labs, 165 Broadway, 23rd Floor, New York, and says its open-source and commercial software may report usage statistics.", "grafana.com/.well-known/security.txt returns 404. Reports go to an Intigriti disclosure programme or security@grafana.com, with no bounties (https://grafana.com/legal/report-a-security-issue/).", "RDAP for grafana.com gives a registration date of 2014-05-27.", "The server runs on the owner's machine. Usage reports go to stats.grafana.org, a second Grafana Labs domain." ], "score": 76, "checks": [ { "check": "Legal entity named", "value": "Raintank Inc., d/b/a Grafana Labs", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "grafana.com, registered 2014-05-27 (12 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache-2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://grafana.com/legal/privacy-policy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-07-10", "words": 6111, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Privacy Policy - Last Updated: July 10, 2026", "says": "Last updated 2026-07-10" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We collect personal information that you voluntarily provide to us when requesting information about us, our products, and our Services;" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain personal information for as long as necessary to fulfill the purposes for which it was collected, consistent with applicable law.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Where you choose to do this, we will receive certain profile information about you from your third party provider." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We may use your information to develop and display content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "In certain circumstances, you may also have the right to object to the processing of your personal information." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions or comments about this policy, or if you need to access this policy in a different format due to a disability, contact us by email at dsr-privacy@grafana.com, or by post to:", "says": "dsr-privacy@grafana.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "We participate in the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework.", "says": "Relies on the Data Privacy Framework" } ], "notes": [ { "date": "2026-10-08", "text": "Grafana's open-source and commercial software may send usage statistics back to Grafana Labs.", "quote": "Our open-source and commercial software may include functionality that reports usage statistics to us." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/grafana-mcp-server.json" }, "verify": { "accepts": "a page on grafana.com or one of its subdomains, or the README of github.com/grafana/mcp-grafana", "badgeUrl": "https://www.anchorterminal.com/badges/grafana-mcp-server.svg", "body": { "slug": "grafana-mcp-server", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/grafana-mcp-server", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/grafana-mcp-server\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/grafana-mcp-server.svg\" alt=\"Grafana MCP Server on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Grafana MCP Server on Anchor Terminal](https://www.anchorterminal.com/badges/grafana-mcp-server.svg)](https://www.anchorterminal.com/tools/grafana-mcp-server)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/grafana-mcp-server\"\u003eGrafana MCP Server on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/grafana-mcp-server", "json": "https://www.anchorterminal.com/tools/grafana-mcp-server.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/grafana-mcp-server.md", "slim": "https://www.anchorterminal.com/tools/grafana-mcp-server.min.md" }, "markdown": "## Overview\n\n**Grade BB · 74.5/100 · rank #69 of 842 · #1 in Observability \u0026 incidents · agent-ready · confidence high**\n\n\n## Assessment\n\nEvery tool carries typed inputs and read-only, destructive and idempotent annotations, and `--disable-write` cuts the default 79 tools to 62. Writes and a general `grafana_api_request` tool are on by default, the default tool list is about 107 KB, and usage statistics have been sent to Grafana Labs by default since 2.0.0.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Grafana Labs (https://grafana.com/docs/grafana/latest/developer-resources/mcp/) |\n| Kind | MCP server |\n| Category | Observability \u0026 incidents (https://www.anchorterminal.com/categories/observability) |\n| Transport | stdio, SSE (legacy), Streamable HTTP |\n| Auth | OAuth or key · The server signs in to Grafana with a service account token (`GRAFANA_SERVICE_ACCOUNT_TOKEN`, or a file path in `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE` that is re-read on each request), or with `GRAFANA_USERNAME` and `GRAFANA_PASSWORD`. An admin creates the token in Grafana, self-serve, and Grafana RBAC sets what it can do. The README lists the permissions each tool needs. Over streamable HTTP a caller can send its own token in `X-Grafana-Service-Account-Token`, and `--server-auth-token` makes callers present a bearer token to the server itself. stdio needs no caller credential. |\n| Pricing | Free (Free · OSS) · Free and open source under Apache-2.0, with nothing to buy for the server. It needs a Grafana instance, which can be self-managed open-source Grafana or Grafana Cloud. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the README, the docs or the changelog (checked 2026-10-08). |\n| Licence | Apache-2.0 |\n| Tools exposed | 119 |\n| Packages | pypi: `mcp-grafana`; oci: `grafana/mcp-grafana`; go: `github.com/grafana/mcp-grafana/v2` |\n| MCP registry name | `io.github.grafana/mcp-grafana` |\n| Source | https://github.com/grafana/mcp-grafana |\n| Docs | https://grafana.com/docs/grafana/latest/developer-resources/mcp/ |\n| llms.txt | https://grafana.com/llms.txt |\n| Last release | 2026-10-07 |\n| GitHub stars | 3,535 (as of 2026-10-08) |\n| PyPI downloads / week | 151,923 |\n| What is graded | The open-source server in grafana/mcp-grafana, version 2.0.2, which the owner runs. Grafana Labs also runs a separate hosted Grafana Cloud MCP server at https://mcp.grafana.com/mcp with OAuth 2.1, for Grafana Cloud only and counted towards Grafana Assistant usage |\n| Install | `uvx mcp-grafana` (PyPI wheel with the Go binary, Python 3.10 or later), Docker image `grafana/mcp-grafana` (SSE by default, pass `-t stdio`), release binaries, `go install github.com/grafana/mcp-grafana/v2/cmd/mcp-grafana@latest`, or the `grafana/grafana-mcp` Helm chart |\n| Transports | stdio (default), SSE and streamable HTTP on `localhost:8000`. Per-request credentials, organisation and URL headers work only over streamable HTTP since 2.0.0 |\n| Tools | 79 by default in 22 categories, 62 with `--disable-write`, 119 with all 35 categories. Off by default are admin, agento11y, assistant, athena, clickhouse, cloudlogging, cloudwatch, elasticsearch, examples, graphite, quickwit, runpanelquery, snowflake |\n| Tool definitions | 106,672 bytes of JSON for the default 79, measured from `tools/list` on 2.0.2. Largest are `alerting_rules_write` (5.9 KB) and `update_dashboard` (5.3 KB) |\n| Credentials | `GRAFANA_SERVICE_ACCOUNT_TOKEN` or `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE`, or `GRAFANA_USERNAME` and `GRAFANA_PASSWORD`. `GRAFANA_API_KEY` is deprecated. `--server-auth-token` adds a bearer token callers must send on HTTP transports |\n| Restrictions | `--disable-write`, `--disable-query`, `--disable-\u003ccategory\u003e`, `--loki-enforced-matchers` (needs `--disable-api`), `--allowed-hosts` and `--allowed-origins` against DNS rebinding, cross-origin redirects refused by default since 1.6.3 |\n| Requirements | Grafana 9.0 or later. Image rendering needs the Grafana Image Renderer. Incident, OnCall, Asserts and Assistant tools need those plugins or Grafana Cloud |\n| Usage statistics | On by default since 2.0.0. One POST to https://stats.grafana.org/mcp-grafana-usage-report every four hours and at exit, with tool names and call and error counts, version, OS, flag names and environment variable names. Off with `--usage-stats=disabled`, `GRAFANA_USAGE_STATS=disabled` or `DO_NOT_TRACK=1` |\n| Observability | Prometheus `/metrics`, OpenTelemetry traces and logs through `OTEL_*` variables, `/healthz`, slow-request logging |\n| Releases | 1.0.0 on 28 July 2026, 2.0.0 tagged 1 October 2026 (move to the official MCP Go SDK, alerting tools split into read and write, Sift tools removed), 2.0.2 on 7 October 2026 |\n| Capabilities | observability.metrics, observability.logs, observability.traces, observability.incidents, work.oncall |\n| Tags | official, local, open-source, self-hosted, mcp, go, docker, helm, grafana, llms-txt, telemetry-default-on |\n| JSON | https://www.anchorterminal.com/api/v1/tools/grafana-mcp-server.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: high. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 91 | 18.2 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 81 | 13.2 |\n| Agent ergonomics | 13% | 16.2 | 74 | 12.0 |\n| Security \u0026 auth | 14% | 17.5 | 65 | 11.4 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 95 | 8.3 |\n| Transparency \u0026 trust (editorial 81, provenance 76) | 7% | 8.8 | 79 | 6.9 |\n| Negative events | up to −15 | up to −15 | -3: before 0.17.2 (13 July 2026) a URL in the then undocumented `X-Grafana-URL` request header caused the server's environment service account token, API key, basic auth or extra headers to be sent to a host the caller chose, on the HTTP transports. Fixed and described in the changelog, whose entry links a placeholder pull request number, and no advisory was published, so a reduced deduction (https://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md). | -3 |\n| **Total** | | | | **74.5 → BB** |\n\n### Why each score\n\n- Reliability 91: Scored as local software, since the owner runs it over stdio, SSE or streamable HTTP. Official PyPI package `mcp-grafana` (a wheel that carries the Go binary, Python 3.10 or later), a Docker image, release binaries and a Helm chart, with Grafana 9.0 or later stated as the requirement (20). Unit, integration and end-to-end workflows all concluded in success on main on 8 October 2026 (25). 54 open issues, none labelled bug, and 38 closed in the 30 days before the check. Three bug reports remain open from July and August (#992 `run_panel_query` 422, #1005 `grafana_api_request` 500 on plugin resources, #1049 a dropped table row in `get_panel_image`), each with replies (19 of 25). The changelog follows Keep a Changelog and semantic versioning and labels breaking changes, and 1.6.2 announced that 2.0 came next. Patch release 1.4.1 carried a breaking parameter change on the Sift tools, and 2.0.0 followed 1.0.0 by two months (12 of 15). Version 2.0.2 (15).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 81: All 79 default tools declare typed JSON Schema inputs with `additionalProperties` false, read from `tools/list` on 2.0.2. No tool declares an output schema, which issue #1278 asks for (23 of 25). grafana.com serves llms.txt and a Markdown form of every docs page, the MCP pages included (10). Descriptions state purpose and inputs, with a median of 240 characters. Version 2.0.2 removed model directives and references to other tools from descriptions to meet connector directory rules, so guidance on when to use a tool is thinner than it was (14 of 20). 375 of 383 parameters carry a description, but only 14 are enums. Values such as `queryType` ('range' or 'instant') and incident `status` are named in prose, and 16 parameters are free-form objects (9 of 15). The docs have client configuration examples, task guides and a troubleshooting page, and empty results return hints. No catalogue of error responses was found (10 of 15). Semantic versions, tagged releases and a dated changelog (15).\n- Agent ergonomics 74: 79 tools load by default in 2.0.2, about 107 KB of definitions as JSON, and 119 with every category on. That is 5 of 25 by count, plus 9 for `--enabled-tools`, per-category `--disable-*` flags, 13 opt-in categories and `--disable-write`, which leaves 62 (14). `limit` and `page` on searches, `get_dashboard_summary`, JSONPath reads through `get_dashboard_property`, a jq filter on `grafana_api_request`, and a 100-line default on `query_loki_logs` with an optional byte and time-range guardrail (18 of 20). Unknown argument keys are rejected with the valid ones listed, empty results carry likely causes and next steps, and TraceQL errors return correction hints. No documented error list (16 of 20). Every default tool sets `readOnlyHint`, `destructiveHint` and `idempotentHint` (60 read-only, 9 marked destructive). No idempotency keys on creates (17 of 20). 85 of 383 parameters are required and most have defaults. The Go module is the only library, with a Python wrapper for install (9 of 15).\n- Security \u0026 auth 65: The server holds a Grafana service account token, which Grafana RBAC can scope by action and resource and which can be revoked. `GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE` is re-read on each request for rotation. Username and password and a deprecated API key also work. The open-source server has no OAuth, and no secret travels in a URL (25 of 30). `--disable-write`, `--disable-query`, per-category flags, Loki enforced matchers and a per-tool RBAC table support least privilege. Writes are on by default, the default set includes `grafana_api_request` for any API path, and nothing asks for confirmation (14 of 20). Log lines, dashboards and annotations reach the model as stored. No injection guidance was found in the README or docs, and issue #680 on the subject has been open since 24 March 2026 (2 of 15). OpenTelemetry traces, metrics and logs per tool call and slow-request logging, with arguments left out of spans unless `--include-args-in-spans` is set (10 of 15). Grafana Labs runs a disclosure programme on Intigriti without bounties, lists ISO 27001 and SOC 2 Type 2, and publishes advisories for its products. This repository has no SECURITY.md and no published advisories, though its changelog records security fixes, and grafana.com has no security.txt (14 of 20).\n- Payments \u0026 pricing 60: Read with the self-hosted rule. The server is free under Apache-2.0 and needs no signup of its own, so 20 + 20 + 20. No x402, MPP or L402 (0). It needs a Grafana instance, which can be the free open-source Grafana. Grafana Cloud prices were not checked. The separate hosted Grafana Cloud MCP server counts towards Grafana Assistant usage and is not what this listing grades.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 95: v2.0.2 tagged on 7 October 2026, one day before the check (30). 17 tagged releases from 0.17.2 on 13 July to 2.0.2 (20). 38 issues closed in the 30 days before the check against 54 open and 22 open pull requests, with commits on main most days. Several feature requests from March and April have no reply (21 of 25). Listed in the official MCP registry as `io.github.grafana/mcp-grafana`, a GitHub-verified namespace, with v2.0.1 of 6 October marked latest in the page we read (14 of 15). Renovate, a Docker image scan workflow and, from 8 October, cosign signing and SBOMs for releases (10).\n- Transparency \u0026 trust 79: Apache-2.0 (30). Local software that talks to the configured Grafana. A docs page lists every field in the usage report, the destination, and the region and network name the receiving service adds, and the Grafana Labs privacy policy (last updated 10 July 2026) covers usage statistics from its open-source software. No retention period for the reports was found (24 of 30). No deprecation policy. Notices come without dates, such as `GRAFANA_API_KEY` to be removed 'in a future version', and the Sift tools were marked deprecated before 2.0.0 removed them (10 of 20). Usage statistics are documented with three opt-outs and a `log` mode that prints the report without sending it. They arrived off by default in 1.5.0 on 17 September 2026 and were switched on by default in 2.0.0, noted in the changelog (17 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/grafana-mcp-server.md (JSON https://www.anchorterminal.com/fixes/grafana-mcp-server.json)\n\n### What we couldn't check\n\n- The lead did not mention the hosted Grafana Cloud MCP server at mcp.grafana.com, a separate product with OAuth 2.1. This listing grades the open-source server only\n- unchecked: Grafana Cloud pricing and its free tier, which matter only when the server points at Grafana Cloud\n- unchecked: the Helm chart in grafana/helm-charts and the Docker Hub image page, which rest on the README\n- unchecked: whether the MCP registry lists 2.0.2, since the page we read ended at v2.0.1 marked latest\n- unchecked: the Intigriti programme page and its scope, and whether mcp-grafana is in scope\n- The 0.17.2 changelog entry links pull request #XXX. The commit on 13 July 2026 names #995\n- No retention period for usage reports was found in the usage statistics docs or the privacy policy\n\n### Sources\n\n- README, flags, read-only mode, RBAC table and tool list: \u003chttps://github.com/grafana/mcp-grafana\u003e (seen 2026-10-08)\n- changelog, 0.10.0 to 2.0.2: \u003chttps://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md\u003e (seen 2026-10-08)\n- tool definitions from `tools/list` on the 2.0.2 PyPI binary, run locally with usage statistics off: \u003chttps://pypi.org/project/mcp-grafana/\u003e (seen 2026-10-08)\n- PyPI metadata and release dates: \u003chttps://pypi.org/pypi/mcp-grafana/json\u003e (seen 2026-10-08)\n- PyPI weekly downloads: \u003chttps://pypistats.org/api/packages/mcp-grafana/recent\u003e (seen 2026-10-08)\n- repository statistics: \u003chttps://api.github.com/repos/grafana/mcp-grafana\u003e (seen 2026-10-08)\n- workflow runs on main: \u003chttps://github.com/grafana/mcp-grafana/actions\u003e (seen 2026-10-08)\n- open issues: \u003chttps://github.com/grafana/mcp-grafana/issues\u003e (seen 2026-10-08)\n- repository security advisories (none): \u003chttps://github.com/grafana/mcp-grafana/security/advisories\u003e (seen 2026-10-08)\n- open-source MCP server docs: \u003chttps://grafana.com/docs/grafana/latest/developer-resources/mcp/\u003e (seen 2026-10-08)\n- anonymous usage statistics docs: \u003chttps://grafana.com/docs/grafana/latest/developer-resources/mcp/anonymous-usage-statistics/\u003e (seen 2026-10-08)\n- hosted Grafana Cloud MCP server docs: \u003chttps://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/\u003e (seen 2026-10-08)\n- hosted endpoint OAuth metadata: \u003chttps://mcp.grafana.com/.well-known/oauth-protected-resource\u003e (seen 2026-10-08)\n- MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=grafana\u003e (seen 2026-10-08)\n- llms.txt: \u003chttps://grafana.com/llms.txt\u003e (seen 2026-10-08)\n- security page and certifications: \u003chttps://grafana.com/security/\u003e (seen 2026-10-08)\n- vulnerability reporting policy: \u003chttps://grafana.com/legal/report-a-security-issue/\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://grafana.com/legal/privacy-policy/\u003e (seen 2026-10-08)\n- security.txt (404): \u003chttps://grafana.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- domain registration: \u003chttps://rdap.verisign.com/com/v1/domain/grafana.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 76/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Raintank Inc., d/b/a Grafana Labs | 20/20 |\n| Domain age | grafana.com, registered 2014-05-27 (12 years) | 15/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | nothing hosted, so the Apache-2.0 licence stands in | 10/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nNo terms document governs this software beyond the Apache-2.0 licence, so `terms` is left out.\n\nThe privacy policy (last updated 10 July 2026) names Raintank Inc., d/b/a Grafana Labs, 165 Broadway, 23rd Floor, New York, and says its open-source and commercial software may report usage statistics.\n\ngrafana.com/.well-known/security.txt returns 404. Reports go to an Intigriti disclosure programme or security@grafana.com, with no bounties (https://grafana.com/legal/report-a-security-issue/).\n\nRDAP for grafana.com gives a registration date of 2014-05-27.\n\nThe server runs on the owner's machine. Usage reports go to stats.grafana.org, a second Grafana Labs domain.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The Apache-2.0 licence stands in and the check scores in full.\n\n\n**Privacy policy** (https://grafana.com/legal/privacy-policy/), read 2026-10-08, dated 2026-07-10, states 8 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-07-10.\n- Says how long data is kept. For as long as needed, with no period named.\n- Gives a privacy contact. dsr-privacy@grafana.com.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n- Also in the text (2026-10-08). Grafana's open-source and commercial software may send usage statistics back to Grafana Labs. \"Our open-source and commercial software may include functionality that reports usage statistics to us.\"\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- All 79 default tools in 2.0.2 declare typed JSON Schema inputs and `readOnlyHint`, `destructiveHint` and `idempotentHint` annotations\n- `--disable-write`, `--disable-query`, per-category flags and Loki enforced matchers narrow what the server can do, with a per-tool table of required RBAC permissions\n- 17 tagged releases between 13 July and 7 October 2026, with a Keep a Changelog file that labels breaking changes\n- Unit, integration and end-to-end workflows all passed on main on 8 October 2026\n- Dashboard summary, JSONPath property reads, jq filtering and a 100-line Loki default keep responses small\n\n## Weaknesses\n\n- The default set is 79 tools and about 107 KB of definitions, and 119 tools with every category on\n- Write tools and `grafana_api_request`, which can call any Grafana API path, are enabled unless the operator turns them off\n- Anonymous usage statistics went from off by default in 1.5.0 (17 September 2026) to on by default in 2.0.0\n- A credential-forwarding flaw fixed in 0.17.2 on 13 July 2026 has no published advisory, and the repository has no SECURITY.md\n- No prompt-injection guidance for log lines and dashboard content. Issue #680 on the subject has been open since 24 March 2026\n\n## Before you call it (notes for agents)\n\n1. Start with `--disable-write` unless the task needs writes, and add `--disable-api` to remove `grafana_api_request`\n2. Pass `--enabled-tools` with only the categories needed. The default list loads 79 tools\n3. Use `get_dashboard_summary` or `get_dashboard_property` with a JSONPath before `get_dashboard_by_uid`, which returns the whole dashboard JSON\n4. Set `GRAFANA_USAGE_STATS=disabled` or `DO_NOT_TRACK=1` to stop the four-hourly usage report to stats.grafana.org\n5. Use streamable HTTP, not SSE, when each caller needs its own token or organisation, and set `--server-auth-token` on any non-loopback address\n\n## Connect\n\nInstall:\n\n```bash\nuvx mcp-grafana\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"grafana\": {\n \"args\": [\n \"mcp-grafana\"\n ],\n \"command\": \"uvx\",\n \"env\": {\n \"GRAFANA_SERVICE_ACCOUNT_TOKEN\": \"\\u003cyour service account token\\u003e\",\n \"GRAFANA_URL\": \"http://localhost:3000\"\n }\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/grafana-mcp-server (letme picks it for observability.incidents, the top-graded tool for the job, letme picks it for observability.logs, the top-graded tool for the job, letme picks it for observability.metrics, the top-graded tool for the job, letme picks it for observability.traces, the top-graded tool for the job, letme picks it for work.oncall, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Datadog MCP Server | C | 56.6 | 566 | observability.metrics, observability.logs, observability.traces, observability.incidents | no | https://www.anchorterminal.com/tools/datadog-mcp.md |\n| Honeycomb MCP | C | 58.3 | 527 | observability.traces, observability.metrics, observability.logs | no | https://www.anchorterminal.com/tools/honeycomb-mcp.md |\n| Render MCP Server | B | 63.6 | 352 | observability.logs, observability.metrics | no | https://www.anchorterminal.com/tools/render-mcp-server.md |\n| PagerDuty MCP Server | D | 48.4 | 724 | observability.incidents, work.oncall | no | https://www.anchorterminal.com/tools/pagerduty-mcp.md |\n| LaunchDarkly | B | 69.2 | 185 | observability.logs | no | https://www.anchorterminal.com/tools/launchdarkly.md |\n| PostHog | B | 68.4 | 204 | observability.logs | no | https://www.anchorterminal.com/tools/posthog.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- 79 tools load by default in 2.0.2 and 119 with every category on, each with typed inputs and read-only, destructive and idempotent annotations, measured from `tools/list` on the PyPI binary (source: \u003chttps://github.com/grafana/mcp-grafana#tools\u003e)\n- `--disable-write` removes write tools and the raw-SQL query tools, `--disable-query` removes every tool that runs a datasource query, and `--loki-enforced-matchers` pins LogQL label matchers on every Loki query (source: \u003chttps://github.com/grafana/mcp-grafana#read-only-mode\u003e)\n- Anonymous usage statistics were added off by default in 1.5.0 on 17 September 2026 and switched on by default in 2.0.0. The docs list every field sent and three opt-outs (source: \u003chttps://grafana.com/docs/grafana/latest/developer-resources/mcp/anonymous-usage-statistics/\u003e)\n- 2.0.0 moved to the official MCP Go SDK, split the alerting tools into read and write tools, removed the Sift tools, and stopped per-request headers reaching tool calls over SSE (source: \u003chttps://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md\u003e)\n- 0.17.2 on 13 July 2026 stopped the server's own Grafana credentials being sent to a host named in a caller's `X-Grafana-URL` header. No advisory was published (source: \u003chttps://github.com/grafana/mcp-grafana/blob/main/CHANGELOG.md\u003e)\n- Grafana Labs also runs a hosted Grafana Cloud MCP server at https://mcp.grafana.com/mcp with OAuth 2.1 and the scopes grafana:read, grafana:query and grafana:write, a separate product for Grafana Cloud only (source: \u003chttps://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/\u003e)\n\n## Compare\n\n- [Datadog MCP Server vs Grafana MCP Server](https://www.anchorterminal.com/compare/datadog-mcp-vs-grafana-mcp-server.md): C 56.6 vs BB 74.5\n- [Grafana MCP Server vs Honeycomb MCP](https://www.anchorterminal.com/compare/grafana-mcp-server-vs-honeycomb-mcp.md): BB 74.5 vs C 58.3\n- [Grafana MCP Server vs PagerDuty MCP Server](https://www.anchorterminal.com/compare/grafana-mcp-server-vs-pagerduty-mcp.md): BB 74.5 vs D 48.4\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on grafana.com or one of its subdomains, or the README of github.com/grafana/mcp-grafana. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"grafana-mcp-server\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/grafana-mcp-server\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/grafana-mcp-server.svg\" alt=\"Grafana MCP Server on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Grafana MCP Server on Anchor Terminal](https://www.anchorterminal.com/badges/grafana-mcp-server.svg)](https://www.anchorterminal.com/tools/grafana-mcp-server)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/grafana-mcp-server\"\u003eGrafana MCP Server on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Grafana MCP Server is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/grafana-mcp-server-dark.png\n- Light: https://www.anchorterminal.com/assets/share/grafana-mcp-server-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Observability \u0026 incidents", "url": "https://www.anchorterminal.com/categories/observability" }, { "name": "Grafana MCP Server", "url": "" } ], "description": "Grafana Labs' open-source MCP server for Grafana. It runs locally or self-hosted and gives agents dashboards, datasource queries (Prometheus, Loki, Tempo, Pyroscope and others), alerting, incidents and OnCall on a self-managed Grafana or Grafana Cloud.", "facts": [ "rank #69 of 842", "OAuth or key auth", "0 desk reviews" ], "h1": "Grafana MCP Server", "image": "https://www.anchorterminal.com/assets/og/tools-grafana-mcp-server.png", "path": "/tools/grafana-mcp-server", "published": "2026-10-01", "section": "tools", "title": "Grafana MCP Server review for AI agents, grade BB (74.5/100)", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/grafana-mcp-server" }, "tokens": { "markdown": 6950, "slim": 1780 }, "version": 1 }