Grafana connector for AI agents

Tools your observability agent reaches for on Grafana, scoped per user.

CALL ANY TOOL

36 tools for observability in Grafana: search, create, and update dashboards, query data sources, read alert rules and alerts, and create silences and annotations.

grafana_alert_group_list

List alert group

List Grafana Alertmanager alerts grouped the way notification policies group them. Returns an array of groups, each with its group labels, receiver and the alerts in it. Use grafana_alert_group_list to see alerts as they are batched into notifications. Use grafana_alert_list for a flat list of alerts.

Parameters

Name

Type

Required

Description

active

boolean

Optional

Include active alerts. Defaults to true. Default: `true`.

filter

array

Optional

Label matchers to filter alerts, each in Prometheus matcher syntax. Example: ["severity=\"critical\"", "team=~\"api|web\""].

inhibited

boolean

Optional

Include inhibited alerts. Defaults to true. Default: `true`.

receiver

string

Optional

Regular expression matching the contact point (receiver) name to filter alerts by. Example: oncall-.*.

silenced

boolean

Optional

Include silenced alerts. Defaults to true. Default: `true`.

grafana_alert_list

List alert

grafana_alert_rule_get

Get alert rule

grafana_alert_rule_status_list

List alert rule status

grafana_annotation_create

Create annotation

grafana_annotation_get

Get annotation

grafana_annotation_list

List annotation

grafana_annotation_tag_list

List annotation tag

grafana_annotation_update

Update annotation

grafana_current_user_get

Get current user

grafana_dashboard_create

Create dashboard

Create a dashboard in a Grafana namespace through the dashboard.grafana.app API, optionally inside a folder. Returns the created Dashboard object with metadata.name (the dashboard UID), resourceVersion and spec. Use grafana_dashboard_create for a new dashboard. Use grafana_dashboard_update to change an existing one. Requires a folder UID from grafana_folder_list or grafana_dashboard_search to place it in a folder.

Parameters

Name

Type

Required

Description

namespace

string

Required

Grafana API namespace that scopes the request to an organization or stack. Use 'default' for the default organization on self-managed Grafana, 'org-<org_id>' for another organization (e.g. org-2), or 'stacks-<stack_id>' on Grafana Cloud (the stack ID is the instance ID shown in the Grafana Cloud portal under your stack's Details). Example: default.

spec

object

Required

Dashboard JSON model: the same JSON you see in Grafana's dashboard settings → JSON Model. It needs a title and usually holds panels, templating, time and schemaVersion; do not include id or uid here (the UID comes from the Dashboard UID input). Example: {"title": "API Latency", "panels": [], "schemaVersion": 41, "time": {"from": "now-6h", "to": "now"}}.

api_version

string

Optional

Version of the dashboard.grafana.app API to call. v1beta1 is served by Grafana 12 and later; v1 is the version shown in the latest Grafana docs. Defaults to v1beta1. One of: `v1beta1`, `v1`. Default: `v1beta1`.

dashboard_uid

string

Optional

UID to give the new dashboard (its metadata.name). Up to 40 letters, digits, '-' or '_'. Leave blank to let Grafana generate one with the 'Name Prefix' input or a default prefix. Example: api-latency.

folder_uid

string

Optional

UID of the folder to create the dashboard in (sets the grafana.app/folder annotation). Leave blank for the root (General) level. Example: nErXDvCkzz.

generate_name

string

Optional

Prefix for a server-generated UID (metadata.generateName), used only when Dashboard UID is blank. Defaults to 'dash-' if both are blank. Example: api-.

grafana_dashboard_get

Get dashboard

grafana_dashboard_list

List dashboard

grafana_dashboard_search

Search dashboard

grafana_dashboard_update

Update dashboard

Replace a Grafana dashboard's JSON model through the dashboard.grafana.app API, optionally moving it to another folder and recording a version message. Returns the updated Dashboard object with the new resourceVersion and generation. Use grafana_dashboard_update to change an existing dashboard; it replaces the whole spec, so start from grafana_dashboard_get. Use grafana_dashboard_create for a new dashboard. Requires the dashboard UID and its current JSON from grafana_dashboard_get.

Parameters

Name

Type

Required

Description

dashboard_uid

string

Required

UID of the dashboard to update. In the /apis endpoints this is the object's metadata.name; it is the uid shown in the dashboard URL (/d/<uid>/...) and in grafana_dashboard_search results. Example: cIBgcSjkk.

namespace

string

Required

spec

object

Required

The complete new dashboard JSON model. This replaces the existing spec, so send every panel and setting you want to keep. the same JSON you see in Grafana's dashboard settings → JSON Model. It needs a title and usually holds panels, templating, time and schemaVersion; do not include id or uid here (the UID comes from the Dashboard UID input). Example: {"title": "API Latency", "panels": [], "schemaVersion": 41, "time": {"from": "now-6h", "to": "now"}}.

api_version

string

Optional

folder_uid

string

Optional

UID of the folder the dashboard should be in (grafana.app/folder annotation). This is a full replace: pass the current folder UID to keep the dashboard where it is, or leave blank to put it at the root level. Example: nErXDvCkzz.

message

string

Optional

Commit message saved in the dashboard's version history (grafana.app/message annotation). Example: Add error-rate panel.

grafana_datasource_get

Get datasource

grafana_datasource_health_check

Check datasource health

grafana_datasource_query

Query datasource

grafana_folder_create

Create folder

grafana_folder_list

List folder

grafana_library_element_get

Get library element

grafana_library_element_list

List library element

grafana_org_get

Get org

grafana_org_user_list

List org user

grafana_public_dashboard_list

List public dashboard

grafana_silence_get

Get silence

grafana_silence_list

List silence

grafana_snapshot_get

Get snapshot

grafana_snapshot_list

List snapshot

grafana_team_search

Search team

For more tools, view docs.

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Grafana tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafana"], toolNames: [
    "grafana_alert_list",
    "grafana_datasource_query",
    "grafana_annotation_create"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Check firing alerts, query p95 latency for checkout-api, and annotate the deploy" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafana"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Check firing alerts, query p95 latency for checkout-api, and annotate the deploy" }],
  tools,
});

// Execute the tool call with the user's vaulted Grafana access token
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafana"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Check firing alerts, query p95 latency for checkout-api, and annotate the deploy" }],
  tools,
});

// Tool call runs with the user's vaulted Grafana access token
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafana"] }, pageSize: 100,
});

const agent = new Agent({
  name: "observability_agent",
  model: "gemini-2.5-pro",
  instruction: "Grafana tools scoped to this user",
  tools,
});

await agent.run("Check firing alerts, query p95 latency for checkout-api, and annotate the deploy");

Try these prompts

Copy any prompt into your agent. Each maps directly to a Grafana tool. Click to copy, paste into your agent, done.

Dashboards

Copy the prompt

Copied

Find the checkout service dashboard.

Copy the prompt

Copied

Create a folder called Payments for the payments team.

Copy the prompt

Copied

List the dashboards shared publicly.

Alerts

Copy the prompt

Copied

Which alerts are firing right now?

Copy the prompt

Copied

Silence the DiskPressure alert on db-2 for 2 hours.

Copy the prompt

Copied

Show the evaluation state of every alert rule.

Data and events

Copy the prompt

Copied

Query Prometheus for p95 latency on checkout-api over the last hour.

Copy the prompt

Copied

Annotate the checkout dashboard with today's 3pm deploy.

Copy the prompt

Copied

Run a health check on the Loki data source.

SEE HOW AUTH WORKS

Each user connects their own Grafana access token once, and Scalekit sends it with every call. Tokens stay vaulted, every call is scope checked, and every action is logged.

Authorize

Your user connects

Grafana

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Grafana

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Grafana

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Grafana

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other monitoring and developer tools connectors.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Engineering Teams

Engineering standup agent

Pulls commits from GitHub and GitLab, tracks issue movement in Jira, and posts a per-engineer standup brief to Slack. Each engineer's activity is read on their own delegated OAuth.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared Grafana access token looks fine in a demo. In production every silence and dashboard edit looks like one service account, and you cannot tell which user triggered it. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Grafana today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Grafana as the user or through a shared token?

As the user. Each user connects their own Grafana access token once, and Scalekit sends it with every call. Audit logs attribute every silence, annotation, and dashboard change to that user, not a shared service account.

Where is the Grafana access token stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. To rotate it, the user reconnects with a new access token. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.

Can I limit what the agent does in Grafana?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example the search, alert, and query tools without grafana_dashboard_update, which replaces a dashboard's JSON model, or grafana_silence_create. No Grafana tool deletes data. Scalekit also enforces scope checks before every API call.

What happens when a user revokes Grafana access?

The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Which Grafana organization does the agent work in?

The organization the user's access token belongs to. grafana_org_get returns it, and the data source, team, user, and snapshot tools act in that organization. grafana_current_user_get shows which Grafana user or service account the token authenticates.