Grafana Cloud MCP server for AI agents

Live

OAUTH 2.1

OBSERVABILITY

Monitoring

Grafana Cloud MCP gives your agent observability across your Grafana stack: query metrics, logs, and traces, read dashboards and alert rules, check who is on call, and manage incidents and investigations.

  • Per-user credentials: each call uses the actual user's token, never a shared bot.
  • Encrypted per-tenant vault: AES-256, resolved at request time, never in LLM context.
  • Scoped before every call: pre-call scope check, 90-day SIEM-exportable audit chain.
Grafana Cloud MCP
agent · Acme Q3
Run
Which alert groups fired in the last hour, and who is on call for the payments schedule?
S
grafanacloudmcp_list_alert_groups
131ms
Observability agent
3 alert groups fired in the last hour, 2 of them still unresolved. Maya Chen is on call for the payments schedule.
Sources: Grafana OnCall alert groups, last 1 hour
grafanacloudmcp
3 alert groups
18:29
Message Claude...

Tools your observability agent reaches for on Grafana Cloud, scoped per user.

CALL ANY TOOL
138 tools for observability in Grafana Cloud: query Prometheus, Loki, Tempo, and Pyroscope, read dashboards and alert rules, check on-call users, and create incidents, annotations, and investigations.
grafanacloudmcp_add_activity_to_incident
Add activity to incident
Add a note (userNote activity) to an existing incident's timeline using its ID. The note body can include URLs which will be attached as context. Use this to add context to an incident.
Parameters
Name
Type
Required
Description
body
string
Required
The body of the activity. URLs will be parsed and attached as context
incidentId
string
Required
The ID of the incident to add the activity to
eventTime
string
Optional
The time that the activity occurred. If not provided, the current time will be used
grafanacloudmcp_agento11y_manage_agents
Agento11y manage agents
grafanacloudmcp_agento11y_manage_evaluators
Agento11y manage evaluators
grafanacloudmcp_alerting_routing_write
Write alerting routing
grafanacloudmcp_alerting_rules_read
Read alerting rules
grafanacloudmcp_app_observability_handler
App observability handler
grafanacloudmcp_assistant_search
Search assistant
grafanacloudmcp_create_alert_creation
Create alert creation
grafanacloudmcp_create_folder
Create folder
grafanacloudmcp_delete_annotation
Delete annotation
grafanacloudmcp_diff_tempo_traces
Diff tempo traces
grafanacloudmcp_get_alert_group
Get alert group
grafanacloudmcp_get_assistant_conversation
Get assistant conversation
grafanacloudmcp_get_dashboard_summary
Get dashboard summary
grafanacloudmcp_get_investigation
Get investigation
grafanacloudmcp_get_plugin
Get plugin
grafanacloudmcp_get_role_assignments
Get role assignments
grafanacloudmcp_grafana_api_request
Grafana api request
grafanacloudmcp_list_alert_groups
List alert groups
grafanacloudmcp_list_cloudwatch_metrics
List cloudwatch metrics
grafanacloudmcp_list_incident_custom_fields
List incident custom fields
grafanacloudmcp_list_oncall_schedules
List oncall schedules
grafanacloudmcp_list_prometheus_metric_names
List prometheus metric names
grafanacloudmcp_list_sql_tables
List sql tables
grafanacloudmcp_query_cloudwatch
Query cloudwatch
grafanacloudmcp_query_influxdb
Query influxdb
grafanacloudmcp_query_prometheus_histogram
Query prometheus histogram
grafanacloudmcp_resolve_alert_creation
Resolve alert creation
grafanacloudmcp_search_docs
Search docs
grafanacloudmcp_update_alert_group
Update alert group

For more tools, view docs.

Build your Agent
Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.
Python · LlamaIndex
import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Grafana Cloud tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafanacloudmcp"], toolNames: [
    "grafanacloudmcp_query_prometheus",
    "grafanacloudmcp_query_loki_logs",
    "grafanacloudmcp_list_alert_groups"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Check the checkout service error rate, pull its recent error logs, and list the alert groups that fired in the last hour" }] });
import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafanacloudmcp"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Check the checkout service error rate, pull its recent error logs, and list the alert groups that fired in the last hour" }],
  tools,
});

// Execute the tool call with the user's vaulted Grafana Cloud OAuth token
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");
import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafanacloudmcp"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Check the checkout service error rate, pull its recent error logs, and list the alert groups that fired in the last hour" }],
  tools,
});

// Tool call runs with the user's vaulted Grafana Cloud OAuth token
await sk.tools.executeTool(msg.content, "user_123");
import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["grafanacloudmcp"] }, pageSize: 100,
});

const agent = new Agent({
  name: "observability_agent",
  model: "gemini-2.5-pro",
  instruction: "Grafana Cloud tools scoped to this user",
  tools,
});

await agent.run("Check the checkout service error rate, pull its recent error logs, and list the alert groups that fired in the last hour");
Try these prompts
Copy any prompt into your agent. Each maps directly to a Grafana Cloud MCP tool. Click to copy, paste into your agent, done.
Metrics, logs, and traces
Copy the prompt
Copied
Query Prometheus for the p95 request latency of the checkout service over the last 6 hours.
Copy the prompt
Copied
Show the error logs from the api namespace in Loki for the last 30 minutes.
Copy the prompt
Copied
Search Tempo for traces slower than 2 seconds in the last hour.
Dashboards and alerts
Copy the prompt
Copied
Search my dashboards for anything tagged kubernetes.
Copy the prompt
Copied
List the alert rules that are currently firing.
Copy the prompt
Copied
Show the queries behind the panels on the API latency dashboard.
On-call and incidents
Copy the prompt
Copied
Who is on call right now for the payments schedule?
Copy the prompt
Copied
List the active incidents.
Copy the prompt
Copied
Start an investigation into why checkout latency rose this morning.
SEE HOW AUTH WORKS
Each user signs in to Grafana Cloud once, and Scalekit stores and refreshes their tokens. Credentials stay vaulted, every call is scope checked, and every action is logged.
1
Authorize
Your user connects
Grafana Cloud MCP
once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access
Who:
user ‘A’
when:
Once per user
access:
Limited to user
2
Store
Their
Grafana Cloud MCP
token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection
vault:
encrypted
scope:
per-user
tokens:
auto-refreshed
3
Resolve
When your agent calls a
Grafana Cloud MCP
tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs
speed:
~40ms
check:
before every call
seen by:
nobody
4
Audit
Every
Grafana Cloud MCP
tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it
history:
90 days
export:
SIEM-ready
logged:
every call
Test other agents
See the same per-user auth pattern across other monitoring connectors.
Engineering Teams
DevOps assistant agent
Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.
Engineering Teams
Engineering standup agent
Pulls commits from GitHub and GitLab, tracks issue movement in Jira, and posts a per-engineer standup brief to Slack. Each engineer's activity is read on their own delegated OAuth.
Test other agents
See the same per-user auth pattern across other monitoring connectors.
ENGINEERING
DevOps assistant agent
Poll GitHub for failing checks and stale pull requests, open Linear issues for the ones that need work, and digest to Slack.
ENGINEERING
Engineering standup agent
Pull commits from GitHub and GitLab, track Jira issue movement, and post a per-engineer standup brief to Slack.
Why Scalekit
Secure your agent's access. Connectors ship in minutes
01.
Shared tokens break per-user analytics
A shared Grafana Cloud OAuth token looks fine in a demo. In production every alert silence and dashboard change looks like one service account, and you cannot tell which user triggered it. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.
// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓
02.
Authentication is not authorization
03.
Multi-tenancy is architectural
04.
Grafana Cloud today. Ten connectors tomorrow.
“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”
Venu Madhav Kattagoni
Head of Engineering / Von
FAQs
Frequently Asked Questions
Does the agent access Grafana Cloud as the user or through a shared service account?
As the user. Each user signs in to Grafana Cloud once, and Scalekit stores and refreshes their tokens. Every query, incident, and dashboard change in your audit trail is attributed to that user, not a shared service account.
Where is the Grafana Cloud OAuth token stored?
In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.
Can I limit what the agent does in Grafana Cloud?
Yes. Filter by tool name in listScopedTools to expose only what you want, for example the query and list tools without grafanacloudmcp_alerting_rules_write, which creates, updates, and deletes alert rules, or grafanacloudmcp_delete_annotation, which permanently deletes an annotation. Scalekit also enforces scope checks before every API call.
What happens when a user revokes Grafana Cloud access?
The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.
Which data sources can the agent query?
The ones configured in the user's Grafana stack. Dedicated tools query Prometheus, Loki, Tempo, Pyroscope, Graphite, InfluxDB, Elasticsearch, CloudWatch, and SQL databases, and grafanacloudmcp_list_datasources shows what is available.
Start in your coding agent
Up and running in one command
Install the Scalekit skill in your editor of choice. Connector, auth, tools, prompt, all wired up
Claude Code REPL
/plugin marketplace add scalekit-inc/claude-code-authstack
/plugin install agentkit@scalekit-auth-stack
Cursor Code REPL
# ~/.cursor/mcp.json
{
""mcpServers"": {
""grafanacloudmcp"": {
""url"": ""https://mcp.scalekit.com/grafanacloudmcp"",
""headers"": { ""Authorization"": ""Bearer $SCALEKIT_TOKEN"" }
}
}
}
Codex Code REPL
# ~/.codex/config.toml
[mcp_servers.grafanacloudmcp]
url = ""https://mcp.scalekit.com/grafanacloudmcp""
auth_env = ""SCALEKIT_TOKEN""
Copilot Code REPL
# .vscode/mcp.json
{
""servers"": {
""grafanacloudmcp"": {
""url"": ""https://mcp.scalekit.com/grafanacloudmcp"",
""type"": ""http""
}
}
}