mcp_prometheus_execute_queryLABSCO SUMMARY
Multi-tenancy is enforced on the server, not requested by the client.
In a shared Mimir the interesting question is not what the tools can do but whose data they can see. Here the tenant list comes from the authenticated user's Dex groups — resolved from GrafanaOrganization CRDs or a static map — and is applied to every query, so a client cannot ask for someone else's tenant. Everything is read-only, and the automatic truncation with a hint to narrow the query is the small touch that keeps a careless PromQL from filling the context window.
What it is
A Go server that wraps the Prometheus HTTP API in read-only tools. Deployed with OAuth enabled it also acts as a full OAuth 2.1 authorization server backed by Dex, resolving each authenticated user's Mimir tenants and enforcing them server-side.
What you get
- 18 read-only tools, all accepting optional
prometheus_urlandorg_idoverrides per call mcp_prometheus_execute_queryandmcp_prometheus_execute_range_queryrun PromQL, with timeout, limit, stats and lookback_delta- Discovery:
mcp_prometheus_get_metric_metadata,mcp_prometheus_list_label_names,mcp_prometheus_list_label_values,mcp_prometheus_find_series - System state:
mcp_prometheus_get_targets,mcp_prometheus_get_build_info,mcp_prometheus_get_runtime_info,mcp_prometheus_get_flags,mcp_prometheus_get_config,mcp_prometheus_get_tsdb_stats,mcp_prometheus_check_ready - Alerting:
mcp_prometheus_get_alerts,mcp_prometheus_get_alertmanagers,mcp_prometheus_get_rules mcp_prometheus_query_exemplarscorrelates with traces;mcp_prometheus_get_targets_metadatareturns per-target metadata- Large results are truncated automatically with guidance for narrowing the query
Requirements
A pre-built binary, a source build with Go, or the Helm chart for Kubernetes. PROMETHEUS_URL points at Prometheus or Mimir, with basic auth, a bearer token or PROMETHEUS_ORGID as needed. serve --transport stdio runs locally without OAuth; production uses --transport streamable-http --enable-oauth, which needs MCP_OAUTH_ISSUER plus Dex configuration in DEX_ISSUER_URL, DEX_CLIENT_ID, DEX_CLIENT_SECRET and DEX_REDIRECT_URL. Tenancy resolves from GrafanaOrganization CRDs by default, or from a static group map.
Setup effort
Build from source — git clone https://github.com/giantswarm/mcp-prometheus.git
USE CASES
01
Asking a metrics question in English
Get the PromQL run for you, instant or over a range, with the result summarised.
02
Finding out what is even being scraped
List label names and values, find series by matcher, and read target health.
03
Working an incident
Read active alerts and the rules behind them, then query the series that fired.
04
Going from a metric to a trace
Pull exemplars for the query so the spike has a request attached to it.
18 tools
Listed in project docs. Your client may show a different list.
mcp_prometheus_execute_range_querymcp_prometheus_get_metric_metadatamcp_prometheus_list_label_namesmcp_prometheus_list_label_valuesmcp_prometheus_find_seriesmcp_prometheus_get_targetsmcp_prometheus_get_build_infomcp_prometheus_get_runtime_infomcp_prometheus_get_flagsmcp_prometheus_get_configmcp_prometheus_get_tsdb_statsmcp_prometheus_check_readymcp_prometheus_get_alertsmcp_prometheus_get_alertmanagersmcp_prometheus_get_rulesmcp_prometheus_query_exemplarsmcp_prometheus_get_targets_metadataBEFORE YOU INSTALL
What to know first
Tools you get
18 tools named in the project's documentation. All 18 are read-only and need PROMETHEUS_URL set. With OAuth on, results are scoped to your Mimir tenants; prometheus_url and org_id are per-call parameters, not tools.
Requires
PROMETHEUS_URL in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://github.com/giantswarm/mcp-prometheus.git
cd mcp-prometheus
go build -o mcp-prometheus ./...MCP Clients
Any MCP client — stdio
The project publishes no client configuration. After the build, add the binary to your client as a local stdio server: the full path to mcp-prometheus as the command, serve as its argument, and PROMETHEUS_URL (your Prometheus or Mimir base URL) in its environment.
