Summary

Multi-tenancy is enforced on the server, not requested by the client.

In a shared Mimir the interesting question is not what the tools can do but whose data they can see. Here the tenant list comes from the authenticated user's Dex groups — resolved from GrafanaOrganization CRDs or a static map — and is applied to every query, so a client cannot ask for someone else's tenant. Everything is read-only, and the automatic truncation with a hint to narrow the query is the small touch that keeps a careless PromQL from filling the context window.

What it is

A Go server that wraps the Prometheus HTTP API in read-only tools. Deployed with OAuth enabled it also acts as a full OAuth 2.1 authorization server backed by Dex, resolving each authenticated user's Mimir tenants and enforcing them server-side.

What you get

18 read-only tools, all accepting optional `prometheus_url` and `org_id` overrides per call
`mcp_prometheus_execute_query` and `mcp_prometheus_execute_range_query` run PromQL, with timeout, limit, stats and lookback_delta
Discovery: `mcp_prometheus_get_metric_metadata`, `mcp_prometheus_list_label_names`, `mcp_prometheus_list_label_values`, `mcp_prometheus_find_series`
System state: `mcp_prometheus_get_targets`, `mcp_prometheus_get_build_info`, `mcp_prometheus_get_runtime_info`, `mcp_prometheus_get_flags`, `mcp_prometheus_get_config`, `mcp_prometheus_get_tsdb_stats`, `mcp_prometheus_check_ready`
Alerting: `mcp_prometheus_get_alerts`, `mcp_prometheus_get_alertmanagers`, `mcp_prometheus_get_rules`
`mcp_prometheus_query_exemplars` correlates with traces; `mcp_prometheus_get_targets_metadata` returns per-target metadata
Large results are truncated automatically with guidance for narrowing the query

Requirements

A pre-built binary, a source build with Go, or the Helm chart for Kubernetes. PROMETHEUS_URL points at Prometheus or Mimir, with basic auth, a bearer token or PROMETHEUS_ORGID as needed. `serve --transport stdio` runs locally without OAuth; production uses `--transport streamable-http --enable-oauth`, which needs MCP_OAUTH_ISSUER plus Dex configuration in DEX_ISSUER_URL, DEX_CLIENT_ID, DEX_CLIENT_SECRET and DEX_REDIRECT_URL. Tenancy resolves from GrafanaOrganization CRDs by default, or from a static group map.