That table is the reason to run this with a purpose-built service account rather than an Editor token: you can grant datasources:query on two specific datasource UIDs and know exactly which tools still work. The optional categories go the same way — administration and the heavier datasource integrations are off until named, so a connection starts narrow and widens on purpose. Worth knowing before your first call: fetching a large dashboard by UID returns the whole JSON, and the summary and property tools exist precisely because that can swallow a context window.
Grafana's own server for a Grafana instance, open source or Cloud. It reaches dashboards, datasources and the query languages behind them, plus alerting, incidents, Sift investigations, OnCall and administration.
- Dashboards found, read whole or in parts, summarized without the full JSON, and created or updated — search_dashboards, get_dashboard_by_uid, get_dashboard_summary, get_dashboard_property, get_dashboard_panel_queries, update_dashboard
- Datasources listed and resolved by UID or name, with example queries per type — list_datasources, get_datasource, get_query_examples
- Prometheus queried directly, including histograms, with metric names, metadata and label discovery — query_prometheus, query_prometheus_histogram, list_prometheus_metric_names, list_prometheus_metric_metadata, list_prometheus_label_names, list_prometheus_label_values
- Loki logs, patterns, stats and labels — query_loki_logs, query_loki_patterns, query_loki_stats, list_loki_label_names, list_loki_label_values
- Optional datasource categories that stay off until you enable them: ClickHouse, CloudWatch, InfluxDB, Snowflake, Elasticsearch and Quickwit, each with its own query and table tools
- Profiling through Pyroscope — query_pyroscope, list_pyroscope_profile_types, list_pyroscope_label_names, list_pyroscope_label_values
- Alerting and on-call: alert rules, routing and silences managed, alert groups and schedules read, and who is on call right now — alerting_manage_rules, alerting_manage_routing, alerting_manage_silences, list_alert_groups, get_current_oncall_users, list_oncall_schedules
- Incident response: incidents created, updated and annotated, and Sift investigations run to find error patterns and slow requests — create_incident, update_incident, add_activity_to_incident, list_incidents, find_error_pattern_logs, find_slow_requests, get_sift_analysis
- The surrounding furniture — folders, annotations, snapshots, deeplinks, provisioning checks, rendered panel images, and Grafana Assistant — create_folder, get_annotations, create_annotation, create_snapshot, generate_deeplink, get_panel_image, list_provisioning_repositories, ask_assistant
- Administration behind its own switch: teams, users, roles, assignments and resource permissions — list_teams, list_users_by_org, list_all_roles, get_role_details, get_resource_permissions
Grafana 9.0 or later, and a service account token in GRAFANA_SERVICE_ACCOUNT_TOKEN with GRAFANA_URL pointing at the instance — your own host, or the Grafana Cloud URL. Run it with uvx as mcp-grafana, or from the binary, Docker image or Helm chart. Permissions are per tool: each one needs its own RBAC action and a matching scope, such as datasources:query on datasources:uid:prometheus-prod. Whole categories — Admin, Assistant, ClickHouse, CloudWatch, Snowflake, Elasticsearch, Quickwit, Examples and run_panel_query among them — stay off until you name them in --enabled-tools.
One command plus a key — uvx mcp-grafana, then supply credentials