← Back to search

io.github.grafana/mcp-grafana

grafana streamable_http Apache-2.0 Scanned 2d ago

An MCP server giving access to Grafana dashboards, data and more.

D
53.8 / 100

Versions

0.14.0latest
May 8, 2026
0.13.1
Apr 30, 2026
0.13.0
Apr 29, 2026
0.12.1
Apr 28, 2026
0.12.0
Apr 23, 2026
+ show 45 moreshow less
0.11.6
Apr 9, 2026
0.11.5
Apr 9, 2026
0.11.4
Apr 2, 2026
0.11.3
Mar 12, 2026
0.11.2
Feb 25, 2026
0.11.1
Feb 24, 2026
0.11.0
Feb 19, 2026
0.10.0
Feb 12, 2026
0.9.0
Jan 28, 2026
0.8.2
Jan 14, 2026
0.8.1
Jan 14, 2026
0.8.0
Jan 14, 2026
0.7.10
Dec 3, 2025
0.7.9
Nov 14, 2025
0.7.8
Oct 21, 2025
0.7.7-rc.3
Oct 15, 2025
0.7.7-rc.2
Oct 15, 2025
0.7.7-rc.1
Oct 15, 2025
0.7.6
Oct 15, 2025
0.7.5
Oct 15, 2025
0.7.4
Oct 15, 2025
0.7.3
Oct 10, 2025
0.7.2
Oct 1, 2025
0.7.1
Oct 1, 2025
0.7.0
Sep 25, 2025
0.6.5
Sep 5, 2025
0.6.4
Sep 4, 2025
0.6.3
Aug 19, 2025
0.6.2
Jul 23, 2025
0.6.1
Jul 18, 2025
0.5.0
Jun 14, 2025
0.4.2
Jun 3, 2025
0.4.1
May 21, 2025
0.4.0
May 19, 2025
0.3.0
May 6, 2025
0.2.6
Apr 17, 2025
0.2.5
Apr 11, 2025
0.2.4
Apr 1, 2025
0.2.3
Mar 24, 2025
0.2.2
Mar 21, 2025
0.2.1
Mar 13, 2025
0.2.0
Mar 12, 2025
0.1.2
Jan 28, 2025
0.1.1
Jan 17, 2025
0.1.0
Jan 16, 2025
v0.10.0latest
first seen Jun 5, 2026
v0.9.0
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 97

query_clickhouse
annotations: mismatch low

Query ClickHouse via Grafana. REQUIRED FIRST: Use list_clickhouse_tables to find tables, then describe_clickhouse_table to see column schemas, then query. Supports macros: $__timeFilter(column), $__from, $__to, $__interval, ${varname} Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms) Example: SELECT Timestamp, Body FROM otel_logs WHERE $__timeFilter(Timestamp)

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
list_clickhouse_tables
annotations: verified low

START HERE for ClickHouse: List available tables (name, database, engine, row count, size). NEXT: Use describe_clickhouse_table to see column schemas.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
describe_clickhouse_table
annotations: verified low

Get column schema for a ClickHouse table. Pass the database from list_clickhouse_tables results. NEXT: Use query_clickhouse with discovered column names.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_cloudwatch
annotations: verified low

Query AWS CloudWatch metrics via Grafana. Requires region. REQUIRED FIRST: Use list_cloudwatch_namespaces -> list_cloudwatch_metrics -> list_cloudwatch_dimensions -> then query. Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms) Common namespaces: AWS/EC2, AWS/ECS, AWS/RDS, AWS/Lambda, ECS/ContainerInsights Example dimensions: ECS: {ClusterName, ServiceName}, EC2: {InstanceId} Cross-account monitoring: Use accountId to query metrics from a specific source account (e.g. '123456789012') or 'all' to query all linked accounts. Only applicable when using a CloudWatch monitoring account datasource.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_cloudwatch_namespaces
annotations: verified low

START HERE for CloudWatch: List available namespaces (AWS/EC2, AWS/ECS, AWS/RDS, etc.). Requires region. Supports cross-account monitoring via optional accountId parameter. NEXT: Use list_cloudwatch_metrics with a namespace.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_cloudwatch_metrics
annotations: verified low

List metrics for a CloudWatch namespace. Requires region. Supports cross-account monitoring via optional accountId parameter. Use after list_cloudwatch_namespaces. NEXT: Use list_cloudwatch_dimensions\\, then query_cloudwatch.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_cloudwatch_dimensions
annotations: verified low

List dimension keys for a CloudWatch metric. Requires region. Supports cross-account monitoring via optional accountId parameter. Use after list_cloudwatch_metrics. NEXT: Use query_cloudwatch with discovered dimensions.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_snapshots
annotations: verified low

List Grafana dashboard snapshots with optional query and result limit filters.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_snapshot
annotations: verified low

Get a Grafana snapshot by key, including snapshot metadata and dashboard payload.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
create_snapshot
annotations: verified low

Create a Grafana snapshot from a full dashboard payload. Supports optional expiration and external snapshot fields.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
delete_snapshot
annotations: verified low

Delete a Grafana snapshot by snapshot key.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
get_annotations
annotations: verified low

Fetch Grafana annotations using filters such as dashboard UID, time range and tags.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
create_annotation
annotations: verified low

Create a new annotation on a dashboard or panel. Set format to 'graphite' and provide 'what' for Graphite-format annotations.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
update_annotation
annotations: verified low

Updates the provided properties of an annotation by ID. Only fields included in the request are modified; omitted fields are left unchanged.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
get_annotation_tags
annotations: verified low

Returns annotation tags with optional filtering by tag name. Only the provided filters are applied.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_datasources
annotations: verified low

List all configured datasources in Grafana. Use this to discover available datasources and their UIDs. Supports filtering by type and/or name (case-insensitive substring match) and pagination.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
create_datasource
annotations: verified low

Create a datasource. If type is ambiguous, call search_plugin_information first; install the plugin if needed. IMPORTANT: always call this tool twice. First call: provide only the type — the tool returns a field schema. After receiving the schema, you MUST ask the user for every required field value explicitly; do not infer or use defaults without user confirmation. Second call: provide the type, the display name in the top-level name argument, schemaReviewed=true, and the fields map populated with values confirmed by the user. Never handle credentials — remind the user to rotate any detected. Returns UID, health check, and a config page link.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
list_incidents
annotations: verified low

List Grafana incidents. Allows filtering by status ('active', 'resolved') and optionally including drill incidents. Returns a preview list with basic details.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
update_datasource
annotations: verified low

Update non-secret datasource fields by UID. Omitted fields are preserved. IMPORTANT: always call this tool twice. First call: provide only the uid — the tool returns the datasource's field schema. After receiving the schema, ask the user which fields they want to change and confirm each new value; do not infer or reset fields the user did not mention. Second call: provide the uid, schemaReviewed=true, and the changed values in the fields map. Returns an update message and a health check. For secrets, direct the user to the Grafana UI.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint true
get_datasource
annotations: verified low

Retrieves detailed information about a specific datasource by UID or name. Returns the full datasource model, including name, type, URL, access settings, JSON data, and secure JSON field status. Provide either uid or name; uid takes priority if both are given.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
check_datasources_health
annotations: verified low

Check datasource health. Filter by type or UIDs; omit both to check all.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_dashboard_by_uid
annotations: verified low

Retrieves the complete dashboard, including panels, variables, and settings, for a specific dashboard identified by its UID. The response includes 'apiVersion' and 'isV2': when 'isV2' is true the dashboard uses the v2 schema (panels live under 'elements' keyed by name, arranged by 'layout'; variables under 'variables'), otherwise it is classic v1 ('panels[]' with 'templating.list'). WARNING: Large dashboards can consume significant context window space. Consider using get_dashboard_summary for overview or get_dashboard_property for specific data instead.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
update_dashboard
annotations: verified low

Create or update a dashboard. Two modes: (1) Full JSON — provide 'dashboard' for new dashboards or complete replacements. (2) Patch — provide 'uid' + 'operations' to make targeted changes to an existing dashboard. One of these two modes is required; 'folderUid'\\, 'message'\\, and 'overwrite' are supplementary and do nothing on their own. Dashboard authoring guidance: if a saved query must support one\\, many\\, or All values from a multi-select variable inside a regex expression or matcher\\, save '${var:regex}' rather than plain '$var'. Saved dashboard annotation queries/definitions must be written into dashboard JSON under 'annotations.list'; the create_annotation tool creates annotation events and does not add a reusable dashboard annotation query/definition to the saved dashboard. For stat panels over the current dashboard range\\, make the query return the range-level result the stat should display; panel-side reduction only reduces returned series and does not compute peak-over-range or ratio-of-peaks semantics for you. Patch operations support JSONPaths like '$.panels[0].targets[0].expr'\\, '$.panels[1].title'\\, '$.panels[2].targets[0].datasource'\\, '$.templating.list/-'\\, and '$.annotations.list/-'. Append to arrays with '/- ' syntax: '$.panels/- '. Remove by index: {\"op\": \"remove\"\\, \"path\": \"$.panels[2]\"}. Multiple removes on the same array are automatically reordered to avoid index-shifting issues. Note: only numeric array indices are supported in patch paths; filter expressions like [?(@.id==2)] and wildcards like [*] are not supported. v2 dashboards (check 'isV2' from get_dashboard_by_uid) use a different shape: patch '$.elements.<name>.spec.title' or '$.elements.<name>.spec.data.spec.queries[0].spec' and edit '$.variables'/'$.layout' rather than '$.panels'/'$.templating.list'. Full-JSON saves containing top-level 'elements'/'layout' are written as v2 and require a Kubernetes-capable Grafana. After creating or updating a dashboard\\, verify that panel queries return data by using `run_panel_query` or the appropriate query tool (`query_prometheus`\\, `query_loki_logs`\\, etc.) to validate expressions before considering the task complete.

readOnlyHint false openWorldHint false destructiveHint true
get_dashboard_panel_queries
annotations: verified low

Retrieve panel queries from a Grafana dashboard. Supports all datasource types (Prometheus, Loki, CloudWatch, SQL, etc.) and row-nested panels. Optionally filter to a specific panel by ID with `panelId`. Optionally provide `variables` for template variable substitution, which populates `processedQuery` and `requiredVariables` fields. Returns an array of objects with fields: title, query (raw expression), datasource (object with uid and type), and optionally processedQuery, refId, and requiredVariables.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_dashboard_property
annotations: verified low

Get specific parts of a dashboard using JSONPath expressions to minimize context window usage. JSONPath targets the dashboard's native schema. Classic v1 paths: '$.title' (title)\\, '$.panels[*].title' (all panel titles)\\, '$.panels[0]' (first panel)\\, '$.templating.list' (variables)\\, '$.annotations.list' (saved dashboard annotation queries/definitions)\\, '$.tags' (tags)\\, '$.panels[*].targets[*].expr' (all queries). v2 dashboards (see isV2 from get_dashboard_by_uid) use different paths: '$.title'\\, '$.elements' (panels\\, keyed by name)\\, '$.variables' (variables)\\, '$.annotations'. Use this instead of get_dashboard_by_uid when you only need specific dashboard properties.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_dashboard_summary
annotations: verified low

Get a compact summary of a dashboard including title\\, panel count\\, panel types\\, variables\\, and other metadata without the full JSON. Use this for dashboard overview and planning modifications without consuming large context windows.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_loki_label_names
annotations: verified low

Lists all available label/field names (keys) found in logs within a specified Loki or VictoriaLogs datasource and time range. Returns a list of unique label strings (e.g., `[\"app\", \"env\", \"pod\"]`). If the time range is not provided, it defaults to the last hour.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_loki_label_values
annotations: verified low

Retrieves all unique values associated with a specific `labelName` within a Loki or VictoriaLogs datasource and time range. Returns a list of string values (e.g., for `labelName=\"env\"`, might return `[\"prod\", \"staging\", \"dev\"]`). Useful for discovering filter options. Defaults to the last hour if the time range is omitted.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
create_incident
annotations: verified low

Create a new Grafana incident. Requires title, severity, and room prefix. Allows setting status and labels. This tool should be used judiciously and sparingly, and only after confirmation from the user, as it may notify or alarm lots of people.

readOnlyHint false openWorldHint false destructiveHint false
query_loki_logs
annotations: verified low

Executes a log query against a Loki or VictoriaLogs datasource and returns matching log entries (or metric samples on Loki). Defaults to the last hour, a limit of 10 entries, and 'backward' direction (newest first). The `logql` parameter takes LogQL on Loki and LogsQL on VictoriaLogs (e.g., Loki: `{app=\"foo\"} |= \"error\"`; VictoriaLogs: `{app=\"foo\"} \"error\"`). To count matching log lines precisely, use a `count_over_time()` metric query with queryType='instant'. Prefer using `query_loki_stats` first to cheaply check whether a stream contains data (avoiding expensive queries against empty streams) and `list_loki_label_names` / `list_loki_label_values` to verify labels exist before querying. Note: `query_loki_stats` returns approximate storage-level counts, not exact log line counts. For broad queries that match many lines, set `format` to 'compact' to group results by stream and avoid repeating label metadata on every line. If this server enables the Loki cost guardrail, expensive queries are rejected before execution: query cost is bytes SCANNED, determined only by the stream selector and time range — line filters (|=) and parsers (| json) reduce what is returned, not what is scanned. Use a stream selector with at least one selective positive label matcher (never `{}`, `=~\".*\"`/`=~\".+\"`, or negative-only matchers), keep time ranges narrow, and check size with `query_loki_stats` first; rejected queries return rewrite guidance.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_loki_stats
annotations: verified low

Retrieves index-level statistics about log streams matching a given selector within a Loki or VictoriaLogs datasource and time range. Returns an object containing the count of streams, chunks, entries, and total bytes (e.g., `{\"streams\": 5, \"chunks\": 50, \"entries\": 10000, \"bytes\": 512000}`). **Important**: the `entries` count reflects storage-level index entries (chunk metadata), NOT the number of individual log lines matching the selector. To count actual matching log lines, use `query_loki_logs` with a `count_over_time()` metric query instead. On VictoriaLogs only `entries` is populated; the other fields remain zero. The `logql` parameter **must** be a simple label selector (e.g., `{app=\"nginx\", env=\"prod\"}`) and does not support line filters, parsers, or aggregations. Defaults to the last hour if the time range is omitted.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_loki_patterns
annotations: verified low

Retrieves detected log patterns from a Loki datasource for a given stream selector and time range. Returns a list of patterns, each containing a pattern string and a total count of occurrences. Patterns help identify common log structures and anomalies. The `logql` parameter must be a stream selector (e.g., `{job=\"nginx\"}`) and does not support line filters or aggregations. Defaults to the last hour if the time range is omitted. **Not supported on VictoriaLogs** datasources - use a `| stats` pipeline instead.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
grafana_api_request
annotations: verified low

Make an authenticated HTTP request to the Grafana API. Similar to 'gh api' for GitHub.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint true
get_query_examples
annotations: verified low

Get example queries for a specific datasource type. Provides sample queries with descriptions for Prometheus (PromQL), Loki (LogQL), ClickHouse (SQL with Grafana macros), CloudWatch (metric configurations), and InfluxDB (Flux and InfluxQL). Use this to understand query syntax and common patterns for each datasource. TIP: Use list_datasources to find datasource UIDs, or get_datasource if you know the exact name.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_elasticsearch
annotations: verified low

Executes a search query against an Elasticsearch or OpenSearch datasource and retrieves matching documents. Supports Lucene query syntax (e.g., 'status:200 AND host:server1') for both Elasticsearch and OpenSearch. Elasticsearch Query DSL JSON is also supported for Elasticsearch datasources only (not OpenSearch). Returns a list of documents with their index, ID, source fields, and optional score. Use this to search logs, metrics, or any indexed data stored in Elasticsearch or OpenSearch. Defaults to 10 results and sorts by @timestamp in descending order (newest first).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_graphite
annotations: verified low

WORKFLOW: list_graphite_metrics -> query_graphite.\n\nExecutes a Graphite render API query against a Graphite datasource and returns matching metric series with their datapoints. Supports the full Graphite target expression language including wildcard patterns (e.g. 'servers.web*.cpu.load5'), aggregation functions (e.g. 'sumSeries(app.*.requests)'), and tag-based queries (e.g. 'seriesByTag(\\'name=cpu.load\\')'). Datapoints with no recorded value are returned with a null value field. Time range defaults to the last hour if not specified.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_graphite_metrics
annotations: verified low

Discover available metric paths in a Graphite datasource by browsing the metric tree. Returns nodes matching the query pattern\\, each indicating whether it is a leaf metric (has data) or an expandable branch (has children). Use '*' as a wildcard at any level to enumerate the tree (e.g. '*' → top-level nodes\\, 'servers.*' → all second-level nodes under 'servers'). Drill down progressively to find the full metric path before querying with query_graphite.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_graphite_tags
annotations: verified low

List available tag names in a Graphite datasource that uses tag-based metrics. Returns a list of tag name strings (e.g. [\"name\"\\, \"env\"\\, \"region\"]). These tags can be used to build tag-based target expressions for query_graphite (e.g. seriesByTag('name=cpu.load\\,env=prod')). Optionally filter by a prefix. Requires Graphite to be configured with tag support.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_graphite_density
annotations: verified low

Analyses metric data density for one or more Graphite series over a time window.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_sift_analysis
annotations: verified low

Retrieves a specific analysis from an investigation by its UUID. The investigation ID and analysis ID should be provided as strings in UUID format.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
add_activity_to_incident
annotations: verified low

Add a note (userNote activity) to an existing incident's timeline using its ID. The note body can include URLs which will be attached as context. Use this to add context to an incident.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
get_incident
annotations: verified low

Get a single incident by ID. Returns the full incident details including title, status, severity, labels, timestamps, and other metadata.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
update_incident
annotations: verified low

Update an existing Grafana incident by ID. Allows changing the status ('active' or 'resolved'), the severity, and the title. Only the provided fields are changed. Use this to resolve an incident or to correct its severity or title as part of an on-call workflow.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
analyze_loki_labels
annotations: verified low

Audits a Loki label strategy and optionally diagnoses query performance. Returns per-label verdicts, missing base labels, normalisation issues, and a recommended set. Pass datasourceUid for live cardinality or labels for static scoring; both may be combined.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
create_folder
annotations: verified low

Create a Grafana folder. Provide a title and optional UID. Returns the created folder.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
suggest_loki_alloy_label_config
annotations: verified low

Generates an Alloy loki.process snippet enforcing an approved label set via stage.label_keep, with optional log-level normalisation and soft-enforcement placeholders.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
agento11y_manage_agents
annotations: verified low

Read the agent catalog of Grafana Agent Observability (the grafana-agento11y-app plugin): which agents send telemetry, what their system prompts and tools are, how their prompt versions evolved, and how each version scored. The catalog is derived from ingested telemetry, not from a registration step: an agent exists here once its generations have been seen. It answers "what is this agent" while agento11y_manage_conversations and agento11y_manage_generations answer "what did it do". Operations: - 'list': agents in this tenant, newest activity first. Each row carries the latest effective version, first and latest seen times, generation and version counts, tool count, a system prompt prefix, and token_estimate. Paginated via limit and cursor - 'get': one agent version in full: the complete system prompt, every tool with its JSON schema, and the models it ran on. Returns the latest version unless 'version' is set - 'list_versions': the version history of one agent, one row per effective version with its seen window, generation count, tool count, and token_estimate. Paginated - 'list_version_scores': evaluation score aggregates per version, with per-evaluator score_key, pass and fail counts, and mean_score. Use it to compare how versions scored Versions: an effective version is always 'sha256:<64 lowercase hex>', and only that form is accepted by 'get'; a declared version such as '1.4.2' is reported in the declared_version fields but cannot be looked up. The plugin derives the effective version from the first of these the telemetry carries: the version the SDK reported, a hash of the declared version, a hash of the system prompt. Adding, removing, or editing a tool never mints a new version. Editing the prompt mints one only for an agent that reports neither its own effective version nor a declared version, so an agent that declares '1.4.2' keeps one effective version across prompt edits. Response size: 'get' returns the whole system prompt plus every tool schema, which can be tens of thousands of tokens. Check token_estimate.total from 'list' or 'list_versions' before fetching, and prefer the system_prompt_prefix in those rows when a prefix is enough. Cross-referencing: pass an agent name from 'list' to agento11y_manage_conversations as the search filter agent = "<name>" to find what that agent actually did. Pagination: when a response carries next_cursor, call the same operation again with cursor set to it. For 'list', also repeat the same name_prefix, start_time, and end_time using absolute RFC3339 times; the cursor is bound to those filters and a relative value such as now-7d or 7d re-resolves and is rejected. Permissions: every operation is a read and needs grafana-agento11y-app.data:read (Agento11y Editor or Admin). This tool performs no writes. When to use: - Discovering which agent names exist before filtering conversations or generations by agent - Reading the system prompt or tool inventory an agent ran with, or how they changed between versions - Checking whether a new prompt version scores worse than the previous one When NOT to use: - Reading individual conversations, generations, or their scores (use agento11y_manage_conversations and agento11y_manage_generations) - Inspecting evaluators or the rules that schedule them (use agento11y_manage_evaluators and agento11y_manage_eval_rules)

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_influxdb
annotations: mismatch low

Query an InfluxDB datasource via Grafana. Supports both InfluxQL (v1.x) and Flux (v2.x). The 'dialect' parameter selects the query language; if omitted it's inferred from the datasource configuration. Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms) InfluxQL example: SELECT mean("value") FROM "cpu" WHERE time > now() - 1h GROUP BY time(1m) Flux example: from(bucket: "metrics") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "cpu")

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
query_quickwit
annotations: verified low

Executes a search query against a Quickwit datasource and retrieves matching documents. Supports Lucene query syntax (e.g., 'severity_text:ERROR AND service_name:api') and partial Elasticsearch-compatible Query DSL JSON. The timestamp field is resolved from Quickwit index metadata (not jsonData.timeField). Returns a list of documents with their index, ID, source fields, and optional score. Use this to search logs or other indexed data stored in Quickwit. Defaults to 10 results and sorts by the index timestamp field in descending order (newest first).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_provisioning_repositories
annotations: verified low

List provisioning repositories (e.g. git-sync sources) configured for this Grafana instance.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
validate_provisioning_file
annotations: verified low

Validate a file in a provisioning repository at a given branch or commit by dry-run applying it.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_plugin
annotations: verified low

Check whether a Grafana plugin is installed and retrieve its details (name, version, type, enabled status). Returns installed=false when the plugin is not found. Use install_plugin when a plugin is not installed to install plugin after confirming this action with the user.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
install_plugin
annotations: verified low

Install a Grafana plugin by its plugin ID. If the version is not already confirmed with the user, omit it — the tool will look up the latest version and return it for confirmation before installing.

readOnlyHint false openWorldHint true idempotentHint false destructiveHint false
search_plugin_information
annotations: verified low

Search the Grafana plugin catalog by keyword to discover available plugins before installing or getting plugin details on a specific instance.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
list_snowflake_tables
annotations: verified low

START HERE for Snowflake: List available tables (database, schema, name, kind, row count, size) via INFORMATION_SCHEMA. NEXT: Use describe_snowflake_table to see column schemas.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
describe_snowflake_table
annotations: verified low

Get column schema for a Snowflake table. Pass the database/schema from list_snowflake_tables results. NEXT: Use query_snowflake with discovered column names.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_assertions
annotations: verified low

Get assertion summary for a given entity with its type, name, env, site, namespace, and a time range

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_sift_investigation
annotations: verified low

Retrieves an existing Sift investigation by its UUID. The ID should be provided as a string in UUID format (e.g. '02adab7c-bf5b-45f2-9459-d71a2c29e11b').

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
agento11y_manage_conversations
annotations: verified low

List, search, and fetch LLM conversations from Grafana Agent Observability (the grafana-agento11y-app plugin). Operations: - 'list': recent conversations (lightweight; id, title, generation count, timestamps), paginated via limit and cursor - 'search': search conversations by filter expression and time range; results include models, agents, error counts, rating and eval summaries, and trace IDs - 'get': one conversation by ID with all its generations, including full prompts and outputs (can be large) Filter syntax for 'search': key operator value, with the value in double quotes; multiple filters are separated by spaces and combined with AND. Filter keys (trace): model, provider, agent, agent.version, status, error.type, error.category, duration, tool.name, operation, namespace, cluster, service Filter keys (metadata): generation_count, eval.passed, eval.evaluator_id, eval.score_key, eval.score Operators: =, !=, >, <, >=, <=, =~ (regex) Example: status = "error" agent = "claude-code" Pagination: when a response has next_cursor, fetch the next page by calling the same operation again with cursor set to next_cursor. For 'search', also repeat the same filters, start_time, and end_time as the first call, using absolute RFC3339 times; relative ranges like now-24h shift between calls and the cursor will be rejected. When to use: - Debugging an AI application: find failing or low-rated conversations, then inspect their generations - Reviewing evaluation results and user ratings across conversations When NOT to use: - Fetching a single generation or its evaluation scores (use agento11y_manage_generations)

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
agento11y_manage_generations
annotations: verified low

Fetch a single LLM generation and its evaluation scores from Grafana Agent Observability (the grafana-agento11y-app plugin). Operations: - 'get': full generation detail by ID, including prompt, output, model, and usage (can be large) - 'scores': evaluation scores for a generation (evaluator, score key, score type, value, passed, explanation) When to use: - Drilling into one generation found via agento11y_manage_conversations - Checking why an evaluation passed or failed for a specific generation When NOT to use: - Searching or listing conversations (use agento11y_manage_conversations)

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
search_dashboards
annotations: verified low

Search for Grafana dashboards by a query string. Returns a list of matching dashboards with details like title, UID, folder, tags, and URL.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
search_folders
annotations: verified low

Search for Grafana folders by a query string. Returns matching folders with details like title, UID, and URL.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_teams
annotations: verified low

Search for Grafana teams by a query string. Returns a list of matching teams with details like name, ID, and URL.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_users_by_org
annotations: verified low

List users in the Grafana organization. Returns a list of organization users with details like userid, email, role etc.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_all_roles
annotations: verified low

List all roles in Grafana. Optionally filter to show only roles that can be delegated by the current user. Returns role details including UID, name, permissions, and metadata.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_role_details
annotations: verified low

Get detailed information about a specific Grafana role by its UID, including permissions, metadata, and configuration.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_role_assignments
annotations: verified low

List all assignments for a specific role, showing which users, teams, and service accounts have been assigned this role.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_user_roles
annotations: verified low

List all roles assigned to one or more users. Returns a map of user IDs to their assigned roles, excluding built-in roles and team-inherited roles.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_team_roles
annotations: verified low

List all roles assigned to one or more teams. Returns a map of team IDs to their assigned roles.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_resource_permissions
annotations: verified low

List all permissions set on a specific Grafana resource (e.g., dashboard, datasource, folder) by its type and ID.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_resource_description
annotations: verified low

List available permissions and assignment capabilities for a Grafana resource type.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_panel_image
annotations: verified low

Render a Grafana dashboard panel or full dashboard as a PNG image. Returns the image as base64 encoded data. Requires the Grafana Image Renderer service to be installed.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_snowflake
annotations: mismatch low

Query Snowflake via Grafana. REQUIRED FIRST: Use list_snowflake_tables to find tables (filter by database/schema), then describe_snowflake_table to see column schemas, then query. Supports macros: $__timeFilter(column), $__timeFrom, $__timeTo, $__from, $__to, $__interval, $__interval_ms, ${varname} Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms) Snowflake event tables (telemetry from logging APIs/auto-instrumentation) live in the database/schema configured by the EVENT TABLE setting; the standard one is SNOWFLAKE.TELEMETRY.EVENTS. Example: SELECT TIMESTAMP, RECORD['severity_text']::STRING AS LEVEL, VALUE FROM SNOWFLAKE.TELEMETRY.EVENTS WHERE $__timeFilter(TIMESTAMP) AND RECORD_TYPE = 'LOG'

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
list_sift_investigations
annotations: verified low

Retrieves a list of Sift investigations with an optional limit. If no limit is specified, defaults to 10 investigations.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
find_error_pattern_logs
annotations: verified low

Searches Loki logs for elevated error patterns compared to the last day's average, waits for the analysis to complete, and returns the results including any patterns found.

readOnlyHint false openWorldHint false destructiveHint false
find_slow_requests
annotations: verified low

Searches relevant Tempo datasources for slow requests, waits for the analysis to complete, and returns the results.

readOnlyHint false openWorldHint false destructiveHint false
list_prometheus_metric_metadata
annotations: verified low

List Prometheus metric metadata. Returns metadata about metrics currently scraped from targets. Note: This endpoint is experimental.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_prometheus
annotations: verified low

WORKFLOW: list_prometheus_metric_names -> list_prometheus_label_values -> query_prometheus. Query a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.) using a PromQL expression. Supports instant queries (single point) and range queries (time range). Time: RFC3339 or relative expressions like 'now'\\, 'now-1h'.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_prometheus_metric_names
annotations: verified low

DISCOVERY: Call this first to find available metrics before querying. Lists metric names in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Retrieves all metric names and filters them using the provided regex. Supports pagination and an optional time range to restrict results to metrics active within that window.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_prometheus_label_names
annotations: verified low

List label names in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Allows filtering by series selectors and time range.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_prometheus_label_values
annotations: verified low

Use after list_prometheus_metric_names to find label values for filtering queries. Gets the values for a specific label name in a PromQL-compatible datasource (Prometheus, Thanos, Mimir, Cloud Monitoring, etc.). Allows filtering by series selectors and time range.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_prometheus_histogram
annotations: verified low

Query Prometheus histogram percentiles. DISCOVER FIRST: Use list_prometheus_metric_names with regex='.*_bucket$' to find histograms. Generates histogram_quantile PromQL. Example: metric='http_duration', percentile=95, labels='job="api"' Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms)

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
run_panel_query
annotations: mismatch low

Executes one or more dashboard panel queries with optional time range and variable overrides. Accepts an array of panel IDs to query in a single call. Fetches the dashboard\\, extracts queries from the specified panels\\, substitutes template variables and Grafana macros ($__range\\, $__rate_interval\\, $__interval)\\, and routes to the appropriate datasource (Prometheus\\, Loki\\, ClickHouse\\, CloudWatch\\, InfluxDB\\, BigQuery\\, MSSQL\\, or PostgreSQL). Returns results keyed by panel ID - partial failures are allowed (some panels can succeed while others fail). Use get_dashboard_summary first to find panel IDs. If a panel uses a template variable datasource you cannot access\\, provide datasourceUid and datasourceType to override.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_oncall_schedules
annotations: verified low

List Grafana OnCall schedules, optionally filtering by team ID. If a specific schedule ID is provided, retrieves details for only that schedule. Returns a list of schedule summaries including ID, name, team ID, timezone, and shift IDs. Supports pagination.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_oncall_shift
annotations: verified low

Get detailed information for a specific Grafana OnCall shift using its ID. A shift represents a designated time period within a schedule when users are actively on-call. Returns the full shift details.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_current_oncall_users
annotations: verified low

Get the list of users currently on-call for a specific Grafana OnCall schedule ID. Returns the schedule ID, name, and a list of detailed user objects for those currently on call.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_oncall_teams
annotations: verified low

List teams configured in Grafana OnCall. Returns a list of team objects with their details. Supports pagination.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_oncall_users
annotations: verified low

List users from Grafana OnCall. These are OnCall users (separate from Grafana users). Can retrieve all users in the OnCall directory, a specific user by ID, or filter by username. Returns a list of user objects with their details. Supports pagination.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_alert_groups
annotations: verified low

List alert groups from Grafana OnCall with filtering options. Supports filtering by alert group ID, route ID, integration ID, state (new, acknowledged, resolved, silenced), team ID, time range, labels, and name. For time ranges, use format '{start}_{end}' ISO 8601 timestamp range (e.g., '2025-01-19T00:00:00_2025-01-19T23:59:59' for a specific day). For labels, use format 'key:value' (e.g., ['env:prod', 'severity:high']). Returns a list of alert group objects with their details. Supports pagination.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
get_alert_group
annotations: verified low

Get a specific alert group from Grafana OnCall by its ID. Returns the full alert group details, including the most recent alert and its raw payload when the OnCall API provides them. Alert payloads carry integration-specific fingerprints (for example Sentry's payload.data.event.hashes or Alertmanager's payload.alerts[].fingerprint) that identify recurring alerts across different alert groups.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
update_alert_group
annotations: verified low

Update the state of a Grafana OnCall alert group: acknowledge, unacknowledge, resolve, or unresolve it by ID. Returns the alert group's resulting OnCall state (one of new, acknowledged, resolved, silenced), or a stateWarning explaining why that state could not be read back after a successful update.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
list_athena_catalogs
annotations: verified low

START HERE for Athena: List available data catalogs (e.g. AwsDataCatalog, Iceberg connectors). NEXT: Use list_athena_databases with a catalog.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_athena_databases
annotations: verified low

List databases in an Athena catalog. Use after list_athena_catalogs. NEXT: Use list_athena_tables with a database.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_athena_tables
annotations: verified low

List tables in an Athena database. Use after list_athena_databases. NEXT: Use describe_athena_table to see column schemas before querying.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
describe_athena_table
annotations: verified low

Get column names for an Athena table. Use after list_athena_tables. NEXT: Use query_athena with discovered column names.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
query_athena
annotations: mismatch low

Query Amazon Athena via Grafana. REQUIRED FIRST: Use list_athena_catalogs -> list_athena_databases -> list_athena_tables -> describe_athena_table to discover schema, then query. Supports macros: $__timeFilter(column), $__dateFilter(column), $__unixEpochFilter(column), $__timeFrom(), $__timeTo(), $__from, $__to, $__interval, ${varname} Time formats: 'now-1h', '2026-02-02T19:00:00Z', '1738519200000' (Unix ms) Athena queries are async — Grafana handles polling. Use LIMIT and partition-aware WHERE clauses to avoid timeouts on large tables. Example: SELECT request_time, status FROM my_table WHERE $__timeFilter(request_time) LIMIT 100

readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
generate_deeplink
annotations: verified low

Generate deeplink URLs for Grafana resources. Supports dashboards (requires dashboardUid or provisioningPreview), panels (requires dashboardUid or provisioningPreview, plus panelId), and Explore queries (requires datasourceUid and optionally queries). For dashboard and panel links, provisioningPreview points at a dashboard staged on a provisioning repository branch (e.g. a git-sync PR preview). For explore links, the time range and queries are embedded inside the Grafana explore state. Set shorten=true to also attempt a /goto/<uid> short URL; if shortening fails, the full deeplink is returned.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false

Permissions 4

network medium
Server uses network capabilities via: aiohttp, fetch(), httpx
filesystem low
Server uses filesystem capabilities via: fs, os, pathlib
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 419

medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
medium
Tool 'query_clickhouse' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'list_clickhouse_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_clickhouse_table' annotations are consistent annotation_checker · 80%
info
Tool 'query_cloudwatch' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_namespaces' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_dimensions' annotations are consistent annotation_checker · 80%
info
Tool 'list_snapshots' annotations are consistent annotation_checker · 80%
info
Tool 'get_snapshot' annotations are consistent annotation_checker · 80%
info
Tool 'create_snapshot' annotations are consistent annotation_checker · 80%
info
Tool 'delete_snapshot' annotations are consistent annotation_checker · 80%
info
Tool 'get_annotations' annotations are consistent annotation_checker · 80%
info
Tool 'create_annotation' annotations are consistent annotation_checker · 80%
info
Tool 'update_annotation' annotations are consistent annotation_checker · 80%
info
Tool 'get_annotation_tags' annotations are consistent annotation_checker · 80%
info
Tool 'list_datasources' annotations are consistent annotation_checker · 80%
info
Tool 'create_datasource' annotations are consistent annotation_checker · 80%
info
Tool 'update_datasource' annotations are consistent annotation_checker · 80%
info
Tool 'get_datasource' annotations are consistent annotation_checker · 80%
info
Tool 'check_datasources_health' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_by_uid' annotations are consistent annotation_checker · 80%
info
Tool 'update_dashboard' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_panel_queries' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_property' annotations are consistent annotation_checker · 80%
medium
Tool 'query_influxdb' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'query_quickwit' annotations are consistent annotation_checker · 80%
medium
Tool 'query_athena' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'generate_deeplink' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Tool 'query_snowflake' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'list_snowflake_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_snowflake_table' annotations are consistent annotation_checker · 80%
info
Tool 'get_assertions' annotations are consistent annotation_checker · 80%
info
Tool 'get_sift_investigation' annotations are consistent annotation_checker · 80%
info
Tool 'get_sift_analysis' annotations are consistent annotation_checker · 80%
info
Tool 'list_sift_investigations' annotations are consistent annotation_checker · 80%
info
Tool 'find_error_pattern_logs' annotations are consistent annotation_checker · 80%
info
Tool 'find_slow_requests' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_metric_metadata' annotations are consistent annotation_checker · 80%
info
Tool 'query_prometheus' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_metric_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_label_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_label_values' annotations are consistent annotation_checker · 80%
info
Tool 'query_prometheus_histogram' annotations are consistent annotation_checker · 80%
medium
Tool 'run_panel_query' claims readOnly but name implies write operation annotation_checker · 80%
info
Tool 'list_oncall_schedules' annotations are consistent annotation_checker · 80%
info
Tool 'get_oncall_shift' annotations are consistent annotation_checker · 80%
info
Tool 'get_current_oncall_users' annotations are consistent annotation_checker · 80%
info
Tool 'list_oncall_teams' annotations are consistent annotation_checker · 80%
info
Tool 'list_oncall_users' annotations are consistent annotation_checker · 80%
info
Tool 'list_alert_groups' annotations are consistent annotation_checker · 80%
info
Tool 'get_alert_group' annotations are consistent annotation_checker · 80%
info
Tool 'update_alert_group' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_catalogs' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_databases' annotations are consistent annotation_checker · 80%
medium
Excessive dependency count: 171 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: go.opentelemetry.io/otel@1.43.0 (GO-2026-5158) dependency_analyzer · 95%
medium
Vulnerable dependency: github.com/klauspost/compress@1.18.5 (GO-2026-5841) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/mod@0.35.0 (GO-2026-6179) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/mod@0.35.0 (GO-2026-6180) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.55.0 (GO-2026-5942) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/text@0.37.0 (GO-2026-5970) dependency_analyzer · 95%
medium
Vulnerable dependency: google.golang.org/grpc@1.80.0 (GHSA-hrxh-6v49-42gf) dependency_analyzer · 95%
medium
Vulnerable dependency: google.golang.org/grpc@1.80.0 (GO-2026-6061) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in grafana-mcp-grafana-a5151e7/tools/agento11y_agents_test.go:25 entropy_analyzer · 70%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: query_clickhouse manifest_parser · 85%
info
Tool: list_clickhouse_tables manifest_parser · 85%
info
Tool: describe_clickhouse_table manifest_parser · 85%
info
Tool: query_cloudwatch manifest_parser · 85%
info
Tool: list_cloudwatch_namespaces manifest_parser · 85%
info
Tool: list_cloudwatch_metrics manifest_parser · 85%
info
Tool: list_cloudwatch_dimensions manifest_parser · 85%
info
Tool: list_snapshots manifest_parser · 85%
info
Tool: get_snapshot manifest_parser · 85%
info
Tool: create_snapshot manifest_parser · 85%
info
Tool: delete_snapshot manifest_parser · 85%
info
Tool: get_annotations manifest_parser · 85%
info
Tool: create_annotation manifest_parser · 85%
info
Tool: update_annotation manifest_parser · 85%
info
Tool: get_annotation_tags manifest_parser · 85%
info
Tool: list_datasources manifest_parser · 85%
info
Tool: create_datasource manifest_parser · 85%
info
Tool: update_datasource manifest_parser · 85%
info
Tool: get_datasource manifest_parser · 85%
info
Tool: check_datasources_health manifest_parser · 85%
info
Tool: get_dashboard_by_uid manifest_parser · 85%
info
Tool: query_loki_stats manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Tool: update_dashboard manifest_parser · 85%
info
Tool: get_dashboard_panel_queries manifest_parser · 85%
info
Tool: get_dashboard_property manifest_parser · 85%
info
Tool: get_dashboard_summary manifest_parser · 85%
info
Tool: list_loki_label_names manifest_parser · 85%
info
Tool: list_loki_label_values manifest_parser · 85%
info
Tool: query_loki_logs manifest_parser · 85%
info
Tool: query_loki_patterns manifest_parser · 85%
info
Tool: grafana_api_request manifest_parser · 85%
info
Tool: get_query_examples manifest_parser · 85%
info
Tool: query_elasticsearch manifest_parser · 85%
info
Tool: query_graphite manifest_parser · 85%
info
Tool: list_graphite_metrics manifest_parser · 85%
info
Tool: list_graphite_tags manifest_parser · 85%
info
Tool: query_graphite_density manifest_parser · 85%
info
Tool: list_incidents manifest_parser · 85%
info
Tool: create_incident manifest_parser · 85%
info
Tool: add_activity_to_incident manifest_parser · 85%
info
Tool: get_incident manifest_parser · 85%
info
Tool: update_incident manifest_parser · 85%
info
Tool: analyze_loki_labels manifest_parser · 85%
info
Tool: create_folder manifest_parser · 85%
info
Tool: suggest_loki_alloy_label_config manifest_parser · 85%
info
Tool: agento11y_manage_agents manifest_parser · 85%
info
Tool: query_influxdb manifest_parser · 85%
info
Tool: query_quickwit manifest_parser · 85%
info
Tool: list_provisioning_repositories manifest_parser · 85%
info
Tool: validate_provisioning_file manifest_parser · 85%
info
Tool: get_plugin manifest_parser · 85%
info
Tool: install_plugin manifest_parser · 85%
info
Tool: search_plugin_information manifest_parser · 85%
info
Tool: agento11y_manage_conversations manifest_parser · 85%
info
Tool: agento11y_manage_generations manifest_parser · 85%
info
Tool: search_dashboards manifest_parser · 85%
info
Tool: search_folders manifest_parser · 85%
info
Tool: list_teams manifest_parser · 85%
info
Tool: list_users_by_org manifest_parser · 85%
info
Tool: list_all_roles manifest_parser · 85%
info
Tool: get_role_details manifest_parser · 85%
info
Tool: get_role_assignments manifest_parser · 85%
info
Tool: list_user_roles manifest_parser · 85%
info
Tool: list_team_roles manifest_parser · 85%
info
Tool: get_resource_permissions manifest_parser · 85%
info
Tool: get_resource_description manifest_parser · 85%
info
Tool: get_panel_image manifest_parser · 85%
info
Tool: query_snowflake manifest_parser · 85%
info
Tool: list_snowflake_tables manifest_parser · 85%
info
Tool: describe_snowflake_table manifest_parser · 85%
info
Tool: get_assertions manifest_parser · 85%
info
Tool: get_sift_investigation manifest_parser · 85%
info
Tool: get_sift_analysis manifest_parser · 85%
info
Tool: list_sift_investigations manifest_parser · 85%
info
Tool: find_error_pattern_logs manifest_parser · 85%
info
Tool: find_slow_requests manifest_parser · 85%
info
Tool: list_prometheus_metric_metadata manifest_parser · 85%
info
Tool: query_prometheus manifest_parser · 85%
info
Tool: list_prometheus_metric_names manifest_parser · 85%
info
Tool: list_prometheus_label_names manifest_parser · 85%
info
Tool: list_prometheus_label_values manifest_parser · 85%
info
Tool: query_prometheus_histogram manifest_parser · 85%
info
Tool: run_panel_query manifest_parser · 85%
info
Tool: list_oncall_schedules manifest_parser · 85%
info
Tool: get_oncall_shift manifest_parser · 85%
info
Tool: get_current_oncall_users manifest_parser · 85%
info
Tool: list_oncall_teams manifest_parser · 85%
info
Tool: list_oncall_users manifest_parser · 85%
info
Tool: list_alert_groups manifest_parser · 85%
info
Tool: get_alert_group manifest_parser · 85%
info
Tool: update_alert_group manifest_parser · 85%
info
Tool: list_athena_catalogs manifest_parser · 85%
info
Tool: list_athena_databases manifest_parser · 85%
info
Tool: list_athena_tables manifest_parser · 85%
info
Tool: describe_athena_table manifest_parser · 85%
info
Tool: query_athena manifest_parser · 85%
info
Tool: generate_deeplink manifest_parser · 85%
info
Required env vars (23) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'create_datasource': Directive language: 'you must' poisoning · 85%
critical
Tool poisoning in 'create_datasource': Directive language: 'always' poisoning · 85%
critical
Tool poisoning in 'update_datasource': Directive language: 'always' poisoning · 85%
info
SBOM generated: 355 components sbom_generator · 100%
info
Tool 'get_dashboard_summary' annotations are consistent annotation_checker · 80%
info
Tool 'list_loki_label_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_loki_label_values' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_logs' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_stats' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_patterns' annotations are consistent annotation_checker · 80%
info
Tool 'grafana_api_request' annotations are consistent annotation_checker · 80%
info
Tool 'get_query_examples' annotations are consistent annotation_checker · 80%
info
Tool 'query_elasticsearch' annotations are consistent annotation_checker · 80%
info
Tool 'query_graphite' annotations are consistent annotation_checker · 80%
info
Tool 'list_graphite_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'list_graphite_tags' annotations are consistent annotation_checker · 80%
info
Tool 'query_graphite_density' annotations are consistent annotation_checker · 80%
info
Tool 'list_incidents' annotations are consistent annotation_checker · 80%
info
Tool 'create_incident' annotations are consistent annotation_checker · 80%
info
Tool 'add_activity_to_incident' annotations are consistent annotation_checker · 80%
info
Tool 'get_incident' annotations are consistent annotation_checker · 80%
info
Tool 'update_incident' annotations are consistent annotation_checker · 80%
info
Tool 'analyze_loki_labels' annotations are consistent annotation_checker · 80%
info
Tool 'create_folder' annotations are consistent annotation_checker · 80%
info
Tool 'suggest_loki_alloy_label_config' annotations are consistent annotation_checker · 80%
info
Tool 'agento11y_manage_agents' annotations are consistent annotation_checker · 80%
info
Tool 'list_provisioning_repositories' annotations are consistent annotation_checker · 80%
info
Tool 'validate_provisioning_file' annotations are consistent annotation_checker · 80%
info
Tool 'get_plugin' annotations are consistent annotation_checker · 80%
info
Tool 'install_plugin' annotations are consistent annotation_checker · 80%
info
Tool 'search_plugin_information' annotations are consistent annotation_checker · 80%
info
Tool 'agento11y_manage_conversations' annotations are consistent annotation_checker · 80%
info
Tool 'agento11y_manage_generations' annotations are consistent annotation_checker · 80%
info
Tool 'search_dashboards' annotations are consistent annotation_checker · 80%
info
Tool 'search_folders' annotations are consistent annotation_checker · 80%
info
Tool 'list_teams' annotations are consistent annotation_checker · 80%
info
Tool 'list_users_by_org' annotations are consistent annotation_checker · 80%
info
Tool 'list_all_roles' annotations are consistent annotation_checker · 80%
info
Tool 'get_role_details' annotations are consistent annotation_checker · 80%
info
Tool 'get_role_assignments' annotations are consistent annotation_checker · 80%
info
Tool 'list_user_roles' annotations are consistent annotation_checker · 80%
info
Tool 'list_team_roles' annotations are consistent annotation_checker · 80%
info
Tool 'get_resource_permissions' annotations are consistent annotation_checker · 80%
info
Tool 'get_resource_description' annotations are consistent annotation_checker · 80%
info
Tool 'get_panel_image' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_athena_table' annotations are consistent annotation_checker · 80%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
info
Tool: list_team_roles manifest_parser · 85%
info
Tool 'find_slow_requests' annotations are consistent annotation_checker · 80%
info
Tool 'query_graphite' annotations are consistent annotation_checker · 80%
info
Tool 'list_graphite_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'list_graphite_tags' annotations are consistent annotation_checker · 80%
info
Tool 'query_graphite_density' annotations are consistent annotation_checker · 80%
info
Tool 'create_folder' annotations are consistent annotation_checker · 80%
info
Tool 'list_incidents' annotations are consistent annotation_checker · 80%
info
Tool 'list_team_roles' annotations are consistent annotation_checker · 80%
info
Tool 'get_resource_permissions' annotations are consistent annotation_checker · 80%
info
Tool 'get_resource_description' annotations are consistent annotation_checker · 80%
info
Tool 'query_athena' annotations are consistent annotation_checker · 80%
info
Tool 'generate_deeplink' annotations are consistent annotation_checker · 80%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: get_panel_image manifest_parser · 85%
info
Tool: suggest_loki_alloy_label_config manifest_parser · 85%
info
Tool: query_clickhouse manifest_parser · 85%
info
Tool: list_clickhouse_tables manifest_parser · 85%
info
Tool: describe_clickhouse_table manifest_parser · 85%
info
Tool: query_elasticsearch manifest_parser · 85%
info
Tool: get_plugin manifest_parser · 85%
info
Tool: install_plugin manifest_parser · 85%
info
Tool: search_plugin_information manifest_parser · 85%
info
Tool: get_sift_investigation manifest_parser · 85%
info
Tool: get_sift_analysis manifest_parser · 85%
info
Tool: list_sift_investigations manifest_parser · 85%
info
Tool: find_error_pattern_logs manifest_parser · 85%
info
Tool: find_slow_requests manifest_parser · 85%
info
Tool: query_graphite manifest_parser · 85%
info
Tool: list_graphite_metrics manifest_parser · 85%
info
Tool: list_graphite_tags manifest_parser · 85%
info
Tool: query_graphite_density manifest_parser · 85%
info
Tool: create_folder manifest_parser · 85%
info
Tool: list_incidents manifest_parser · 85%
info
Tool: create_incident manifest_parser · 85%
info
Tool: add_activity_to_incident manifest_parser · 85%
info
Tool: get_incident manifest_parser · 85%
info
Tool: search_dashboards manifest_parser · 85%
info
Tool: search_folders manifest_parser · 85%
info
Tool: list_loki_label_names manifest_parser · 85%
info
Tool: list_loki_label_values manifest_parser · 85%
low
Tool 'create_incident' has no annotations annotation_checker · 100%
info
Tool: query_loki_logs manifest_parser · 85%
info
Tool: query_loki_stats manifest_parser · 85%
info
Tool: query_loki_patterns manifest_parser · 85%
info
Tool: query_snowflake manifest_parser · 85%
info
Tool: list_snowflake_tables manifest_parser · 85%
info
Tool: describe_snowflake_table manifest_parser · 85%
info
Tool: list_prometheus_metric_metadata manifest_parser · 85%
info
Tool: query_prometheus manifest_parser · 85%
info
Tool: list_prometheus_metric_names manifest_parser · 85%
info
Tool: list_prometheus_label_names manifest_parser · 85%
info
Tool 'get_role_assignments' annotations are consistent annotation_checker · 80%
info
Tool: list_prometheus_label_values manifest_parser · 85%
info
Tool: query_prometheus_histogram manifest_parser · 85%
info
Tool: get_query_examples manifest_parser · 85%
info
Tool: query_cloudwatch manifest_parser · 85%
info
Tool: list_cloudwatch_namespaces manifest_parser · 85%
info
Tool: list_cloudwatch_metrics manifest_parser · 85%
info
Tool: list_cloudwatch_dimensions manifest_parser · 85%
info
Tool: list_teams manifest_parser · 85%
info
Tool: list_users_by_org manifest_parser · 85%
info
Tool: list_all_roles manifest_parser · 85%
info
Tool: get_role_details manifest_parser · 85%
info
Tool: get_role_assignments manifest_parser · 85%
info
Tool: list_user_roles manifest_parser · 85%
info
Tool 'list_user_roles' annotations are consistent annotation_checker · 80%
info
Tool: get_resource_permissions manifest_parser · 85%
info
Tool: get_resource_description manifest_parser · 85%
info
Tool: run_panel_query manifest_parser · 85%
info
Tool: list_datasources manifest_parser · 85%
info
Tool: get_datasource manifest_parser · 85%
info
Tool: query_influxdb manifest_parser · 85%
info
Tool: get_dashboard_by_uid manifest_parser · 85%
info
Tool: update_dashboard manifest_parser · 85%
info
Tool: get_dashboard_panel_queries manifest_parser · 85%
info
Tool: get_dashboard_property manifest_parser · 85%
info
Tool: get_dashboard_summary manifest_parser · 85%
info
Tool: grafana_api_request manifest_parser · 85%
info
Tool: analyze_loki_labels manifest_parser · 85%
info
Tool: get_assertions manifest_parser · 85%
info
Tool: list_oncall_schedules manifest_parser · 85%
info
Tool: get_oncall_shift manifest_parser · 85%
info
Tool: get_current_oncall_users manifest_parser · 85%
info
Tool: list_oncall_teams manifest_parser · 85%
info
Tool: list_oncall_users manifest_parser · 85%
info
Tool: list_alert_groups manifest_parser · 85%
info
Tool: get_alert_group manifest_parser · 85%
info
Tool: get_annotations manifest_parser · 85%
info
Tool: create_annotation manifest_parser · 85%
info
Tool: update_annotation manifest_parser · 85%
info
Tool: get_annotation_tags manifest_parser · 85%
info
Tool: list_athena_catalogs manifest_parser · 85%
info
Tool: list_athena_databases manifest_parser · 85%
info
Tool: list_athena_tables manifest_parser · 85%
info
Tool: describe_athena_table manifest_parser · 85%
info
Tool: query_athena manifest_parser · 85%
info
Tool: generate_deeplink manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (13) manifest_parser · 80%
info
Tool 'get_panel_image' annotations are consistent annotation_checker · 80%
info
Tool 'suggest_loki_alloy_label_config' annotations are consistent annotation_checker · 80%
info
Tool 'query_clickhouse' annotations are consistent annotation_checker · 80%
info
Tool 'list_clickhouse_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_clickhouse_table' annotations are consistent annotation_checker · 80%
info
Tool 'query_elasticsearch' annotations are consistent annotation_checker · 80%
info
Tool 'get_plugin' annotations are consistent annotation_checker · 80%
info
Tool 'install_plugin' annotations are consistent annotation_checker · 80%
info
Tool 'search_plugin_information' annotations are consistent annotation_checker · 80%
info
Tool 'get_sift_investigation' annotations are consistent annotation_checker · 80%
info
Tool 'get_sift_analysis' annotations are consistent annotation_checker · 80%
info
Tool 'list_sift_investigations' annotations are consistent annotation_checker · 80%
info
Tool 'find_error_pattern_logs' annotations are consistent annotation_checker · 80%
medium
Tool 'add_activity_to_incident' claims readOnly but name implies write operation annotation_checker · 80%
info
Tool 'get_incident' annotations are consistent annotation_checker · 80%
info
Tool 'search_dashboards' annotations are consistent annotation_checker · 80%
info
Tool 'search_folders' annotations are consistent annotation_checker · 80%
info
Tool 'list_loki_label_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_loki_label_values' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_logs' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_stats' annotations are consistent annotation_checker · 80%
info
Tool 'query_loki_patterns' annotations are consistent annotation_checker · 80%
info
Tool 'query_snowflake' annotations are consistent annotation_checker · 80%
info
Tool 'list_snowflake_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_snowflake_table' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_metric_metadata' annotations are consistent annotation_checker · 80%
info
Tool 'query_prometheus' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_metric_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_label_names' annotations are consistent annotation_checker · 80%
info
Tool 'list_prometheus_label_values' annotations are consistent annotation_checker · 80%
info
Tool 'query_prometheus_histogram' annotations are consistent annotation_checker · 80%
info
Tool 'get_query_examples' annotations are consistent annotation_checker · 80%
info
Tool 'query_cloudwatch' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_namespaces' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'list_cloudwatch_dimensions' annotations are consistent annotation_checker · 80%
info
Tool 'list_teams' annotations are consistent annotation_checker · 80%
info
Tool 'list_users_by_org' annotations are consistent annotation_checker · 80%
info
Tool 'list_all_roles' annotations are consistent annotation_checker · 80%
info
Tool 'get_role_details' annotations are consistent annotation_checker · 80%
medium
Tool 'run_panel_query' claims readOnly but name implies write operation annotation_checker · 80%
info
Tool 'list_datasources' annotations are consistent annotation_checker · 80%
info
Tool 'get_datasource' annotations are consistent annotation_checker · 80%
info
Tool 'query_influxdb' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_by_uid' annotations are consistent annotation_checker · 80%
info
Tool 'update_dashboard' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_panel_queries' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_property' annotations are consistent annotation_checker · 80%
info
Tool 'get_dashboard_summary' annotations are consistent annotation_checker · 80%
info
Tool 'grafana_api_request' annotations are consistent annotation_checker · 80%
info
Tool 'analyze_loki_labels' annotations are consistent annotation_checker · 80%
info
Tool 'get_assertions' annotations are consistent annotation_checker · 80%
info
Tool 'list_oncall_schedules' annotations are consistent annotation_checker · 80%
info
Tool 'get_oncall_shift' annotations are consistent annotation_checker · 80%
info
Tool 'get_current_oncall_users' annotations are consistent annotation_checker · 80%
info
Tool 'list_oncall_teams' annotations are consistent annotation_checker · 80%
info
Tool 'list_oncall_users' annotations are consistent annotation_checker · 80%
info
Tool 'list_alert_groups' annotations are consistent annotation_checker · 80%
info
Tool 'get_alert_group' annotations are consistent annotation_checker · 80%
info
Tool 'get_annotations' annotations are consistent annotation_checker · 80%
info
Tool 'create_annotation' annotations are consistent annotation_checker · 80%
medium
Tool 'update_annotation' claims readOnly but name implies write operation annotation_checker · 80%
info
Tool 'get_annotation_tags' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_catalogs' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_databases' annotations are consistent annotation_checker · 80%
info
Tool 'list_athena_tables' annotations are consistent annotation_checker · 80%
info
Tool 'describe_athena_table' annotations are consistent annotation_checker · 80%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
medium
Excessive dependency count: 164 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5025) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5026) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5027) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5028) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5029) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.53.0 (GO-2026-5030) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/sys@0.43.0 (GO-2026-5024) dependency_analyzer · 95%
info
SLSA Build Level 3 detected slsa_assessor · 85%
info
Could not connect to MCP server for output poisoning scan output_poisoning · 100%
info
Could not connect to MCP server for behavioral verification behavioral_verifier · 100%
info
SBOM generated: 164 components sbom_generator · 100%
info
MITRE ATLAS technique coverage summary atlas_annotator · 100%
info
ATLAS: Adversarial ML Supply Chain (AML.T0043) atlas_annotator · 100%
info
ATLAS: Poison Training Data (AML.T0020) atlas_annotator · 100%
info
go.mod metadata manifest_parser · 100%