Prometheus Safe MCP
# Prometheus Safe MCP
A focused, read-only MCP server for bounded Prometheus instant queries, active alerts, and target health. **Alpha:** tests use synthetic HTTP responses; compatibility with a live Prometheus release is not certified.
## Install and run
Requires Python 3.11+ and `uv`.
```sh
uv sync --extra test
export PROMETHEUS_SAFE_URL=https://prometheus.example.invalid
uv run prometheus-safe-mcp
```
The process speaks MCP over stdio. It does not load `.env`; `.env.example` is documentation only. Configure the URL of a read-only, network-restricted Prometheus endpoint.
## Safety
All tools use HTTP GET. Query length, HTTP duration/bytes, and returned target count are bounded. Configuration rejects URL credentials, queries, fragments, and non-HTTP schemes. Audit records contain operation categories rather than PromQL text or response bodies. This does not replace upstream authentication, authorization, or egress policy. See [security design](docs/SECURITY-DESIGN.md).
## Verify
```sh
uv run --extra test pytest
uv run python -m compileall -q src tests
uv build
```
MIT © 2026 Ben Gauger.
TDQS
Scored across 3 tools
Each tool targets a clearly distinct aspect of Prometheus: querying metrics, listing active alerts, and checking target health. There is no functional overlap between them, making tool selection unambiguous.
All three tool names follow a consistent snake_case convention with a noun-like pattern (prometheus_query, active_alerts, target_health). The names are predictable and reflect their purpose without mixing conventions.
Three tools is a lean but reasonable count for a minimal Prometheus integration, covering the most common read-only operations. It feels slightly thin for a full-featured server but is appropriate for a focused purpose.
The surface covers core operations (query, alerts, health) but lacks obvious complementary features like range queries, alert rule management, or metric metadata retrieval. Agents may need to work around these gaps for more complex workflows.