prom-evidence-mcp
Allows querying Prometheus telemetry data with evidence (PromQL, timestamps, series count, warnings) for reliable AI-driven analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@prom-evidence-mcpcheck the error rate for the last 30 minutes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
prom-evidence-mcp
An evidence-first Prometheus MCP server. It lets an AI agent query production telemetry, but every response carries the receipts: the exact PromQL that ran, when it ran, how many series and samples came back, and explicit warnings when the data is empty, high cardinality, or too thin to support a trend.
Why
I spent years doing production incident response on systems processing over a million orders a day, and the lesson that stuck is that the most dangerous thing in an incident is not missing data, it is a confident conclusion built on partial data. Agents make this worse: they are fluent enough to turn three data points into a convincing root cause story.
This server takes a position: an agent should never be able to read telemetry without also receiving the evidence needed to doubt it. Concretely:
An empty result comes back with a warning that absence of data is not evidence of absence, and a pointer to verify the metric name first.
A range query with too few samples per series says plainly that trends computed on it are unreliable.
A high cardinality result warns that aggregates over hundreds of series are easy to misread.
target_healthexists so the agent can check whether the scrapes behind the numbers are even alive before reasoning about the numbers.
The evidence block is part of the tool contract, so a well-prompted agent cites its queries and coverage the same way a careful engineer pastes the graph link into the incident channel.
Related MCP server: observability-mcp
Tools
Tool | What it does |
| Evaluate a PromQL expression now (or at a timestamp), with evidence |
| Evaluate over a window with a step, with sample-coverage warnings |
| List or filter metric names, for verifying a metric exists before trusting an empty result |
| Up/down summary per scrape job, with last errors for down targets |
Every response is JSON with result plus an evidence object:
{
"evidence": {
"query": "sum(rate(http_requests_total[5m]))",
"endpoint": "/api/v1/query_range",
"executed_at": "2026-07-11T22:41:03.512Z",
"window": { "start": "2026-07-11T20:00:00Z", "end": "2026-07-11T22:00:00Z", "step": "60s" },
"duration_ms": 84,
"series_returned": 1,
"total_samples": 121,
"warnings": []
}
}Install
git clone https://github.com/elizabethpammi/prom-evidence-mcp
cd prom-evidence-mcp
npm install
npm run buildUse with Claude Code
claude mcp add prometheus --env PROMETHEUS_URL=https://your-prometheus.example.com -- node /path/to/prom-evidence-mcp/dist/index.jsUse with Claude Desktop
{
"mcpServers": {
"prometheus": {
"command": "node",
"args": ["/path/to/prom-evidence-mcp/dist/index.js"],
"env": { "PROMETHEUS_URL": "https://your-prometheus.example.com" }
}
}
}No Prometheus handy? Point it at the public PromLabs demo instance to try it out:
PROMETHEUS_URL=https://demo.promlabs.com npm run smokeConfiguration
Env var | Default | Meaning |
| required | Base URL of the Prometheus server |
|
| Per-request timeout |
|
| Series count above which results carry a cardinality warning |
|
| Samples per series below which range results carry a reliability warning |
Non-goals
This is a read-only window onto telemetry. It deliberately does not expose admin endpoints, remote write, or configuration reload. An agent that can read your metrics should not be one typo away from changing them.
License
MIT
Available Tools
4 toolsinstant_queryA
Run an instant PromQL query. The response includes an evidence block (exact query, execution time, series and sample counts, and warnings about empty or high cardinality results) that MUST be cited when making claims from this data.
| Name | Required | Description | Default |
|---|---|---|---|
| time | No | Optional RFC3339 or unix timestamp to evaluate at (defaults to now) | |
| promql | Yes | The PromQL expression to evaluate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the response structure (evidence block with exact query, execution time, series/sample counts, warnings) and mandates citation of that evidence. It does not mention side effects, rate limits, or auth, but for a read-only query tool this covers the most important behavioral aspects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero fluff. It front-loads the core purpose ('Run an instant PromQL query') and then adds the critical response/citation detail. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description explains the response's key components (evidence block) and the mandatory citation behavior. It also covers the instant evaluation nature. It omits potential error handling or edge cases, but for a straightforward query tool this is sufficient for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (promql and time) are already documented. The description does not add parameter-specific detail beyond the schema, which is acceptable; the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs an instant PromQL query, specifying the verb 'run' and the resource 'PromQL query'. The word 'instant' distinguishes it from likely time-range siblings like range_query, though it does not explicitly name them, so it's not a perfect 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for point-in-time queries via the word 'instant', but it does not explicitly state when to use this tool versus alternatives like range_query or list_metrics. There is no direct comparison or exclusion of sibling tools, leaving some inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_metricsA
List metric names known to this Prometheus, optionally filtered by a substring. Use this to verify a metric actually exists before concluding anything from an empty query result.
| Name | Required | Description | Default |
|---|---|---|---|
| contains | No | Optional case-insensitive substring filter |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the read-only nature implicitly ('List') and the substring filter behavior, but doesn't state whether the list is exhaustive, paginated, or limited in any way. For a simple read-only listing tool, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste. The core action and filter are front-loaded, and the usage guidance is a single actionable sentence. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter listing tool with no output schema, the description covers the action, the filter, and the use case. It doesn't describe the return format, but for a list of metric names that's a minor gap given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'contains' parameter as an optional case-insensitive substring filter. The description adds the purpose context (verifying metric existence) but no additional parameter-level detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('metric names known to this Prometheus'), and adds the optional substring filter. It clearly distinguishes itself from siblings like instant_query and range_query, which execute queries rather than enumerate metric names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when to use this tool: to verify a metric actually exists before concluding anything from an empty query result. This is clear usage guidance that also implies when not to use it (when you need actual values, use instant_query or range_query instead).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
range_queryA
Run a PromQL range query over a time window. The response includes an evidence block with sample coverage; if samples per series are low the evidence will say trends are unreliable, and that warning must be surfaced to the user.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | Window end, RFC3339 or unix timestamp | |
| step | No | Resolution step, e.g. 30s, 5m | 60s |
| start | Yes | Window start, RFC3339 or unix timestamp | |
| promql | Yes | The PromQL expression to evaluate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses a key behavioral trait: the response includes an evidence block with sample coverage, and if samples per series are low, the evidence will say trends are unreliable, and that warning must be surfaced to the user. This goes beyond the schema and annotations (which are absent), providing actionable behavioral context about output interpretation and user-facing obligations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no waste. The core action is front-loaded, and the critical behavioral warning about sample coverage is included without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core action and the most important output behavior (evidence block, sample coverage warning). It doesn't mention pagination, limits, or error cases, but for a query tool with a clear schema and no output schema, the essential context is present. The warning about surfacing unreliable trends is a valuable addition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description adds context about the time window and evidence block but doesn't add parameter-specific semantics beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a PromQL range query over a time window, which is a specific verb+resource combination. It distinguishes itself from instant_query (a point-in-time query) by explicitly mentioning 'range query over a time window'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for time-bounded PromQL queries and mentions the evidence block behavior, but it doesn't explicitly state when to use this vs instant_query or list_metrics. The sibling names provide context, but the description itself doesn't name alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
target_healthA
Summarize scrape target health (up/down counts per job). Check this first during an incident: query results are only as trustworthy as the scrapes behind them, and a down target silently turns into missing data everywhere else.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the behavioral burden. It discloses that a down target 'silently turns into missing data everywhere else' and ties tool output to query trustworthiness. It could mention read-only/no-side-effect behavior explicitly, but 'summarize' strongly implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both purposeful: the first states what the tool returns, the second states when and why to call it. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, simple summary tool, the description fully covers what it does, what it returns, and when to use it. No output schema is needed because the return shape is stated in plain language.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter information the description must add. The baseline for zero-parameter tools is 4, and the description appropriately focuses on output and usage rather than padding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Summarize') and names a precise resource ('scrape target health') with the exact output ('up/down counts per job'). It clearly stands apart from sibling query/list tools by focusing on health rather than data retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit situational guidance: 'Check this first during an incident' and explains why. It does not explicitly name alternatives or exclusions, but the context is clear enough that an agent can decide when this tool is the right first step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
instant_query - First observed
list_metrics - First observed
range_query - First observed
target_health
TDQS
Scored across 4 tools
Each tool targets a distinct operation: instant queries, range queries, metric listing, and target health. There is no overlap in purpose, and the descriptions reinforce when each should be used.
Names are lowercase snake_case and readable, with instant_query and range_query following a clear pattern. list_metrics and target_health deviate slightly from the adjective_noun style but remain predictable and unambiguous.
Four tools is well-scoped for a focused Prometheus evidence server, covering the essential query and health-check operations without unnecessary bloat.
The core workflow of verifying target health, confirming metric existence, and running instant/range queries is covered. Minor gaps exist such as label value enumeration or metric metadata, but agents can work around these with the available tools.
Maintenance
Related MCP Connectors
- SpanlyOAuthcom.spanly
MCP observability. Query live traffic, errors, duration, and alerts from your AI agent.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
A paid remote MCP for AI SDK eval dashboard, built to return verdicts, receipts, usage logs, and aud
Related MCP Servers
- AlicenseBqualityFmaintenanceA Model Context Protocol server that enables AI assistants to query Prometheus metrics, discover available data, and analyze system performance through natural language interactions.592 npmMIT
- AlicenseAqualityAmaintenanceUnified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend.126Apache 2.0
- AlicenseNot gradedqualityDmaintenanceA lean MCP server that provides LLM agents with transparent access to multiple Prometheus instances for metrics analysis and SRE operations.4GPL 2.0
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol server that enables AI agents to interact directly with Prometheus metrics data through natural language queries.MIT