# mcp-grafana

In-cluster MCP server for read-only Grafana, Prometheus, Alertmanager, and Loki
diagnostics.

## Tools

- `get_grafana_health()` - Grafana health/status.
- `list_datasources()` - compact datasource inventory.
- `query_prometheus()` - instant PromQL through Grafana's Prometheus datasource proxy.
- `query_prometheus_range()` - range PromQL through Grafana's Prometheus datasource proxy.
- `list_prometheus_alerts()` - Prometheus alert state from the datasource proxy.
- `list_alertmanager_alerts()` - Alertmanager alerts from the datasource proxy.
- `query_loki()` - Loki range query through the Grafana datasource proxy.

`query_prometheus`, `list_prometheus_alerts`, and `list_alertmanager_alerts`
default to the `prometheus` and `alertmanager` datasource UIDs provisioned by
kube-prometheus-stack. `query_loki` defaults to the `loki` UID pinned in
`romaine-life/osms`.

## Auth

Inbound transport is gated by `kube-rbac-proxy` using Kubernetes
TokenReview/SubjectAccessReview, matching the other romaine.life MCP servers.

Outbound calls to Grafana use the calling session pod's `auth.romaine.life`
service-principal JWT, forwarded by the pod's `mcp-auth-proxy` sidecar in the
`X-Auth-Romaine-Token` header. Grafana validates that JWT via its `[auth.jwt]`
configuration, so this server does not mint or store a separate Grafana service
account token.