Skip to main content

Set up the Grafana MCP server

The Grafana Cloud MCP server gives agents access to your whole observability stack — dashboards, Prometheus metrics, Loki logs, Pyroscope profiles, alerting, incidents, and OnCall. This guide covers connecting it to MintMCP using per-user OAuth.

Prerequisites​

  • A MintMCP admin account
  • A Grafana Cloud account and your instance URL (e.g. https://<instance>.grafana.net)
  • Connecting users need the Assistant Cloud MCP User role (or the grafana-assistant-app.cloud-mcp:access permission) and must have accepted the Grafana Assistant terms

Add Grafana to MintMCP​

Grafana is pre-listed as a recommended server in the MintMCP MCP store. Each team member authorizes with their own Grafana Cloud account through per-user OAuth. Grafana's MCP server supports dynamic client registration, so MintMCP registers automatically.

  1. In MintMCP, go to MCP store > Manage store.
  2. Find Grafana in the recommended servers list.
  3. Click Install.

Connect as a user​

The first time a user connects, Grafana asks for the Grafana Cloud instance URL, then shows a consent page with two permission levels:

  • Read — view dashboards, alerts, and incidents, and query data sources. Always available.
  • Write — create and modify dashboards, alerts, incidents, and Assistant investigations. Optional; if left unchecked, write tools stay unavailable for that user. Organization admins can grant write access by default; other users need the Assistant Admin role.

What the connector exposes​

AreaWhat users can do
Dashboards and navigationSearch dashboards and folders, retrieve and update dashboards, create folders, generate deeplinks
MetricsRun Prometheus queries, discover metrics and explore labels
LogsRun Loki queries, detect log patterns, get statistics
ProfilingQuery Pyroscope profiling data
Data sourcesList and inspect data source configurations, run ClickHouse SQL queries, fetch AWS CloudWatch metrics
AlertingManage alert rules and notification routing
Incident responseCreate and track incidents, manage OnCall schedules and shifts
InvestigationsCreate and inspect Grafana Assistant investigations
RenderingExport panel images and infrastructure summaries

Security considerations​

  • Every request runs as the signed-in Grafana Cloud user, so existing RBAC roles and data source permissions apply unchanged, and MintMCP's audit log attributes each tool call to that user.
  • Keep the write scope unchecked for users who only need to query and explore. Write access can modify production dashboards and alert rules.
  • OAuth tokens expire after 30 days, after which users re-authorize — a stolen token has a bounded lifetime.
  • Use tool customization to expose read-only tools to roles that shouldn't be editing dashboards or alerts.

Troubleshooting​

  • Authorization fails or access is denied — Confirm the user has the Assistant Cloud MCP User role (or the grafana-assistant-app.cloud-mcp:access permission) and has accepted the Grafana Assistant terms in their Grafana Cloud instance.
  • Write tools are missing — The user left the write scope unchecked at consent, or lacks the rights to grant it (org admin or Assistant Admin role). Reconnect and check write access.
  • Connection stops working after a month — Grafana Cloud MCP tokens expire after 30 days. Reconnect to re-authorize.
  • Self-hosted Grafana — The hosted server at mcp.grafana.com works with Grafana Cloud only. For an instance you run yourself, see Set up the Grafana MCP server (self-hosted).

Next steps​