Services → Grafana

Connect Grafana

Four tools: find a dashboard, read its queries, see what is firing, check Grafana is up. The smallest honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere.

Tier 2 A Grafana service account token (starts `glsa_`) ~3 min profile grafana/oncall-read

Setting this up with your own agent? Give it these instructions.

Why this one is Tier 2 on purpose

The other services here can point at a credential that refuses writes by itself.

Grafana's roles are coarser: Viewer is the narrowest that can still read dashboards

and run queries, and it is a role rather than a capability list. So the honest

statement is that the gateway allowlist is the primary fence here, and the profile

is labelled Tier 2 to say so rather than to hedge.

Grafana does, unusually, tell you what a token may do —

/api/access-control/user/permissions, no permission required — so prove

re-checks that claim on every run rather than asking you to take it on faith. See

[the full Grafana page](grafana.md#grafana-tells-you-what-the-token-can-do).

Steps

  1. In Grafana: **Administration → Users and access → Service accounts → Add service account**.
  2. Name it prodpeek and set the role to Viewer.
  3. Add service account token, set an expiry, and copy it. Grafana shows it once.
  4. In Prodpeek: Services → Add a service, pick grafana/oncall-read, set the upstream to your Grafana origin (https://your-stack.grafana.net), paste the token, then Test connection.

There is no MCP server to install. Prodpeek speaks Grafana's HTTP API directly —

see [why](grafana.md#why-there-is-no-mcp-server-to-install).

What four tools buys you


search_dashboards    find the dashboard somebody already built
get_panel_queries    the queries behind its panels, without the layout
list_firing_alerts   what is on fire right now
health               Grafana is up, and this is its version

That is enough for an agent to answer "what is wrong, and what does this team

already measure" — and not enough for it to ask your datasources anything it

likes. query is deliberately denied here; bind to grafana/read-only if you

want it, rather than widening this profile.

Screenshots

Administration → Users and access → Service accounts → Add service account, with role Viewer. Screenshot pending — the steps above stand on their own.
Administration → Users and access → Service accounts → Add service account, with role Viewer.
Add service account token, with an expiry set. Screenshot pending — the steps above stand on their own.
Add service account token, with an expiry set.