Connectors · Observability & analytics
Grafana MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Grafana and the rest of your systems. It gives your agent 371 Grafana actions (176 reads, 126 writes and 69 that wait for a confirmation) and holds the Grafana credential itself, so the agent never does. It paces Grafana's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "grafana.org.get_current", intent: "check which Grafana account is connected"}# Get current Organization. · read · 1 upstream call- 371actionsin one signed file
- 176readlook, never change
- 126writecreate and update
- 69wait for a yesdestructive, confirmed first
Set up
Connect Grafana in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Grafana.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
tokenGrafana service account token, sent as `Authorizationapi_hostWhere your Grafana lives: your api host
account { op: "connections.requirements", service: "grafana" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "grafana.org.get_current" }# get current organization. · read · 1 upstream callcheck { action: "grafana.admin_users.create_user", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Grafana at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
token- Setup fields
api_host- Limits we pace to
- 600 calls a minute, per connection
- API covered
- Grafana API v1, at your Grafana instance's API base URL, which you enter when connecting
- Built from
- Grafana's documentation, read 19 September 2026OpenAPI spec (GitHub)OpenAPI spec (GitHub)grafana.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 170 of 176 reads, for up to an hour; a write clears what it affects
- Ready-made plans
- 9 in the store
- Shared entities
- 8, so ask can line Grafana up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Grafana.
371 actions in 1 area. Every one carries its effect, so a key can allow the reads and hold the rest.
- 176readlook, never change
- 126writecreate and update
- 69destructivewait for a confirmation
Monitoring
371176 read · 126 write · 69 destructive
Get users with paging. · Team Search With Paging. · Get all roles. · Get all the alert rules.
Top actions
The Grafana API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 165 of Grafana's 172 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
grafana.users.searchGet users with paging. | Get users with paging. | read | identity.user.list474 connectors |
grafana.teams.searchTeam Search With Paging. | Team Search With Paging. | read | identity.group.list262 connectors |
grafana.access_control.listGet all roles. | Get all roles. | read | identity.role.list184 connectors |
grafana.alert_provisioning.get_rulesGet all the alert rules. | Get all the alert rules. | read | monitoring.monitor.list32 connectors |
grafana.org.listGet all users within the current organization. | Get all users within the current organization. | read | identity.user.list474 connectors |
grafana.users.list_teamsGet teams for user. | Get teams for user. | read | identity.group.list262 connectors |
grafana.admin_users.create_userCreate new user. | Create new user. | write | identity.user.create262 connectors |
grafana.teams.create_teamAdd Team. | Add Team. | write | identity.group.create205 connectors |
grafana.alert_rule_groups.get_rules_configGET /api/ruler/{DatasourceUID}/api/v1/rules | GET /api/ruler/{DatasourceUID}/api/v1/rules | read | monitoring.monitor.list32 connectors |
grafana.access_control.create_roleCreate a new custom role. | Create a new custom role. | write | identity.role.create105 connectors |
grafana.folders.listGet all folders. | Get all folders. | read | content.folder.list62 connectors |
grafana.admin_users.delete_userDelete global User. | Delete global User. | destructive | identity.user.delete253 connectors |
Try it
Prompts to paste into Claude.
Each one names the Grafana actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in Grafana? List every user and their role.
calls
grafana.users.search - Planwrite
Audit who has access to an org and what roles they hold in Grafana.
calls
grafana.orgs.search_org_usersgrafana.access_control.search_user_rolesgrafana.access_control.search_team_rolesgrafana.quotas.list_org_quotasgrafana.access_control.list_user_roles+2 more - Plandestructive
Revoke a departing user's Grafana access in Grafana. Ask me before anything is sent or changed.
calls
grafana.users.get_user_by_login_or_emailgrafana.users.list_orgsgrafana.users.list_teamsgrafana.access_control.list_user_rolesgrafana.admin_users.revoke_user_auth_token+2 more - Writewrite
Create new user in Grafana. Show me exactly what you will send before you save it.
calls
grafana.admin_users.create_user
The plan store
Ready-made plans for Grafana.
9 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design.
Check every data source and annotate the ones that are unhealthy
Use it when An agent is asked whether Grafana's data sources are up, or why panels are showing no data.
Issue a fresh token for a service account and list the old ones
Use it when A service account token is expiring or leaked and a replacement must be issued.
A person decides
Mint a new token named token name for service account name, which already has number of items tokens.
Silence Grafana alerts for a maintenance window
Use it when A maintenance window is starting and alerts for the affected service must be muted for a fixed period.
A person decides
Silence Grafana alerts matching matchers from starts at to ends at for: reason. number of items alert groups are active now.
Create a team and give it access to a folder
Use it when A new squad needs its own Grafana team and edit rights on one dashboard folder.
A person decides
Grant team team name (id team id) permissions on folder folder uid, which currently has number of items permission entries.
Report on alert rules and their current firing state
Use it when Someone asks for a weekly review of Grafana alerting coverage and rule health.
Audit who has access to an org and what roles they hold
Use it when A compliance or access review asks who can see and edit an org's Grafana content.
Publish a dashboard externally and return a short link
Use it when Someone outside Grafana needs to see a dashboard and a shareable link must be produced.
A person decides
Publish dashboard 'title' (dashboard uid) publicly for audience. Anyone with the link will see it.
Delete a stale dashboard folder after counting what it holds
Use it when A dashboard folder is believed dead and someone wants it removed safely with its contents accounted for.
A person decides
Delete folder folder uid and everything in it (dashboard dashboards, alertrule alert rules). Reason: reason. Rules exported first.
Revoke a departing user's Grafana access
Use it when Someone has left and their Grafana access must be removed with an audit trail.
A person decides
Revoke all Grafana access for login or email (user id): number of items orgs, number of items teams, number of items roles.
account { op: "plans.install", slug: "grafana-datasource-health-sweep" }
# then ask for it by name; a schedule can run it on a timetableGovernance for Grafana
Destructive actions wait for a yes.
69 Grafana actions are destructive. The first 10:
- Delete global User.
grafana.admin_users.delete_user - Delete Team By ID.
grafana.teams.delete_team_by_id - Delete a specific alert rule by UID.
grafana.alert_provisioning.delete_rule - Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.
grafana.prometheus_convert.delete_namespace - DELETE /api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}
grafana.alert_provisioning.delete_rule_group - Deletes a specific rule group if it was imported from a Prometheus-compatible source.
grafana.prometheus_convert.delete_rule_group - DELETE /api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}/{Groupname}
grafana.alert_rule_groups.delete_group_config - Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.
grafana.prometheus_convert.cortex_delete_namespace - DELETE /api/ruler/grafana/api/v1/trash/rule/guid/{RuleGUID}
grafana.alert_rule_groups.delete_from_trash_by_guid - Deletes a specific rule group if it was imported from a Prometheus-compatible source.
grafana.prometheus_convert.cortex_delete_rule_group
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete global User.?
intent: the user asked me to delete global User.
account { op: "keys.create", name: "grafana-agent", allowed_actions: ["grafana.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "grafana.admin_users.delete_user", approver: "[email protected]" }, { match: "grafana.teams.delete_team_by_id", approver: "[email protected]" }, { match: "grafana.alert_provisioning.delete_rule", approver: "[email protected]" } ]}Cost
What Grafana costs on actionlake.
Every Grafana action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Grafana refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 371 Grafana actions
- 371actions pageeach page of a long list is one call
- 170reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Grafana action.
371 actions by area: the id your agent calls, what it does, and its effect.
Monitoring371
grafana.access_control.listGet all roles.readgrafana.alert_provisioning.get_rulesGet all the alert rules.readgrafana.teams.searchTeam Search With Paging.readgrafana.users.searchGet users with paging.readgrafana.access_control.add_team_roleAdd team role.destructivegrafana.access_control.add_user_roleAdd a user role assignment.destructive- and 365 more in this area
This index shows a sample of each area. All 371 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Grafana MCP server, answered.
Is there a Grafana MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 371 Grafana actions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Grafana.
What do I need to connect Grafana?
Grafana service account token, sent as `Authorization. Plus your api host. The free call account { op: "connections.requirements", service: "grafana" } lists exactly what to paste.
Can an AI agent delete or change things in Grafana?
Only if its key allows it, and only with an explicit confirmation. 69 Grafana actions are destructive, including delete global User., delete Team By ID. and delete a specific alert rule by UID.. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Grafana API limit?
actionlake paces every call to the limits in the Grafana service file: 600 calls a minute per connection. Repeated reads are answered from cache (170 Grafana actions can be), which never reaches Grafana.
What does a Grafana action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (371 Grafana actions page). Cache hits, searches, dry runs and calls Grafana refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Grafana API does it cover?
The Grafana API v1 at your Grafana instance's API base URL, which you enter when connecting. It is built from Grafana's documentation as read on 19 September 2026. 371 actions in 1 area, each one in the signed service file (version 1.0.0).
Does actionlake keep my Grafana data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Grafana credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Grafana today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
