---
title: "Grafana MCP server for AI agents - actionlake"
description: "Give Claude 371 Grafana actions through one MCP server: users, teams, access control. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/grafana
updated: 2026-10-11
---

Connectors · Observability & analytics

# Grafana MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Grafana and the rest of your systems. It gives your agent 371 Grafana actions (176 reads, 126 writes and 69 that wait for a confirmation) and holds the Grafana credential itself, so the agent never does. It paces Grafana's limits and records every call.

[Connect Grafana free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "grafana.org.get_current",
  intent: "check which Grafana account is connected"
}
# Get current Organization. · read · 1 upstream call
```

- 371 actions in one signed file
- 176 read look, never change
- 126 write create and update
- 69 wait for a yes destructive, confirmed first

Set up

## Connect Grafana in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Grafana.
   Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `token` Grafana service account token, sent as `Authorization
   - `api_host` Where your Grafana lives: your api host
   ```
   account { op: "connections.requirements", service: "grafana" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "grafana.org.get_current" }
   # get current organization. · read · 1 upstream call
   check { action: "grafana.admin_users.create_user", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Grafana at a glance

**Sign-in**

Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`token`

**Setup fields**

`api_host`

**Limits we pace to**

600 calls a minute, per connection

**API covered**

Grafana API v1, at your Grafana instance's API base URL, which you enter when connecting

**Built from**

Grafana's documentation, read 19 September 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/grafana/grafana/main/public/api-merged.json) [OpenAPI spec (GitHub)](https://raw.githubusercontent.com/grafana/grafana/main/pkg/services/ngalert/api/tooling/post.json) [grafana.com](https://grafana.com/docs/grafana/latest/developers/http_api/)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

170 of 176 reads, for up to an hour; a write clears what it affects

**Ready-made plans**

9 in the store

**Shared entities**

8, so ask can line Grafana up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Grafana.

371 actions in 1 area. Every one carries its effect, so a key can allow the reads and hold the rest.

- **176** read look, never change
- **126** write create and update
- **69** destructive wait for a confirmation

1. ### Monitoring
   371
   176 read · 126 write · 69 destructive
   Get users with paging. · Team Search With Paging. · Get all roles. · Get all the alert rules.

Top actions

## The Grafana API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 165 of Grafana's 172 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `grafana.users.search` Get users with paging. | Get users with paging. | read | `identity.user.list` 474 connectors |
| `grafana.teams.search` Team Search With Paging. | Team Search With Paging. | read | `identity.group.list` 262 connectors |
| `grafana.access_control.list` Get all roles. | Get all roles. | read | `identity.role.list` 184 connectors |
| `grafana.alert_provisioning.get_rules` Get all the alert rules. | Get all the alert rules. | read | `monitoring.monitor.list` 32 connectors |
| `grafana.org.list` Get all users within the current organization. | Get all users within the current organization. | read | `identity.user.list` 474 connectors |
| `grafana.users.list_teams` Get teams for user. | Get teams for user. | read | `identity.group.list` 262 connectors |
| `grafana.admin_users.create_user` Create new user. | Create new user. | write | `identity.user.create` 262 connectors |
| `grafana.teams.create_team` Add Team. | Add Team. | write | `identity.group.create` 205 connectors |
| `grafana.alert_rule_groups.get_rules_config` GET /api/ruler/{DatasourceUID}/api/v1/rules | GET /api/ruler/{DatasourceUID}/api/v1/rules | read | `monitoring.monitor.list` 32 connectors |
| `grafana.access_control.create_role` Create a new custom role. | Create a new custom role. | write | `identity.role.create` 105 connectors |
| `grafana.folders.list` Get all folders. | Get all folders. | read | `content.folder.list` 62 connectors |
| `grafana.admin_users.delete_user` Delete global User. | Delete global User. | destructive | `identity.user.delete` 253 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Grafana actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Who has access in Grafana? List every user and their role.
   calls `grafana.users.search`
2. Plan write
   Audit who has access to an org and what roles they hold in Grafana.
   calls `grafana.orgs.search_org_users` `grafana.access_control.search_user_roles` `grafana.access_control.search_team_roles` `grafana.quotas.list_org_quotas` `grafana.access_control.list_user_roles` +2 more
3. Plan destructive
   Revoke a departing user's Grafana access in Grafana. Ask me before anything is sent or changed.
   calls `grafana.users.get_user_by_login_or_email` `grafana.users.list_orgs` `grafana.users.list_teams` `grafana.access_control.list_user_roles` `grafana.admin_users.revoke_user_auth_token` +2 more
4. Write write
   Create new user in Grafana. Show me exactly what you will send before you save it.
   calls `grafana.admin_users.create_user`

The plan store

## Ready-made plans for Grafana.

9 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design.

1. ### Check every data source and annotate the ones that are unhealthy
   Use it when An agent is asked whether Grafana's data sources are up, or why panels are showing no data.
   **Effect**
   write
   **Steps**
   5 · loops
   **Install**
   `grafana-datasource-health-sweep`
2. ### Issue a fresh token for a service account and list the old ones
   Use it when A service account token is expiring or leaked and a replacement must be issued.
   A person decides Mint a new token named _token name_ for service account _name_, which already has _number of items_ tokens.
   **Effect**
   write
   **Steps**
   5
   **Needs**
   seconds to live, service account id and token name
   **Install**
   `grafana-rotate-service-account-token`
3. ### Silence Grafana alerts for a maintenance window
   Use it when A maintenance window is starting and alerts for the affected service must be muted for a fixed period.
   A person decides Silence Grafana alerts matching _matchers_ from _starts at_ to _ends at_ for: _reason_. _number of items_ alert groups are active now.
   **Effect**
   write
   **Steps**
   5
   **Needs**
   ends at, matchers, reason and starts at
   **Install**
   `grafana-silence-alerts-for-maintenance`
4. ### Create a team and give it access to a folder
   Use it when A new squad needs its own Grafana team and edit rights on one dashboard folder.
   A person decides Grant team _team name_ (id _team id_) permissions on folder _folder uid_, which currently has _number of items_ permission entries.
   **Effect**
   write
   **Steps**
   6 · loops
   **Needs**
   folder uid, members, permission items and team name
   **Install**
   `grafana-onboard-team-with-folder-access`
5. ### Report on alert rules and their current firing state
   Use it when Someone asks for a weekly review of Grafana alerting coverage and rule health.
   **Effect**
   write
   **Steps**
   6 · loops
   **Install**
   `grafana-weekly-alert-rule-report`
6. ### Audit who has access to an org and what roles they hold
   Use it when A compliance or access review asks who can see and edit an org's Grafana content.
   **Effect**
   write
   **Steps**
   7 · loops
   **Needs**
   org id
   **Install**
   `grafana-org-access-audit`
7. ### Publish a dashboard externally and return a short link
   Use it when Someone outside Grafana needs to see a dashboard and a shareable link must be produced.
   A person decides Publish dashboard '_title_' (_dashboard uid_) publicly for _audience_. Anyone with the link will see it.
   **Effect**
   write
   **Steps**
   7
   **Needs**
   audience and dashboard uid
   **Install**
   `grafana-publish-dashboard-snapshot-link`
8. ### Delete a stale dashboard folder after counting what it holds
   Use it when A dashboard folder is believed dead and someone wants it removed safely with its contents accounted for.
   A person decides Delete folder _folder uid_ and everything in it (_dashboard_ dashboards, _alertrule_ alert rules). Reason: _reason_. Rules exported first.
   **Effect**
   destructive
   **Steps**
   6
   **Needs**
   folder uid and reason
   **Install**
   `grafana-archive-stale-folder`
9. ### Revoke a departing user's Grafana access
   Use it when Someone has left and their Grafana access must be removed with an audit trail.
   A person decides Revoke all Grafana access for _login or email_ (user _id_): _number of items_ orgs, _number of items_ teams, _number of items_ roles.
   **Effect**
   destructive
   **Steps**
   8
   **Needs**
   login or email and org id
   **Install**
   `grafana-revoke-departing-user`

install a plan

```
account { op: "plans.install", slug: "grafana-datasource-health-sweep" }
# then ask for it by name; a schedule can run it on a timetable
```

Governance for Grafana

## Destructive actions wait for a yes.

69 Grafana actions are destructive. The first 10:

- Delete global User. `grafana.admin_users.delete_user`
- Delete Team By ID. `grafana.teams.delete_team_by_id`
- Delete a specific alert rule by UID. `grafana.alert_provisioning.delete_rule`
- Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace. `grafana.prometheus_convert.delete_namespace`
- DELETE /api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group} `grafana.alert_provisioning.delete_rule_group`
- Deletes a specific rule group if it was imported from a Prometheus-compatible source. `grafana.prometheus_convert.delete_rule_group`
- DELETE /api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}/{Groupname} `grafana.alert_rule_groups.delete_group_config`
- Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace. `grafana.prometheus_convert.cortex_delete_namespace`
- DELETE /api/ruler/grafana/api/v1/trash/rule/guid/{RuleGUID} `grafana.alert_rule_groups.delete_from_trash_by_guid`
- Deletes a specific rule group if it was imported from a Prometheus-compatible source. `grafana.prometheus_convert.cortex_delete_rule_group`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do grafana.admin_users.delete_user confirm_policy: **human**

Delete global User.?

**intent:** the user asked me to delete global User.

run suspended · waiting for a named person · key _grafana-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "grafana-agent",
  allowed_actions: ["grafana.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "grafana.admin_users.delete_user", approver: "lead@example.com" },
    { match: "grafana.teams.delete_team_by_id", approver: "lead@example.com" },
    { match: "grafana.alert_provisioning.delete_rule", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Grafana only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Grafana costs on actionlake.

Every Grafana action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Grafana refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 371 Grafana actions
- 371 actions page each page of a long list is one call
- 170 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Grafana action.

371 actions by area: the id your agent calls, what it does, and its effect.

**Monitoring 371**

- `grafana.access_control.list` Get all roles. read
- `grafana.alert_provisioning.get_rules` Get all the alert rules. read
- `grafana.teams.search` Team Search With Paging. read
- `grafana.users.search` Get users with paging. read
- `grafana.access_control.add_team_role` Add team role. destructive
- `grafana.access_control.add_user_role` Add a user role assignment. destructive
- and 365 more in this area

This index shows a sample of each area. All 371 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The Grafana MCP server, answered.

**Is there a Grafana MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 371 Grafana actions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Grafana.

**What do I need to connect Grafana?**

Grafana service account token, sent as `Authorization. Plus your api host. The free call account { op: "connections.requirements", service: "grafana" } lists exactly what to paste.

**Can an AI agent delete or change things in Grafana?**

Only if its key allows it, and only with an explicit confirmation. 69 Grafana actions are destructive, including delete global User., delete Team By ID. and delete a specific alert rule by UID.. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Grafana API limit?**

actionlake paces every call to the limits in the Grafana service file: 600 calls a minute per connection. Repeated reads are answered from cache (170 Grafana actions can be), which never reaches Grafana.

**What does a Grafana action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (371 Grafana actions page). Cache hits, searches, dry runs and calls Grafana refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Grafana API does it cover?**

The Grafana API v1 at your Grafana instance's API base URL, which you enter when connecting. It is built from Grafana's documentation as read on 19 September 2026. 371 actions in 1 area, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Grafana data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Grafana credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Grafana

Shares the most action names with

- [Datadog 99](https://actionlake.com/connectors/datadog)
- [PostHog 62](https://actionlake.com/connectors/posthog)
- [Axiom 48](https://actionlake.com/connectors/axiom)
- [New Relic 46](https://actionlake.com/connectors/new-relic)
- [Metabase 33](https://actionlake.com/connectors/metabase)
- [Uptrends 30](https://actionlake.com/connectors/uptrends)

Joins with, on shared entities

- [Microsoft 365 Users 4](https://actionlake.com/connectors/microsoft-365-users)
- [Cloudflare 4](https://actionlake.com/connectors/cloudflare)
- [Canvas LMS 4](https://actionlake.com/connectors/canvas-lms)
- [Flagsmith 4](https://actionlake.com/connectors/flagsmith)
- [JumpCloud 4](https://actionlake.com/connectors/jumpcloud)
- [Sophos Central 4](https://actionlake.com/connectors/sophos-central)

Browse

- [All Observability & analytics connectors](https://actionlake.com/connectors/category/observability-and-analytics)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Grafana; the name is the vendor's own. Counts are from the Grafana service file, version 1.0.0.

## Give your agent Grafana today.

[Connect Grafana free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/grafana
More: https://actionlake.com/llms.txt