MCP server for Grafana

MCP server for Grafana is an application that provides AI assistants with access to Grafana via the standard Model Context Protocol (MCP). The server is deployed on a virtual machine in Yandex Cloud and connects to an existing Grafana instance.

Key Features and Benefits

• Yandex AI Studio Integration. The MCP server integrates with AI Studio MCP Servers — connect it to your AI agents in just a few clicks.
• AI Assistant Integration. Enables AI models to interact with Grafana: search and analyze dashboards, view data sources, explore metrics and alerts.
• Bearer Token Authorization. All requests to the MCP server are protected with a Bearer token stored in Yandex Lockbox.
• Secure Secret Storage. The Grafana service account token is stored in Yandex Lockbox and retrieved at startup.
• Standard MCP Protocol. Uses the open Model Context Protocol for AI model interaction, ensuring compatibility with a wide range of clients.
• Streamable HTTP Transport. The MCP server is accessible on port 8000 (Streamable HTTP) through the VM’s internal address. External access can be enabled during installation.
• Minimal Resources. The application runs on a virtual machine with minimal configuration (2 vCPU, 2 GB RAM), reducing infrastructure costs.

1. Make sure you have a running Grafana instance with API access.
2. Create a service account token in Grafana with the necessary access permissions.
3. Create a secret in Yandex Lockbox to store the Grafana service account token. Store the token under the api_key key.
4. Create a secret in Yandex Lockbox to store the Bearer token for authorization. The secret must contain a bearer_token key with an arbitrary token value.
5. Create a service account for deploying the application and assign it the roles compute.editor, iam.serviceAccounts.admin, vpc.admin, and resource-manager.admin on the deployment folder.
6. Assign the installer service account the lockbox.admin role separately on the Bearer token secret and the external service credentials secret. This role is required to read and modify access permissions on the selected secrets; no folder-level Lockbox role is required. This also applies to secrets in another folder. During installation, the application creates a dedicated VM service account and grants it lockbox.payloadViewer only on the selected secrets.
7. The template also grants the VM service account certificate-manager.certificates.downloader on the deployment folder. The installer needs resource-manager.admin to create this IAM binding, even when no custom certificate is selected. If using a certificate, select one from the deployment folder; for a certificate in another folder, grant the VM account access to it separately.
8. In the management console select the Cloud Apps service.
9. In the left panel, select Application Store.
10. Select MCP Grafana and click the Use button.
11. Specify:
    • Application name.
    • (Optional) Application description.
    • The service account created earlier.
    • The cloud subnet where the virtual machine will be deployed.
    • Lockbox secret ID containing the Bearer token for authorization.
    • Grafana instance URL.
    • Lockbox secret ID containing the Grafana service account token.
    • (Optional) Enable external access to the MCP server on port 8000. It is disabled by default; enable it to connect through the public IP address.
    • (Optional) A certificate from Yandex Certificate Manager for connecting to a self-hosted Grafana instance over HTTPS.
    • (Optional) Enable SSH access and specify a username and an SSH public key. Use the corresponding private key to connect to the VM.
12. Click the Install button and wait for the application to install.
13. After installation, copy the full URL from Application data, MCP server URL (internal): http://<private-ip>:8000/mcp. The client needs network access to the VM’s internal IP address from a private IPv4 network.
14. If you enabled external access during installation, use MCP server URL (external) to connect from the internet. When external access is disabled, that URL is unreachable even if the VM has a public IP address.
15. Configure your AI client to connect to the MCP server, specifying the Authorization: Bearer <your-token> header.

Connecting the MCP server to Yandex AI Studio

1. In the management console open AI Studio and go to Agent Core → MCP servers.
2. Click Create MCP server and select the required MCP server under MCP servers from Yandex Cloud Marketplace.
3. Specify the server name and select an existing application instance, or create a new one by following the deployment instructions. When deploying a new server, the Save button becomes available only after the MCP server has been fully deployed and started.
4. After you select the application, the MCP server’s Network and Service account settings are filled in automatically.
5. Click Create. After the connection has been verified successfully, select the required tools and click Save. The MCP server will be registered in AI Studio and available for use by AI agents.

• Searching and analyzing Grafana dashboards using an AI assistant.
• Viewing and exploring data sources configured in Grafana.
• Analyzing alerts and notification rules via natural language.
• Exploring metrics and dashboard panels with AI.
• Automating routine monitoring tasks through an AI assistant.

Yandex Cloud technical support is available 24/7. The types of requests you can submit and the appropriate response time depend on your pricing plan. You can switch to the paid support plan in the management console. You can learn more about the technical support terms here.