grafana/mcp-grafana v2.1.0

on GitHub

Added

• alerting_rules_write and alerting_routing_write can create Mimir/Cortex or Loki ruler alert rules and Mimir/Cortex Alertmanager receivers with managed_by: "datasource". Grafana-managed creation stays the default. The target datasource comes from datasource_uid or, when exactly one compatible datasource exists, is selected automatically; existing rules in the group and the rest of the Alertmanager configuration are preserved (#1342)
• query_prometheus renders its results as an interactive chart (time series, heatmap, bars, stat or table, chosen from the response shape) in MCP hosts that support MCP Apps. The text output is unchanged (#1309)
• Every tool declares the Grafana RBAC actions it needs in its _meta (grafana.com/requiredPermissions), and the README's permissions column is generated from those declarations, adding 20 missing tools and correcting stale entries (#1306)

Fixed

• update_dashboard detects v2 dashboards that Grafana still reports as stored at v1, instead of saving them as v1 and silently dropping auto grid, tabs and conditional rendering (#1357)
• query_sql and run_panel_query replace $__from, $__to and $__interval only as whole tokens, so plugin macros such as ClickHouse's $__fromTime, $__toTime and $__interval_s (and tokens like $__to_date in other dialects) are no longer corrupted (#1346)
• query_prometheus returns endTime is required or startTime must be provided when queryType is 'range' instead of a PromQL parser error when those times are missing (#1347)
• --enable-write-tools=generate_deeplink now works with --disable-write, so shorten=true returns a short link (#1337)
• get_panel_image uses separate default sizes for panels (1000x750), dashboards (1200x900) and Explore (1000x1000) at scale 1, clamps scale to 1-3, and caps each rendered dimension at 3000 pixels (#1323)
• Listing datasource-managed (Prometheus, Mimir, Loki) alert rules pages through results and stops once enough matches are found, with a 10 MiB per-page and 30s overall bound, instead of decoding every rule at once (#1335)
• Several tool bugs (#1313):
  • create_annotation converts Graphite when from milliseconds to seconds
  • update_dashboard returns the saved title instead of null
  • Pyroscope label tools return [] instead of null
  • get_tempo_trace returns a not-found error for unknown trace IDs instead of {}
  • Incident results no longer include empty placeholder assignments
  • install_plugin only suggests creating a datasource for datasource plugins
• Generic empty-result hints for Prometheus and Loki are shorter, using fewer tokens per empty response (#1336)
• The MCP apps no longer ship duplicate woff fonts, shrinking the trace viewer by about 19% (#1312)
• Docker images report their real version from --version (#1315)

Changed

• Breaking: list_users_by_org is paginated, with new query, limit (default 100, max 1000) and page inputs, and returns {totalCount, page, perPage, orgUsers} instead of an array of users. Agents pick up the new shape from the tool description and need no changes; only code that parses the tool output directly must read orgUsers (#1313)
• generate_deeplink with shorten: true returns an error containing the full link when a short URL cannot be created, instead of silently returning the long URL (#1313)
• grafana_api_request times out after the Grafana client timeout (10s by default; raise it with --grafana-timeout). get_panel_image render timeouts default to 60s and are capped at 120s. The client cache is bounded to 1000 entries per client type (#1315)
• Prometheus query and metadata responses larger than 10 MiB fail with an error asking you to narrow the query, instead of being read without limit (#1331)

Security

• Bump the Go toolchain to 1.26.9, golang.org/x/net to v0.60.0 and the builder images to Go 1.27.2 for CVEs (#1333)
• Bump vite in the bundled UI apps to remediate a source-map-js CVE (#1332)
• Releases are signed with keyless cosign: the binaries checksums file, the .mcpb bundle and the Docker images, each with SPDX SBOMs (#1314)