grafana/mcp-grafana v2.2.0

on GitHub

Added

• CloudWatch Logs Insights tools in the opt-in cloudwatch category: list_cloudwatch_log_groups, list_cloudwatch_log_group_fields and query_cloudwatch_logs. Queries run through /api/ds/query with a server-side row limit (default 100, max 1000), support cross-account log groups by ARN, and are stopped if the tool gives up waiting (#1404)
• Datasources are exposed as MCP resources at grafana://datasources/{uid}, listed per caller with their own credentials, so clients with a resource picker (such as @ in Claude Code) can attach a datasource to a conversation directly. They are registered with the datasource tools and turned off with them (#1459)
• render_grafana_app displays the result of an enabled query tool (query_prometheus or get_tempo_trace) in the interactive Grafana App in MCP hosts that support MCP Apps. Breaking: query_prometheus and get_tempo_trace no longer open an App themselves, so intermediate queries don't render charts while the agent is still gathering data. Their text and structured output is unchanged (#1401)
• search_dashboards hits carry a folderPath (for example Ops/Production/Services), and a new optional folderPath input restricts results to a folder and all of its subfolders (#1450)
• An opt-in Prometheus query guardrail for query_prometheus, query_prometheus_histogram and Prometheus panels in run_panel_query. --prometheus-guardrail-mode=shadow|enforce checks each query's effective time range (--prometheus-guardrail-max-range, default 192h) and points per series (--prometheus-guardrail-max-points, default 11000) before it reaches the datasource, and in enforce mode rejects it with rewrite guidance (#1453)
• The Loki cost guardrail is built on the new standalone github.com/grafana/mcp-grafana/lokiguard module, so other callers can share one implementation. It now also guards query_loki_patterns, adds --loki-guardrail-on-estimate-failure=allow|block to reject queries whose cost can't be assessed, and records an mcp.loki_guardrail.estimated_bytes histogram (#1355, #1374)
• BigQuery support in query_sql, list_sql_databases, list_sql_tables and describe_sql_table, without querying INFORMATION_SCHEMA, so metadata lookups don't incur billable usage (#1417)
• run_panel_query runs Infinity panels that use a backend parser (#1345) and Neo4j panels on the kniepdennis-neo4j-datasource plugin (#1391)
• get_tempo_trace accepts optional start and end bounds, so Tempo doesn't have to scan every block for the trace (#1437)
• --sse-keepalive pings SSE clients at the given interval, so an idle reverse proxy or load balancer doesn't close the event stream and end the session. Off by default (#1389)

Fixed

• run_panel_query and dashboard inspection handle many more real-world dashboards:
  • Panels using the default datasource, legacy string datasource references ("Prometheus", "$ds") or no reference at all are resolved (#1406, #1442)
  • Interval variables set to auto are computed like Grafana, instead of sending an invalid placeholder (#1457)
  • Multi-value variables are formatted with the datasource's default, for example (api|web) for Prometheus and 'east','west' for SQL, instead of sending only the first value (#1441)
  • $__auto is substituted, and Loki range queries send it as the step, so count_over_time(...[$__auto]) windows no longer overlap (#1406, #1432)
  • $__range and $__interval keep their seconds (1m30s, not 1m), and $__rate_interval_ms is substituted (#1419, #1433)
  • Inspection shares execution's variable and macro handling, so processedQuery matches the query that runs; it accepts optional start/end and warns when a referenced variable is set to All. In query_sql, ${x:sqlstring} now quotes and escapes the value (#1373, #1375)
  • A target pointing at a different datasource UID no longer inherits the panel's datasource type (#1440)
• search_tempo_traces no longer returns every span twice, accepts limit (default 20) and spss, and notes when a search returned partial results (#1407)
• The row limit appended to SQL queries is no longer swallowed by a trailing line comment, and ClickHouse queries get it before a top-level SETTINGS clause (#1424, #1418)
• --enable-write-tools keeps individual alerting write tools (alerting_rules_write, alerting_routing_write, alerting_silences_write) registered under --disable-write (#1421)
• Datasource-managed alert rules from alerting_rules_read include their namespace and last_error, and omit the empty uid (#1425). When Grafana reports an authentication failure against the ruler, the error suggests checking the datasource credentials and ruler configuration (#1448)
• query_loki_patterns includes the detected level of each pattern (#1422)
• list_prometheus_label_names and list_prometheus_label_values accept PromQL selector strings such as {job="api"} in matches (#1340)
• get_query_examples accepts datasource plugin IDs such as grafana-clickhouse-datasource (#1388)
• update_incident is annotated as destructive, so clients that ask before destructive tools ask before it changes an incident (#1427)
• With --tls-* flags or a SOCKS5 proxy, connections to Grafana are reused across tool calls instead of doing a new TLS handshake every call. Rotated certificate files are still picked up without a restart (#1455)
• OnCall requests use the configured TLS settings, extra headers, SOCKS5 proxy and redirect guard (#1393), and Prometheus requests use a configured BaseTransport (#1370)
• Over the HTTP transports, initialize and tools/list no longer call Grafana, so they work and stay quiet when Grafana is unreachable (#1392)

Changed

• Datasource queries go through Grafana's /api/ds/query endpoint instead of the datasource proxy, so they get the same query service handling as dashboard and Explore queries. This covers Prometheus (#1409), Loki (#1410), Quickwit (#1411), Graphite (#1412), Pyroscope (#1413), VictoriaLogs (#1414), Elasticsearch (#1415) and Tempo (#1416). Label, metadata and other discovery calls are unchanged. Breaking:
  • Grafana before 9.0 is no longer supported for these queries, and a token without permission to query a datasource gets Grafana's error instead of being routed around the query service
  • Query errors carry Grafana's message
  • search_tempo_traces (on Grafana 12.3 and later) and get_tempo_trace return a new output shape with millisecond times; search no longer returns job counts, serviceStats or the partial-results note
  • query_pyroscope metrics for cumulative profile types are rates (for example cores instead of CPU nanoseconds per step), with a new unit field, and the step is at least the datasource's minStep
  • query_graphite rejects Graphite absolute time formats other than Unix seconds, YYYYMMDD and RFC3339, and tags.name is the series target
  • Native histograms from query_prometheus_histogram no longer include their sum
  • A few cases still use the proxy, such as Tempo search before Grafana 12.3, Pyroscope DOT output, older Elasticsearch plugins and Quickwit Query DSL (#1444)

Security

• Bump github.com/andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#1420)
• Bump the Go toolchain to 1.26.10 and the release builder images to Go 1.27.3 for crypto/x509 fixes (#1376)