How is this different from connecting Grafana MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Grafana MCP API changes?

We track the Grafana MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Grafana tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Grafana?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Grafana MCP server myself?

No. TrustGate connects to the Grafana MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Grafana directly.

Connect Grafana MCP to your AI agents, securely.

Q: Is Grafana MCP secure?

The server itself exposes 79 tools, and some of them can write to your Grafana account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Grafana.

One secured endpoint for every Grafana call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Grafana MCP now

What your agents can ask once Grafana MCP is connected.

Select the tools your AI agents can call

79 tools from the Grafana MCP schema.

Showing 79 tools

search_dashboardsreadSearches for dashboards by title, tag or folder.
get_dashboard_by_uidreadGets the full JSON of a dashboard by its UID.
get_dashboard_panel_queriesreadGets the queries behind the panels of a dashboard.
get_dashboard_propertyreadGets a specific property of a dashboard without fetching the whole JSON.
get_dashboard_summaryreadGets a compact summary of a dashboard and its panels.
update_dashboardwriteCreates or updates a Grafana dashboard.
search_foldersreadSearches for folders by title.
list_dashboard_versionsreadLists saved versions of a dashboard (version, author, time, message).
create_folderwriteCreates a folder.
get_panel_imagereadRenders a stored dashboard or panel, a provisioning preview or an ad-hoc Explore view as a PNG image.
query_prometheusreadExecutes a PromQL query against a Prometheus datasource, instant or range.
list_prometheus_metric_namesreadLists the metric names available in a Prometheus datasource.
list_prometheus_metric_metadatareadLists metric metadata from a Prometheus datasource.
list_prometheus_label_namesreadLists the label names available in a Prometheus datasource.
list_prometheus_label_valuesreadLists the values for a specific Prometheus label.
query_prometheus_histogramreadCalculates histogram percentile values.
query_loki_logsreadQueries and retrieves logs using LogQL, as either log or metric queries.
list_loki_label_namesreadLists all available label names in logs.
list_loki_label_valuesreadLists the values for a specific log label.
query_loki_statsreadGets statistics about log streams.
query_loki_patternsreadQueries detected log patterns to identify common structures.
analyze_loki_labelsreadAudits a Loki label strategy, live or static, and optionally diagnoses query performance.
suggest_loki_alloy_label_configreadGenerates an Alloy loki.process snippet that enforces approved labels.
list_incidentsreadLists incidents in Grafana Incident.
get_incidentreadGets detailed information about a specific incident.
create_incidentwriteCreates an incident in Grafana Incident.
add_activity_to_incidentwriteAdds an activity item to an incident.
update_incidentwriteUpdates an incident in Grafana Incident (status, severity, title, or custom fields).
list_incident_custom_fieldsreadLists the custom fields configured for incidents, with their types and select options.
list_oncall_schedulesreadLists schedules from Grafana OnCall.
get_oncall_shiftreadGets the details of an OnCall shift.
get_current_oncall_usersreadGets the users currently on call for a schedule.
list_oncall_teamsreadLists teams from Grafana OnCall.
list_oncall_usersreadLists users from Grafana OnCall.
list_alert_groupsreadLists alert groups from Grafana OnCall with filtering options.
get_alert_groupreadGets a specific alert group from Grafana OnCall by its ID.
update_alert_groupwriteAcknowledges, unacknowledges, resolves or unresolves an alert group.
list_datasourcesreadLists the datasources configured in Grafana.
generate_deeplinkreadGenerates accurate deeplink URLs for Grafana dashboards, panels and Explore.
user_inforeadGets the current identity, capabilities and accessible organizations.
get_datasourcereadGets a datasource by UID or name.
check_datasources_healthreadChecks the health of one or more datasources.
create_datasourcewriteCreates a datasource.
update_datasourcewriteUpdates a datasource.
alerting_rules_readreadLists and inspects alert rules, including their versions.
alerting_rules_writehigh riskCreate, update and delete Grafana-managed rules, or explicitly create datasource-managed rules.
alerting_manage_routingwriteManages notification policies, contact points, and time intervals.
alerting_routing_writewriteCreates Grafana-managed contact points, or explicitly creates external Alertmanager receivers.
alerting_silences_readreadLists and inspects alerting silences.
alerting_silences_writewriteCreate, update, and expire alerting silences.
list_pyroscope_label_namesreadLists label names matching a selector.
list_pyroscope_label_valuesreadLists label values matching a selector for a label name.
list_pyroscope_profile_typesreadLists available profile types.
query_pyroscopereadQueries profiles, metrics, or both from Pyroscope.
get_assertionsreadGets the assertion summary for a given entity.
get_annotationsreadFetches annotations with filters.
create_annotationwriteCreates a new annotation (standard or Graphite format).
update_annotationwriteUpdates specific fields of an annotation (partial update).
delete_annotationhigh riskDeletes an annotation by ID.
get_annotation_tagsreadLists annotation tags with optional filtering.
list_snapshotsreadLists dashboard snapshots with optional query and limit filters.
get_snapshotreadGets snapshot metadata and dashboard payload by snapshot key.
create_snapshotwriteCreates a dashboard snapshot from a full dashboard payload.
delete_snapshothigh riskDeletes a dashboard snapshot by snapshot key.
list_provisioning_repositoriesreadLists provisioning repositories (e.g.
validate_provisioning_filereadDry-runs a file from a provisioning repository and reports admission validation errors.
search_docsreadSearches Grafana documentation or lists product groups.
get_docreadFetches a documentation page, optionally only its headings or a bounded section.
get_pluginreadGets an installed plugin.
search_plugin_informationreadSearches the grafana.com plugin catalog.
install_pluginwriteInstalls a plugin.
grafana_api_requesthigh riskCalls a Grafana HTTP API endpoint.
search_tempo_tracesreadSearches traces with TraceQL.
query_tempo_metricsreadComputes metrics from traces with TraceQL.
get_tempo_tracereadFetches a trace by ID.
diff_tempo_tracesreadCompares two traces.
list_tempo_attribute_namesreadLists span and resource attribute names.
list_tempo_attribute_valuesreadLists values for a trace attribute.
get_tempo_traceql_docsreadGets TraceQL documentation.

What Grafana MCP exposes

Grafana MCP groups its 79 tools into 11 categories, each with a suggested starting policy.

All 79 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Dashboards	Dashboard and folder search, retrieval by UID, versions, panel queries, properties, summaries, panel images, folder creation and updates	Read / Write	Require approval before updating dashboards
Prometheus	PromQL queries, histogram percentiles, metric names, metadata and label discovery	Read	Scope the datasources an agent can query
Loki	LogQL log and metric queries, label names, label values, stream statistics, log patterns and label strategy audits	Read	Treat log content as potentially sensitive
Incidents	Listing, creating, updating, resolving incidents and adding activity	Read / Write	Audit incident creation and resolution
Alerting	Alert rules, notification policies, contact points, time intervals and silences	Read / Write	Require approval for alert rule changes
OnCall	OnCall schedules, shifts, teams, users and alert groups	Read / Write	Limit access to on-call rosters
Datasources & Admin	Datasource listing, lookup, health checks, creation and updates, current user identity and deeplink generation	Read / Write	Keep admin tools disabled unless needed
Profiles & Assertions	Pyroscope profile types, labels and profile queries, plus Asserts assertion summaries	Read	Scope the datasources an agent can query
Annotations & Snapshots	Annotations and annotation tags, and dashboard snapshots: listing, retrieval, creation, updates and deletion	Read / Write	Require approval before deleting annotations or snapshots
Plugins, Docs & API	Installed plugins, plugin catalog search and installation, provisioning repositories and file validation, Grafana documentation and direct Grafana HTTP API requests	Read / Write	Require approval for plugin installs and direct API requests
Tempo	TraceQL trace search, trace metrics, trace retrieval and comparison, attribute discovery and TraceQL docs	Read	Scope the datasources an agent can query

Connect Grafana MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Grafana
Find Grafana in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Grafana MCP or block it. You allow the exact tools each agent can call, one by one.

Grafana MCP	79 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 79 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Grafana MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Grafana MCP79 documented tools. 40 more tools in categories disabled by default can be enabled with the --enabled-tools flag.
Coding assistants	Connection & credentialsper user	Dashboards10 tools
Internal copilots	Tool access policiesdeny by default	Annotations & Snapshots9 tools
Workflow automations	Request & response inspectioninline	OnCall8 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools52 tools