Connect Grafana to Claude

The Grafana MCP server is a program you have to start, secure and keep up to date yourself. For Claude on the web or on a phone it needs a stable address with sign-in – which usually ends up as a secret key in the URL shared by the whole team. XenMCP takes care of it: you add your Grafana address and a token, we start the server in an isolated sandbox, and you get an address like https://your-company-grafana.xenmcp.com/mcp with OAuth – everyone signs in as themselves.

Through one server Claude reaches every data source in your Grafana: Loki (your container logs), Prometheus (metrics), dashboards and alerts.

Your Grafana does not have to be open to the whole internet: XenMCP connects from a fixed IP address. Read-only is the default – Claude can search and analyse, but cannot change dashboards, alerts or incidents.

What you can ask Claude

• Why did the api container restart last night? Show me the errors in the logs before it.
• Which errors were most frequent in the last hour, grouped by service?
• How did the server’s CPU and memory develop over the last 24 hours?
• Which alerts fired this week, and how often?
• Find the database dashboard and summarise what looks unusual right now.

Typical tools

query_loki_logs

Query logs with LogQL (line count capped)

list_loki_label_names / values

Show the available log labels, such as container or service

query_prometheus

Query metrics with PromQL

list_datasources

Show your Grafana’s data sources

search_dashboards / get_dashboard

Find and read dashboards

list_alert_rules

Show alert rules and their state

Change dashboards, alerts, incidents

Blocked (--disable-write), off by default

What you need to connect

• The address of your Grafana (https://grafana.your-company.com)
• A service account token with the Viewer role
• XenMCP’s fixed IP address allowed in your firewall or reverse proxy
• Optional: which data sources Claude may see

Security

• Read-only twice over: a service account with the Viewer role and the server in --disable-write mode. A mistake on one side still allows no changes.
• No open Grafana needed: allow only XenMCP’s fixed IP.
• Everyone signs in as themselves via OAuth; whoever leaves the team loses access without you rotating the token. No shared key in the URL.
• The token is stored encrypted (AES-256-GCM), never shown again and never logged.
• Logs can contain personal data (IP addresses, emails). Results go to your AI client; use Viewer permissions to limit which data sources are visible.
• The call log keeps only tool, status and duration – no queries and no results.

Built on

We use the open server Grafana MCP server (Apache-2.0), build the image ourselves from a pinned version and review the tool descriptions before release.

Frequently asked questions