Provider REST API

Observability

Connect Claude to Grafana

Search dashboards, query Prometheus and Loki datasources, and read alerts. Toolspoke puts 11 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connection
Provider REST API
Authentication
Service account token
Actions exposed
11
Cost per call (typical)
1 credit
Adapter
Maintained by Toolspoke

Connected in three steps

  1. 1

    Install Grafana

    Open the marketplace in your workspace, add Grafana to the project your agents work in, and it appears on the gateway immediately.

  2. 2

    Connect the credential

    Authenticate with service account token. Where to get one, and what it has to be able to reach, is the next section.

  3. 3

    Point your agent at the gateway

    Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json
{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Grafana shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code

Run it in your project, then /mcp to sign in

claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop

Settings, then Connectors, then Add custom connector

https://toolspoke.com/mcp
Cursor

~/.cursor/mcp.json, or .cursor/mcp.json for one project

{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex

~/.codex/config.toml

[mcp_servers.toolspoke]
url = "https://toolspoke.com/mcp"
VS Code

.vscode/mcp.json, or the MCP: Add Server command

{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Grafana asks for

Service account token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

Service account tokenRequired
Grafana → Administration → Users and access → Service accounts → add a service account, then Add service account token. A Viewer role covers every read here; annotation writing needs Editor.
glsa_…
Grafana URLRequired
Your Grafana Cloud stack URL or the base URL of your self-hosted Grafana. It has to be publicly reachable - a private-network address is refused.
https://acme.grafana.net

What Claude can do in Grafana

11 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads
10Reads
Writes
1Writes
Destructive
0Destructive

Reads

10

Fetches data and changes nothing.

  • search_dashboards

    Search dashboards and folders by title or tag. This is the entry point for everything dashboard-shaped: it returns the UIDs that get_dashboard and the annotation actions need. Defaults to dashboards only; pass type dash-folder to list folders instead, or use list_folders.

  • get_dashboard

    Fetch one dashboard by UID, including every panel and the datasource queries behind it. Read this before writing your own PromQL: the panels record the queries a team already trusts for a service, and query_prometheus_range can re-run one directly. Call search_dashboards first for the UID. Panel trees are depth-limited to keep the response readable.

  • list_datasources

    List the datasources configured in this Grafana with their UIDs and types. Call this first for every query action: query_prometheus, query_prometheus_range and query_loki all address a datasource by UID, and the type field is what tells you which of them applies (prometheus, loki, mimir, influxdb, …).

  • query_prometheus

    Run a PromQL query at a single instant through Grafana's datasource proxy and return the current value per series. Use this for "what is it right now" - error rate, replica count, queue depth. Use query_prometheus_range when you need a shape over time. The datasource UID comes from list_datasources and must be of type prometheus or mimir.

  • query_prometheus_range

    Run a PromQL query over a time window through Grafana's datasource proxy and return one series of points per label set. Use this to see whether something is climbing, and to line a metric up against a deploy. Keep step large enough that the window divides into a few hundred points or Prometheus refuses the query outright.

  • query_loki

    Run a LogQL query over a time window through Grafana's datasource proxy and return the matching log lines. Every LogQL query needs at least one stream selector in braces, e.g. {app="checkout"} |= "timeout". A metric-shaped LogQL query such as sum(rate({app="checkout"} |= "error" [5m])) returns series instead of lines. The datasource UID comes from list_datasources and must be of type loki.

  • list_alert_rules

    List the Grafana-managed alert rules that are configured, with their queries, evaluation intervals and labels. This says what could fire; list_active_alerts says what is firing now. Use it to find out why an alert exists and which datasource it watches.

  • list_active_alerts

    List the alerts currently held by Grafana's built-in Alertmanager - what is firing right now, with each alert's labels, annotations and when it started. Start here when asked "is anything on fire", then use list_alert_rules to understand a rule the answer names.

  • list_folders

    List the dashboard folders the token can see, with their UIDs and titles. Use it to map a team name onto the folder UID that search_dashboards filters on.

  • list_annotations

    List annotations - the timestamped markers drawn on dashboard graphs, including the ones Grafana writes itself when an alert changes state. Use it to find out what a team recorded as happening at the moment a metric moved. Filter by dashboard UID or by tag; times are epoch milliseconds.

Writes

1

Creates or updates something on the other side.

  • create_annotation

    Record an annotation so it appears as a marker on dashboard graphs - a deploy, a config change, a manual intervention. Pass a dashboard UID and panel id to pin it to one panel, or neither to make it organization-wide. Give time and timeEnd for a region rather than an instant. Needs an Editor-role token.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else
The 11 actions above are the whole of it. A call to any other name is refused before it reaches Grafana rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
Nothing here deletes
This connector writes to Grafana, but nothing in it deletes or permanently alters anything.
It reaches no further than your credential
Toolspoke holds no access to Grafana of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Grafana
Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Grafana. An agent has to ask.
It does not smooth over provider limits
Toolspoke does not retry, queue or back off around Grafana's own rate limits. A call that Grafana refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Grafana?

11 named actions: 10 that only read and 1 that write. They include search_dashboards, get_dashboard and list_datasources. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Grafana connector need?

Service account token. The connector asks for service account token and grafana url. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Grafana connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 11 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Grafana connector not do?

The 11 actions above are the whole of it. A call to any other name is refused before it reaches Grafana rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. This connector writes to Grafana, but nothing in it deletes or permanently alters anything. Toolspoke holds no access to Grafana of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Grafana. An agent has to ask. Toolspoke does not retry, queue or back off around Grafana's own rate limits. A call that Grafana refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Grafana's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Grafana?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.