The Grafana MCP connection covers Prometheus and Loki datasource queries. You do not need to connect Prometheus or Loki separately if they are already configured as Grafana datasources. However, if you use Tempo for distributed tracing, connect Tempo separately — the Grafana MCP does not expose Tempo’s full TraceQL surface.
What this integration enables
- Metric queries — agents run PromQL against your Prometheus datasource via Grafana
- Log search — agents run LogQL against your Loki datasource via Grafana
- Unified alert state — agents can read Grafana-managed alert rules and their current state
- Dashboard context — agents can reference your dashboards during diagnosis and in RCA documents
Prerequisites
- An environment selected in the top-right context switcher — Settings → Environment → Integrations is scoped to that environment and stays disabled until one is selected
- A running Grafana instance (self-hosted or Grafana Cloud)
- Admin access to Grafana to create a service account
- The
grafana-mcpserver running and reachable from sureops (see step 2 below)
Integration connections are per-environment. Connecting Grafana here only applies to the environment that was selected in the context switcher at the time — it does not carry over to your other environments. Repeat this connect flow for each environment that needs Grafana.
Setup
1
Generate a Service Account Token
In Grafana, go to Administration → Service accounts.Create a new service account. If you only need metric/log queries, dashboard context, and unified alert reads, the Viewer role is enough. If you plan to use Proposed Monitor Export (Growth plan and above) to push approved sureops monitors into Grafana as alert rules, Viewer is not enough — that push requires the
alert.provisioning:write permission, so assign the service account the Editor role (or a custom role/permission set that grants alert.provisioning:write) instead. Then click Add token to generate a service account token for that account.Copy the token; you’ll need it in the next step to configure grafana-mcp. It isn’t entered directly into sureops. Grafana only shows it once.2
Stand up grafana-mcp
Run
grafana-mcp pointed at your Grafana instance. If you’re using the sureops demo environment, grafana-mcp is already provisioned in-cluster — you can skip this step.For your own environment, deploy grafana-mcp with your Grafana URL and the service account token from step 1 as its upstream config — the repository documents both Docker and binary deployment.3
Connect in sureops
In sureops, go to Settings → Environment → Integrations and click Connect next to Grafana.Fill in:
- MCP Server Endpoint — the URL of your running
grafana-mcpserver - Authentication Method — Bearer Token, API Key, or Basic Auth, matching how your
grafana-mcpdeployment expects inbound requests to be authenticated - Token — labeled Bearer Token, API Key, or Password depending on the method you selected above. The form requires a value here even if your
grafana-mcpdeployment doesn’t enforce its own auth — enter any placeholder value in that case
4
Configure Org ID and Alert Folder UID (after connecting)
Once connected, reopen the Grafana integration from Settings → Environment → Integrations. A Settings section appears below the connection status with two additional fields you set post-connect:
- Grafana Org ID — defaults to
1for single-org Grafana installs - Alert Folder UID — the folder alert rules are created in. Optional to connect, but required before you can push a Proposed Monitor — find it in your Grafana instance’s folder settings
Required credentials
Fields collected when you connect the integration:
Fields configured afterward, via the integration’s Settings section once connected:
The Service Account Token and Grafana URL from step 1 are never entered into sureops directly — they configure
grafana-mcp, which handles authentication to Grafana on sureops’ behalf.