# Connect Grafana to Prodpeek

Profile: `grafana/oncall-read` · connection kind: `http` · tier 2
Credential: Grafana service account token
Suggested URL: `https://grafana.example.com/mcp`

Dashboards, alerts and Loki queries. Honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere.

## What you must not do

You cannot create this credential on the user's behalf — it needs their login and,
usually, an approval step. Walk them through it and verify the result. Never ask
them to paste the credential into the chat; it goes straight into Prodpeek's
console, which encrypts it at rest. Grafana's roles do not encode 'cannot write' as precisely as Coolify's abilities do. Tell the user plainly that Viewer is the floor, and that the profile is Tier 2 for that reason rather than pretending it is Tier 1.

## Grant exactly these permissions

- `Service account role: Viewer` — The least Grafana offers that can still read dashboards and run queries. It is coarser than a Coolify read-only token or a Postgres SELECT-only role, which is exactly why this profile is Tier 2 and says so.

## Refuse these, and say why if the user asks for them

- `Editor or Admin` — Both can create, modify and delete dashboards, and Admin can manage users and data sources. With a coarse credential the allowlist becomes the only fence — do not make it the only fence for writes too.
- `Long-lived tokens with no expiry` — Set one. A Viewer token is still a key to your observability data.

## Verify before the credential is used

- The service account lists role Viewer, not Editor or Admin.
- Signed in as that account, the dashboard UI offers no Save or Delete.
- In Prodpeek, Test connection shows the write tools under 'denied by policy'.

## Then, in Prodpeek

1. Services → Add a service → choose the profile `grafana/oncall-read`.
2. Connection kind `http`, URL `https://grafana.example.com/mcp`.
3. Paste the credential. It is encrypted in the store and never shown again.
4. Run **Test connection**. It lists every tool the upstream advertises and how the
   profile classifies each one. Anything under "not in the policy" is denied by
   default — report that list rather than assuming it is fine.

## Full human walkthrough

## Why this one is Tier 2 on purpose

The other services here can point at a credential that refuses writes by itself.
Grafana's roles are coarser: Viewer is the narrowest that can still read dashboards
and run queries, and it is a role rather than a capability list. So the honest
statement is that the gateway allowlist is the primary fence here, and the profile
is labelled Tier 2 to say so rather than to hedge.

That is not a reason to avoid connecting Grafana. It is a reason to know which of
your connections you would want to look at first if something went wrong.

## Steps

1. In Grafana: **Administration → Users and access → Service accounts → Add service
   account**.
2. Name it `prodpeek` and set the role to **Viewer**.
3. **Add service account token**, set an expiry, and copy it. Grafana shows it once.
4. Enable the MCP endpoint (`grafana/mcp-grafana`) if you have not; the URL is your
   Grafana plus `/mcp`.
5. In Prodpeek: **Services → Add a service → Grafana**, paste the token, then
   **Test connection**.

## A note on Loki queries

`query_loki_logs` is allowed and is genuinely useful, and log output carries
whatever your applications printed — including the secrets they should not have
printed. Same caveat as `journal_tail` over SSH and `apps-get-logs` on DigitalOcean.
It is labelled `read_leaks` for that reason, not as a formality.