Services → Grafana

Connect Grafana

Dashboards, alerts and Loki queries. Honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere.

Tier 2 Grafana service account token ~3 min profile grafana/oncall-read

Setting this up with your own agent? Give it these instructions.

Why this one is Tier 2 on purpose

The other services here can point at a credential that refuses writes by itself.

Grafana's roles are coarser: Viewer is the narrowest that can still read dashboards

and run queries, and it is a role rather than a capability list. So the honest

statement is that the gateway allowlist is the primary fence here, and the profile

is labelled Tier 2 to say so rather than to hedge.

That is not a reason to avoid connecting Grafana. It is a reason to know which of

your connections you would want to look at first if something went wrong.

Steps

  1. In Grafana: **Administration → Users and access → Service accounts → Add service account**.
  2. Name it prodpeek and set the role to Viewer.
  3. Add service account token, set an expiry, and copy it. Grafana shows it once.
  4. Enable the MCP endpoint (grafana/mcp-grafana) if you have not; the URL is your Grafana plus /mcp.
  5. In Prodpeek: Services → Add a service → Grafana, paste the token, then Test connection.

A note on Loki queries

query_loki_logs is allowed and is genuinely useful, and log output carries

whatever your applications printed — including the secrets they should not have

printed. Same caveat as journal_tail over SSH and apps-get-logs on DigitalOcean.

It is labelled read_leaks for that reason, not as a formality.

Screenshots

Administration → Users and access → Service accounts → Add service account, with role Viewer. Screenshot pending — the steps above stand on their own.
Administration → Users and access → Service accounts → Add service account, with role Viewer.
Add service account token, with an expiry set. Screenshot pending — the steps above stand on their own.
Add service account token, with an expiry set.