Skip to main content
The Grafana connector works with Grafana Cloud and with self-hosted Grafana 9 or later. It signs in with a service account token and only ever reads.

​
Tools

​
Safety

  • Read-only. No tool creates, edits, silences or deletes anything, and Test Connection warns when the token holds Editor or Admin permissions.
  • Queries run as the data source. Grafana sends a query with the data source’s own credentials. SQL sent to a SQL data source must be one read-only SELECT (checked before anything is sent), and InfluxQL admin statements are refused. Give every data source a read-only database user as well; that is the real guarantee.
  • Limits on every call. 15 s timeout by default (up to 55 s with timeout_seconds), 500 rows or items (up to 5,000 with max_rows) and 1 MB per result. A cut result has truncated: true.
  • No redirects, no private hosts. A direct connection only reaches public addresses, is pinned to the address that was checked, and never follows a redirect.
  • No secrets in results. The token is removed from every error message.

​
Create a Viewer service account

  1. In Grafana, open Administration > Users and access > Service accounts and click Add service account.
  2. Name it danube, set the role to Viewer, and create it.
  3. Click Add service account token, choose an expiry, and copy the token (glsa_...).
Viewer can read every dashboard, data source query and alert rule the organization lets viewers see. Restrict it further with folder permissions if agents should only see some dashboards. For Grafana Cloud, the URL is https://<stack>.grafana.net.

​
Connect

Open Grafana in the dashboard’s tool catalog and click Connect, or let the agent call store_credential. Fill in the Grafana URL and the token. Set Organization ID only if your Grafana has several organizations.
Grafana Cloud and any Grafana reachable over HTTPS connect directly. If your Grafana sits behind an IP allowlist, allow Danube’s egress addresses: see Connect your production database safely. For a self-signed certificate, paste the CA bundle into CA certificate.
Run Test Connection after saving. It tells you which of these failed: the token (auth_required), the network (connection_error, destination_blocked) or TLS (tls_error).

​
Example prompts

  • “Which Grafana alerts are firing right now, and what do their runbooks say?”
  • “Find the checkout dashboard and tell me which queries its latency panels use.”
  • “Run the error-rate panel’s query for the last 24 hours and tell me when it spiked.”
  • “List our Loki data sources and search the last hour of logs for payment_failed.”