> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grafana

> Let agents search dashboards, read the queries behind panels, query any data source and see which alerts are firing

The Grafana connector works with Grafana Cloud and with self-hosted Grafana 9 or later. It signs in with a service account token and only ever reads.

## Tools

| Tool                  | What it returns                                                                                                                                              |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Test Connection**   | Grafana version and database health, the organization, the token's effective role (Viewer, Editor or Admin) and a warning when the token can change anything |
| **Search Dashboards** | Dashboards matching a title, tag or folder: uid, title, URL path, folder and tags                                                                            |
| **Get Dashboard**     | A dashboard's variables and every panel with its title, type, data source and queries (targets). Layout and styling are left out                             |
| **List Data Sources** | Data sources the token can see: uid, name, type, default. Never their settings or credentials                                                                |
| **Query Data Source** | The result of one query (PromQL, LogQL, SQL, InfluxQL, Lucene, or a panel target object) as columns and rows, last hour by default                           |
| **List Alerts**       | Grafana-managed alert rules with state (firing, pending, inactive), labels, annotations, last error and up to 20 instances each                              |

## Safety

* **Read-only.** No tool creates, edits, silences or deletes anything, and Test Connection warns when the token holds Editor or Admin permissions.
* **Queries run as the data source.** Grafana sends a query with the data source's own credentials. SQL sent to a SQL data source must be one read-only `SELECT` (checked before anything is sent), and InfluxQL admin statements are refused. Give every data source a read-only database user as well; that is the real guarantee.
* **Limits on every call.** 15 s timeout by default (up to 55 s with `timeout_seconds`), 500 rows or items (up to 5,000 with `max_rows`) and 1 MB per result. A cut result has `truncated: true`.
* **No redirects, no private hosts.** A direct connection only reaches public addresses, is pinned to the address that was checked, and never follows a redirect.
* **No secrets in results.** The token is removed from every error message.

## Create a Viewer service account

1. In Grafana, open **Administration > Users and access > Service accounts** and click **Add service account**.
2. Name it `danube`, set the role to **Viewer**, and create it.
3. Click **Add service account token**, choose an expiry, and copy the token (`glsa_...`).

Viewer can read every dashboard, data source query and alert rule the organization lets viewers see. Restrict it further with folder permissions if agents should only see some dashboards. For Grafana Cloud, the URL is `https://<stack>.grafana.net`.

## Connect

Open **Grafana** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Fill in the Grafana URL and the token. Set **Organization ID** only if your Grafana has several organizations.

<Tabs>
  <Tab title="Public URL">
    Grafana Cloud and any Grafana reachable over HTTPS connect directly. If your Grafana sits behind an IP allowlist, allow Danube's egress addresses: see [Connect your production database safely](/connectors/production-database#allowlist-danubes-addresses). For a self-signed certificate, paste the CA bundle into **CA certificate**.
  </Tab>

  <Tab title="Private network, SSH bastion">
    Fill in the **SSH bastion** fields: the bastion's public host, user, private key and host key fingerprint. Set **Grafana URL** to the address the bastion reaches, such as `http://grafana.internal:3000`. Danube verifies the bastion's host key against the stored fingerprint and never trusts a new key on first use.
  </Tab>

  <Tab title="Private network, data-plane agent">
    Run the [data-plane agent](/organizations/data-plane) inside the network and store the token as a reference, for example `env://GRAFANA_TOKEN`. The call runs on the agent, which resolves the reference locally, so the token never reaches Danube.
  </Tab>
</Tabs>

Run **Test Connection** after saving. It tells you which of these failed: the token (`auth_required`), the network (`connection_error`, `destination_blocked`) or TLS (`tls_error`).

## Example prompts

* "Which Grafana alerts are firing right now, and what do their runbooks say?"
* "Find the checkout dashboard and tell me which queries its latency panels use."
* "Run the error-rate panel's query for the last 24 hours and tell me when it spiked."
* "List our Loki data sources and search the last hour of logs for `payment_failed`."