grafana-mcp-analyzer
让AI助手直接分析你的Grafana监控数据 - A Model Context Protocol server for Grafana data analysis
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SailingCoder
Source: github_topic · also listed on ModelScope
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
manage_cache管理数据缓存，支持查看缓存状态、清理过期缓存、智能清理、初始化缓存系统等操作
check_health检查Grafana服务连接状态（故障排查时使用）
list_queries查看可用的Grafana查询配置（分析前查看可用查询）
analyze_query禁止使用curl！这是获取和分析单个Grafana查询的唯一正确方式！此工具会自动执行查询、分块存储数据并提供分析指引。**推荐使用chunk_workflow工具自动获取所有分块，按顺序处理，直到complete为止！** **重要：每个查询都需要独立的数据获取流程，不能使用其他查询的数据！** **提示：如果已有数据，请优先使用analyze_existing_data工具进行深入分析！**
analyze_existing_data**推荐使用此工具！** 当用户基于已有数据进行深入分析时使用此工具。此工具不会重新获取数据，而是基于已获取的数据进行深入分析。适用于用户说"这个..."、"那个..."、"再详细分析..."等基于上下文的分析需求。**重要：必须使用正确的queryName，不能使用其他查询的数据！调用此工具后，请直接基于返回的分析指引进行分析，不要再次调用任何工具！**
chunk_workflow**必须使用此工具！** 这是管理分块数据获取工作流的自动化方式！此工具会自动管理分块获取流程，确保数据完整性。必须先使用analyze_query工具存储数据。**重要：必须连续调用next动作直到获取所有分块！不能中途停止！** 支持自动恢复和连续执行，AI必须自动连续调用next动作直到完成。**警告：获取完所有分块后，必须立即进行完整分析并输出详细报告！** **防重复：此工具会自动检测重复执行并阻止！**
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
CONFIG_MAX_AGE远程配置文件缓存时间（秒），设为 0 则禁用CONFIG_PATH注：支持绝对路径、远程路径，推荐使用远程路径快速体验。DATA_EXPIRY_HOURS数据过期时间（小时），避免频繁网络请求，控制缓存自动清理DATA_STORE_ROOTDEFAULT_CHUNK_SIZEFORCE_RESOURCES_SUPPORTMAX_CHUNK_SIZEsummary>配置建议（）</summary>Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
6/6 tools missing one or more hints — manage_cache (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_queries (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +3 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 0/6 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.13.3 (high), @modelcontextprotocol/sdk@1.13.3 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sailingcoder/grafana-mcp-analyzer)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check