Grafana

Four tools: find a dashboard, read its queries, see what is firing, check Grafana is up. The smallest honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere.

Policy	grafana/oncall-read
Connection kind	grafana
Upstream looks like	https://your-stack.grafana.net
Credential	A Grafana service account token (starts glsa_)
Tier	2 — Prodpeek is the only fence, and the profile says so
Time to set up	about 3 minutes

Grant exactly these

Service account role: Viewer

The least Grafana offers that can still read dashboards and run queries. It is coarser than a Coolify read-only token or a Postgres SELECT-only role, which is exactly why this profile is Tier 2 and says so.

Do not grant these

Each of these would undo the point of the rest

Editor or Admin

Both can create, modify and delete dashboards, and Admin can manage users and data sources. With a coarse credential the allowlist becomes the only fence — do not make it the only fence for writes too.

Long-lived tokens with no expiry

Set one. A Viewer token is still a key to your observability data.

Why this one is Tier 2 on purpose

The other services here can point at a credential that refuses writes by itself. Grafana's roles are coarser: Viewer is the narrowest that can still read dashboards and run queries, and it is a role rather than a capability list. So the honest statement is that the gateway allowlist is the primary fence here, and the profile is labelled Tier 2 to say so rather than to hedge.

Grafana does, unusually, tell you what a token may do — /api/access-control/user/permissions, no permission required — so prove re-checks that claim on every run rather than asking you to take it on faith. See the full Grafana page.

Steps

1. In Grafana: Administration → Users and access → Service accounts → Add service account.
2. Name it prodpeek and set the role to Viewer.
3. Add service account token, set an expiry, and copy it. Grafana shows it once.
4. In Prodpeek: Services → Add a service, pick grafana/oncall-read, set the upstream to your Grafana origin (https://your-stack.grafana.net), paste the token, then Test connection.

There is no MCP server to install. Prodpeek speaks Grafana's HTTP API directly — see why.

What four tools buys you

search_dashboards    find the dashboard somebody already built
get_panel_queries    the queries behind its panels, without the layout
list_firing_alerts   what is on fire right now
health               Grafana is up, and this is its version

That is enough for an agent to answer "what is wrong, and what does this team already measure" — and not enough for it to ask your datasources anything it likes. query is deliberately denied here; bind to grafana/read-only if you want it, rather than widening this profile.

Check you got it right

• [ ] The service account lists role Viewer, not Editor or Admin.
• [ ] Signed in as that account, the dashboard UI offers no Save or Delete.
• [ ] In Prodpeek, Test connection shows the write tools under 'denied by policy'.

If an agent is reading this

Grafana's roles do not encode 'cannot write' as precisely as Coolify's abilities do. Tell the user plainly that Viewer is the floor, and that the profile is Tier 2 for that reason rather than pretending it is Tier 1.

Then add it to Prodpeek

Console: Services → Add a service, pick grafana/oncall-read, paste the credential. Or from an agent, add_service with no credential and hand over the drop link.

Then press Test connection and read all three lists.