[renovate]

This PR contains the following updates:

Package	Update	Change
grafana/mcp-grafana	minor	2.1.1 → 2.2.0

---

Release Notes

grafana/mcp-grafana

v2.2.0

Compare Source

Added

• CloudWatch Logs Insights tools in the opt-in cloudwatch category: list_cloudwatch_log_groups, list_cloudwatch_log_group_fields and query_cloudwatch_logs. Queries run through /api/ds/query with a server-side row limit (default 100, max 1000), support cross-account log groups by ARN, and are stopped if the tool gives up waiting (#​1404)
• Datasources are exposed as MCP resources at grafana://datasources/{uid}, listed per caller with their own credentials, so clients with a resource picker (such as @ in Claude Code) can attach a datasource to a conversation directly. They are registered with the datasource tools and turned off with them (#​1459)
• render_grafana_app displays the result of an enabled query tool (query_prometheus or get_tempo_trace) in the interactive Grafana App in MCP hosts that support MCP Apps. Breaking: query_prometheus and get_tempo_trace no longer open an App themselves, so intermediate queries don't render charts while the agent is still gathering data. Their text and structured output is unchanged (#​1401)
• search_dashboards hits carry a folderPath (for example Ops/Production/Services), and a new optional folderPath input restricts results to a folder and all of its subfolders (#​1450)
• An opt-in Prometheus query guardrail for query_prometheus, query_prometheus_histogram and Prometheus panels in run_panel_query. --prometheus-guardrail-mode=shadow|enforce checks each query's effective time range (--prometheus-guardrail-max-range, default 192h) and points per series (--prometheus-guardrail-max-points, default 11000) before it reaches the datasource, and in enforce mode rejects it with rewrite guidance (#​1453)
• The Loki cost guardrail is built on the new standalone github.com/grafana/mcp-grafana/lokiguard module, so other callers can share one implementation. It now also guards query_loki_patterns, adds --loki-guardrail-on-estimate-failure=allow|block to reject queries whose cost can't be assessed, and records an mcp.loki_guardrail.estimated_bytes histogram (#​1355, #​1374)
• BigQuery support in query_sql, list_sql_databases, list_sql_tables and describe_sql_table, without querying INFORMATION_SCHEMA, so metadata lookups don't incur billable usage (#​1417)
• run_panel_query runs Infinity panels that use a backend parser (#​1345) and Neo4j panels on the kniepdennis-neo4j-datasource plugin (#​1391)
• get_tempo_trace accepts optional start and end bounds, so Tempo doesn't have to scan every block for the trace (#​1437)
• --sse-keepalive pings SSE clients at the given interval, so an idle reverse proxy or load balancer doesn't close the event stream and end the session. Off by default (#​1389)

Fixed

• run_panel_query and dashboard inspection handle many more real-world dashboards:
  • Panels using the default datasource, legacy string datasource references ("Prometheus", "$ds") or no reference at all are resolved (#​1406, #​1442)
  • Interval variables set to auto are computed like Grafana, instead of sending an invalid placeholder (#​1457)
  • Multi-value variables are formatted with the datasource's default, for example (api|web) for Prometheus and 'east','west' for SQL, instead of sending only the first value (#​1441)
  • $__auto is substituted, and Loki range queries send it as the step, so count_over_time(...[$__auto]) windows no longer overlap (#​1406, #​1432)
  • $__range and $__interval keep their seconds (1m30s, not 1m), and $__rate_interval_ms is substituted (#​1419, #​1433)
  • Inspection shares execution's variable and macro handling, so processedQuery matches the query that runs; it accepts optional start/end and warns when a referenced variable is set to All. In query_sql, ${x:sqlstring} now quotes and escapes the value (#​1373, #​1375)
  • A target pointing at a different datasource UID no longer inherits the panel's datasource type (#​1440)
• search_tempo_traces no longer returns every span twice, accepts limit (default 20) and spss, and notes when a search returned partial results (#​1407)
• The row limit appended to SQL queries is no longer swallowed by a trailing line comment, and ClickHouse queries get it before a top-level SETTINGS clause (#​1424, #​1418)
• --enable-write-tools keeps individual alerting write tools (alerting_rules_write, alerting_routing_write, alerting_silences_write) registered under --disable-write (#​1421)
• Datasource-managed alert rules from alerting_rules_read include their namespace and last_error, and omit the empty uid (#​1425). When Grafana reports an authentication failure against the ruler, the error suggests checking the datasource credentials and ruler configuration (#​1448)
• query_loki_patterns includes the detected level of each pattern (#​1422)
• list_prometheus_label_names and list_prometheus_label_values accept PromQL selector strings such as {job="api"} in matches (#​1340)
• get_query_examples accepts datasource plugin IDs such as grafana-clickhouse-datasource (#​1388)
• update_incident is annotated as destructive, so clients that ask before destructive tools ask before it changes an incident (#​1427)
• With --tls-* flags or a SOCKS5 proxy, connections to Grafana are reused across tool calls instead of doing a new TLS handshake every call. Rotated certificate files are still picked up without a restart (#​1455)
• OnCall requests use the configured TLS settings, extra headers, SOCKS5 proxy and redirect guard (#​1393), and Prometheus requests use a configured BaseTransport (#​1370)
• Over the HTTP transports, initialize and tools/list no longer call Grafana, so they work and stay quiet when Grafana is unreachable (#​1392)

Changed

• Datasource queries go through Grafana's /api/ds/query endpoint instead of the datasource proxy, so they get the same query service handling as dashboard and Explore queries. This covers Prometheus (#​1409), Loki (#​1410), Quickwit (#​1411), Graphite (#​1412), Pyroscope (#​1413), VictoriaLogs (#​1414), Elasticsearch (#​1415) and Tempo (#​1416). Label, metadata and other discovery calls are unchanged. Breaking:
  • Grafana before 9.0 is no longer supported for these queries, and a token without permission to query a datasource gets Grafana's error instead of being routed around the query service
  • Query errors carry Grafana's message
  • search_tempo_traces (on Grafana 12.3 and later) and get_tempo_trace return a new output shape with millisecond times; search no longer returns job counts, serviceStats or the partial-results note
  • query_pyroscope metrics for cumulative profile types are rates (for example cores instead of CPU nanoseconds per step), with a new unit field, and the step is at least the datasource's minStep
  • query_graphite rejects Graphite absolute time formats other than Unix seconds, YYYYMMDD and RFC3339, and tags.name is the series target
  • Native histograms from query_prometheus_histogram no longer include their sum
  • A few cases still use the proxy, such as Tempo search before Grafana 12.3, Pyroscope DOT output, older Elasticsearch plugins and Quickwit Query DSL (#​1444)

Security

• Bump github.com/andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#​1420)
• Bump the Go toolchain to 1.26.10 and the release builder images to Go 1.27.3 for crypto/x509 fixes (#​1376)

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.