# grafana-mcp

[Grafana's official MCP server](https://github.com/grafana/mcp-grafana)
(`mcp-grafana`) packaged as a container image for cluster0, served over
streamable-HTTP so the Hermes agent (namespace `ai-0`) can call it as an
HTTP MCP server.

## What's in this repo

| File | Purpose |
|---|---|
| `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). |
| `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |

The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg
(default `v1.1.0`); the workflow resolves the newest GitHub release and
skips the build when it's already published.

## Deployment (cluster0)

Manifests: `William/Kubernetes_Cluster0`, app dir
`cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/`,
namespace `ai-0-1`.

Runtime env (set by the Deployment, from the server's own Infisical-managed
secret — never baked into the image):

| Var | Value |
|---|---|
| `GRAFANA_URL` | `http://grafana-service.personal-0.svc.cluster.local` |
| `GRAFANA_SERVICE_ACCOUNT_TOKEN` | Grafana service-account token (Infisical project `ai-0-1`) |
| `ALLOWED_HOSTS` (Deployment env, read by args) | `grafana-mcp-service.ai-0-1.svc.cluster.local` |

The service is **ClusterIP-only** (no Ingress/NodePort): it exposes Will's
Grafana instance, so only in-cluster consumers can reach it. Hermes consumes
it via `http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp`.

### Grafana service account

Create in Grafana (Administration → Service Accounts) with the **Editor**
built-in role (upstream-recommended quick setup; covers all read + most
write tools) or granular RBAC scopes, then add a token and store it as
`GRAFANA_SERVICE_ACCOUNT_TOKEN` in Infisical project `ai-0-1` (env `prod`).

## Registry auth for pushes

The workflow uses a scoped PAT (`write:package`) stored as repo Actions
secret `REGISTRY_TOKEN` — Gitea's container registry rejects scoped token
requests from the Actions job token (upstream #23642).