Hermes
3299926acf
sha256sum -c validates the file under the name recorded in the checksums file (mcp-grafana_Linux_<arch>.tar.gz); saving the download as mcp.tar.gz made the check fail with 'No such file or directory'.
grafana-mcp
Grafana's official MCP server
(mcp-grafana) packaged as a container image for cluster0, served over
streamable-HTTP so the Hermes agent (namespace ai-0) can call it as an
HTTP MCP server.
What's in this repo
| File | Purpose |
|---|---|
Dockerfile |
Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into scratch (the binary is fully static). |
.gitea/workflows/build.yaml |
Builds + pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (+ latest). Triggers: push to main, weekly Mon 06:00 UTC (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |
The upstream version is pinned via the MCP_GRAFANA_VERSION build-arg
(default v1.1.0); the workflow resolves the newest GitHub release and
skips the build when it's already published.
Deployment (cluster0)
Manifests: William/Kubernetes_Cluster0, app dir
cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/,
namespace ai-0-1.
Runtime env (set by the Deployment, from the server's own Infisical-managed secret — never baked into the image):
| Var | Value |
|---|---|
GRAFANA_URL |
http://grafana-service.personal-0.svc.cluster.local |
GRAFANA_SERVICE_ACCOUNT_TOKEN |
Grafana service-account token (Infisical project ai-0-1) |
ALLOWED_HOSTS (Deployment env, read by args) |
grafana-mcp-service.ai-0-1.svc.cluster.local |
The service is ClusterIP-only (no Ingress/NodePort): it exposes Will's
Grafana instance, so only in-cluster consumers can reach it. Hermes consumes
it via http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp.
Grafana service account
Create in Grafana (Administration → Service Accounts) with the Editor
built-in role (upstream-recommended quick setup; covers all read + most
write tools) or granular RBAC scopes, then add a token and store it as
GRAFANA_SERVICE_ACCOUNT_TOKEN in Infisical project ai-0-1 (env prod).
Registry auth for pushes
The workflow uses a scoped PAT (write:package) stored as repo Actions
secret REGISTRY_TOKEN — Gitea's container registry rejects scoped token
requests from the Actions job token (upstream #23642).