Skip to main content

​
Overview

Connecting Grafana Managed lets Rootly AI query your self-hosted Grafana instance during investigations — pulling metrics, logs, profiles, dashboards, and alerts. Every query uses a Grafana service-account token you provide, so Rootly AI can only see what that service account can see.
If your team is on Grafana Cloud (the managed offering), use the Grafana Cloud integration instead — it’s a simpler setup with no self-hosted server to manage.

​
Before You Start

You’ll need three things ready before opening the connection modal:
  • A running mcp-grafana server with a public HTTPS URL that Rootly can reach. Private-network-only addresses (VPN-only, VPC-internal, localhost, RFC1918 IPs) are not accepted.
  • Your Grafana instance URL — the base URL of your self-hosted Grafana (e.g., https://grafana.your-company.com).
  • A Grafana service-account token with read access to whatever data you want Rootly AI to query — metrics, logs, dashboards, alerts. Generate it from Grafana → Administration → Service accounts.
Public HTTPS endpoints only. Private-IP addresses (10.x, 172.16–31.x, 192.168.x), localhost, .internal domains, and other non-routable addresses are refused at save time. If you need Rootly-only access, allow-list Rootly AI’s outbound IPs at your load balancer instead of using a private address.

​
Connecting In Rootly

Open Configuration → AI → Connectors and click Connect on the Grafana Managed card.
​
mcp-grafana Server URL
string
required
The public HTTPS endpoint of your mcp-grafana deployment.
Must be a valid, publicly reachable HTTPS URL.
​
Grafana Instance URL
string
required
Your Grafana’s base URL — the address you’d type in a browser to open Grafana.
​
Service-Account Token
string
required
A Grafana service-account token with read access to the data Rootly AI will query — metrics, logs, dashboards, alerts.Create it from Grafana → Administration → Service accounts → Add service account → Add service account token.
Click Save. Rootly runs a quick check to confirm the connection works. If everything’s set up correctly the card flips to Connected and Rootly AI can start querying Grafana. Common save-time errors:
  • “Rootly couldn’t reach that mcp-grafana URL. It must be a public HTTPS endpoint — private or internal-only addresses are blocked.” — the URL is a private IP, localhost, or an internal-only domain. Expose mcp-grafana on a public HTTPS endpoint and retry.
  • “Rootly reached the server but the connection failed.” — the URL is reachable but something else is wrong. Check that mcp-grafana is running, that the Grafana instance URL is correct, and that the service-account token has adequate permissions.

​
Best Practices

  • Use a dedicated service-account token, not a personal API key. Service accounts are stable across staff turnover and have their own audit trail in Grafana. Name the service account something obvious like rootly-ai so it’s easy to identify in Grafana’s audit log.
  • Scope the service-account token to the minimum roles Rootly AI needs. Read access to metrics, logs, and dashboards is usually enough. If Rootly AI doesn’t need to see alert configurations, don’t grant the alerts role.
  • Rotate the service-account token on a cadence. Rotate on the same schedule as your other API tokens (quarterly is common). After rotating, paste the new token into Rootly’s Configure screen — the connection is re-verified on save.
  • Test with /rootly test. After connecting, declare a test incident and see whether Rootly AI can pull Grafana data during the investigation. If it can’t, catch it in test before a real incident.
  • Consider Grafana Cloud if you’re on the managed offering. Grafana Cloud’s integration doesn’t require you to run and maintain the extra piece yourself. Only stick with the self-hosted Grafana Managed connector if you specifically need to run Grafana yourself.

​
Troubleshooting

The URL isn’t a valid public HTTPS endpoint. Common causes:
  • Private IP (10.x, 172.16-31.x, 192.168.x) — not accepted.
  • localhost or 127.0.0.1 — not accepted.
  • Internal-only domain that doesn’t resolve from Rootly’s network.
  • Self-signed TLS certificate.
Deploy behind a public HTTPS endpoint with a valid TLS certificate, then retry. If your compliance model requires network-layer restriction, allow-list Rootly’s outbound IPs instead of blocking the endpoint entirely.
Reachability is fine, but something else in the connection didn’t succeed. Check in this order:
  1. Is mcp-grafana actually running behind the URL?
  2. Is the Grafana instance URL correct and reachable from mcp-grafana?
  3. Does the service-account token have adequate Grafana permissions? (Test the token directly against Grafana’s API.)
The service-account token is authenticating but doesn’t have permission to see the data being queried. Broaden the service account’s roles in Grafana (or its data-source-level permissions) and retry.
Something changed on the Grafana side after the initial save. Common causes: the service-account token was revoked or rotated, mcp-grafana was redeployed with a different config, the Grafana instance URL changed. Open the Configure screen and re-save.
Rootly AI queries whatever dashboards the service-account token can see. If you have multiple Grafana instances or environments, verify that the instance URL you connected is the one you want Rootly AI to reference (e.g., production Grafana, not a staging clone).

​
Frequently Asked Questions

Grafana Cloud connects to Grafana Labs’ managed offering. One field to configure — a stack URL — and Grafana handles the rest.Grafana Managed connects to your self-hosted Grafana. Three fields to configure and you’re responsible for running the mcp-grafana server that Rootly points at.Pick Grafana Cloud if you’re on the managed offering; Grafana Managed if you self-host.
Yes — you can point multiple Rootly teams at the same mcp-grafana deployment. Each team’s service-account token controls what that team’s Rootly AI can see.
No. Every Rootly AI query reads from Grafana fresh. Grafana’s own caching (dashboard query results, alert state) still applies on the Grafana side.
Rootly’s cloud infrastructure needs a route to reach the server. A VPN-only or private-network-only address isn’t reachable from Rootly. If you need to keep the endpoint off the open internet, the standard pattern is a public HTTPS endpoint with IP allow-listing at the load balancer — allow Rootly’s outbound IP ranges and deny everything else. Contact support for the current IP allow-list.
Rootly AI’s Grafana call fails and it moves on with whatever context it already has. The investigation isn’t blocked — you just lose Grafana signal for that specific investigation. Once Grafana is back, the next investigation will query it normally.

Connectors Overview

The full list of Connectors and how they fit together.

Grafana Cloud

The managed-Grafana counterpart — no self-hosted server required.

Grafana documentation

Grafana Labs’ own reference for service accounts, roles, and mcp-grafana deployment.