{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:27:53.457Z",
  "record_id": "VXI-EXT-TOOL-TRUST-GRAFANA-01-v1",
  "record_kind": "external_reference",
  "title": "Grafana MCP: Query access and write restrictions",
  "system": "Grafana MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a read-only monitoring connector prevent every database query or disclosure?",
  "near_questions": [
    "Does a read-only monitoring connector still allow queries?",
    "What is the difference between Grafana MCP write and query restrictions?",
    "Can Grafana MCP raw SQL tools change data?",
    "Can SQL tools be re-enabled in Grafana read-only mode?",
    "Does query-free Grafana MCP block every datasource path?",
    "What permissions does a Grafana service account token inherit?",
    "Can one Grafana service account span organizations?",
    "Does disabling writes prevent telemetry from reaching an AI client?",
    "What should be checked before allowing datasource queries?",
    "Can a dashboard inspection task disclose sensitive data?",
    "What does a saved Grafana boundary review preserve?",
    "Does this profile verify my installed Grafana MCP flags?"
  ],
  "supported_claims": [
    {
      "claim": "Grafana's MCP repository separates disabling writes from disabling queries. Read-only mode removes raw SQL query tools unless explicitly re-enabled, while other queries can remain. Query-free mode removes query tools but is not a universal block on every datasource path. Credential and datasource privileges still need inspection. A read-only label therefore does not establish a no-query or no-disclosure boundary.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "Grafana's MCP repository separates disabling writes from disabling queries. Read-only mode removes raw SQL query tools unless explicitly re-enabled, while other queries can remain. Query-free mode removes query tools but is not a universal block on every datasource path. Credential and datasource privileges still need inspection. A read-only label therefore does not establish a no-query or no-disclosure boundary.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-DATADOG-01-v1",
    "VXI-EXT-TOOL-TRUST-ELASTIC-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Grafana MCP credential, query and write controls",
    "source_url": "https://github.com/grafana/mcp-grafana",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-GRAFANA-01-v1",
    "candidate_record_sha256": "19878da11b148924fa10660bac284d4074cdd456177a0036cd9aa1a3d41df0d7",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Grafana's MCP repository separates disabling writes from disabling queries. Read-only mode removes raw SQL query tools unless explicitly re-enabled, while other queries can remain. Query-free mode removes query tools but is not a universal block on every datasource path. Credential and datasource privileges still need inspection. A read-only label therefore does not establish a no-query or no-disclosure boundary.",
    "required_buyer_context": "Grafana's official MCP package operated against Grafana Cloud or a local instance; deployment flags, transport and credentials must be identified. Installed version, flags, transport protection, service account, datasource rights and client recipients.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Grafana MCP",
      "variant": "Grafana's official MCP package operated against Grafana Cloud or a local instance; deployment flags, transport and credentials must be identified."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Grafana publishes the server package; the deployer operates the MCP process.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Inspect observability resources and perform enabled Grafana operations.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Dashboards, datasource queries and observability metadata through enabled tools.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Dashboard and alert operations can mutate state; raw SQL authority also depends on datasource credentials.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "Service-account tokens authenticate Grafana API access and inherit the account's permissions.",
        "source_ids": [
          "grafana-auth"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Write and query flags differ; service accounts are organization-bound, with role-based access.",
        "source_ids": [
          "grafana-main",
          "grafana-auth"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Query results leave the datasource for the MCP/client workflow even if resource writes are disabled.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Re-enabling SQL with write-capable credentials, or treating query-free mode as a complete datasource barrier.",
        "source_ids": [
          "grafana-main"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Installed version, flags, transport protection, service account, datasource rights and client recipients.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "For metadata-only work, resolve alternate datasource paths and credential rights before allowing queries.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "grafana-main",
        "url": "https://github.com/grafana/mcp-grafana",
        "final_url": "https://github.com/grafana/mcp-grafana",
        "title": "Grafana MCP credential, query and write controls",
        "checked_on": "2026-10-11",
        "sha256": "29184f019ff6863034dc72570de49fe1a0c962bb30cec19dcbffb1f2b6a56294",
        "bytes": 959998
      },
      {
        "source_id": "grafana-auth",
        "url": "https://grafana.com/docs/grafana/latest/administration/service-accounts/",
        "final_url": "https://grafana.com/docs/grafana/latest/administration/service-accounts/",
        "title": "Grafana service account authority",
        "checked_on": "2026-10-11",
        "sha256": "101ae00fc0b1058857d571105246af873cb40ed587086188e92d064b036698f8",
        "bytes": 346196
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Preserve the distinction between write prevention, query exposure and datasource authority for monitoring-tool approval.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Recheck installed release, query/write flag combinations and datasource credential rights before expanding access."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#grafana-mcp-query-write-trust",
  "machine_readable_record": "/varexis-index/records/grafana-mcp-query-write-trust.json"
}