diff --git a/k8s/librechat/configmap-app.yaml b/k8s/librechat/configmap-app.yaml
index 4db6202..613583d 100644
--- a/k8s/librechat/configmap-app.yaml
+++ b/k8s/librechat/configmap-app.yaml
@@ -14,7 +14,23 @@ data:
         - "https://sales-dev.sttlab.local"
         - "https://workforce-dev.sttlab.local"
         - "https://keycloak.sttlab.local"
+        # Cluster-internal and unencrypted, unlike every other entry: the
+        # Grafana MCP server is reached directly, not through a gateway.
+        - "http://mcp-grafana.observability.svc.cluster.local:8000"
     mcpServers:
+      # Grafana's own MCP server: Prometheus, Loki and Tempo as tools, so the
+      # telemetry can be questioned instead of browsed.
+      #
+      # No oauth block, unlike every other server here. The others sit behind a
+      # Kong gateway enforcing openid-connect; this one is reached directly on
+      # the cluster network and authenticates to Grafana with a service account
+      # token of its own. LibreChat passes no user identity along, so there is
+      # no per-user scoping either — every LibreChat user gets the same full
+      # read of all telemetry. That is the reason to move it behind a gateway
+      # like the others.
+      grafana:
+        type: streamable-http
+        url: http://mcp-grafana.observability.svc.cluster.local:8000/mcp
       catalog-mcp:
         type: streamable-http
         url: https://catalog-dev.sttlab.local/catalog-mcp