From 2a695da0dd607f6730652b8ea9937958434f1ef0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 27 Aug 2026 17:29:17 +0200 Subject: [PATCH] Declare the Grafana MCP server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prometheus, Loki and Tempo become tools the assistant can call, so the telemetry can be questioned rather than browsed — which is where the trace dashboard kept running out of road. Verified: LibreChat initialises the server in 168ms and loads its tool list. No oauth block, unlike every other server here. The others sit behind a Kong gateway enforcing openid-connect; this one is reached directly on the cluster network and authenticates to Grafana with a service account token of its own. LibreChat passes no user identity along, so there is no per-user scoping: every LibreChat user gets the same full read of all telemetry, including the Kong audit records and the LLM prompts now captured there. That is stated in the config rather than left to be discovered, and it is the reason to move this server behind a gateway like the others. allowedDomains gains the first http:// and first cluster-internal entry; without it LibreChat's SSRF protection refuses the address. Co-Authored-By: Claude Opus 5 --- k8s/librechat/configmap-app.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/k8s/librechat/configmap-app.yaml b/k8s/librechat/configmap-app.yaml index 4db6202..613583d 100644 --- a/k8s/librechat/configmap-app.yaml +++ b/k8s/librechat/configmap-app.yaml @@ -14,7 +14,23 @@ data: - "https://sales-dev.sttlab.local" - "https://workforce-dev.sttlab.local" - "https://keycloak.sttlab.local" + # Cluster-internal and unencrypted, unlike every other entry: the + # Grafana MCP server is reached directly, not through a gateway. + - "http://mcp-grafana.observability.svc.cluster.local:8000" mcpServers: + # Grafana's own MCP server: Prometheus, Loki and Tempo as tools, so the + # telemetry can be questioned instead of browsed. + # + # No oauth block, unlike every other server here. The others sit behind a + # Kong gateway enforcing openid-connect; this one is reached directly on + # the cluster network and authenticates to Grafana with a service account + # token of its own. LibreChat passes no user identity along, so there is + # no per-user scoping either — every LibreChat user gets the same full + # read of all telemetry. That is the reason to move it behind a gateway + # like the others. + grafana: + type: streamable-http + url: http://mcp-grafana.observability.svc.cluster.local:8000/mcp catalog-mcp: type: streamable-http url: https://catalog-dev.sttlab.local/catalog-mcp