diff --git a/k8s/mcp-grafana/deployment.yaml b/k8s/mcp-grafana/deployment.yaml
index 11b49d8..c4e458c 100644
--- a/k8s/mcp-grafana/deployment.yaml
+++ b/k8s/mcp-grafana/deployment.yaml
@@ -45,6 +45,24 @@ spec:
             # check is that only callers using the expected name get through.
             - "--allowed-hosts"
             - "mcp-grafana:8000,mcp-grafana.observability.svc.cluster.local:8000"
+            # 65 tools by default, 75 KiB of definitions — and an MCP client
+            # sends the whole tool list on every turn. Measured: that alone was
+            # ~19k prompt tokens per request, which is what made a three-turn
+            # conversation trip Kong's 50k-tokens-per-minute AI rate limit and
+            # fail with 429 before reaching the provider.
+            #
+            # Kept: the datasources this stack actually has, plus search to find
+            # things by name. Dropped: everything Cloud-only here (incident,
+            # oncall, sift, asserts, pyroscope), every datasource that does not
+            # exist (athena, clickhouse, cloudwatch, influxdb, elasticsearch,
+            # graphite, quickwit, snowflake), and the Grafana-administration
+            # surface (provisioning, plugin, api, config, folder, annotations,
+            # snapshot, rendering, navigation).
+            - "--enabled-tools"
+            - "search,datasource,prometheus,loki"
+            # The service account is Viewer, so writes would fail anyway —
+            # this removes their definitions from what is sent every turn.
+            - "--disable-write"
           env:
             - name: GRAFANA_URL
               # In-cluster address, not the ingress: no TLS hop, no dependency