Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Apono Agent Privilege Guard for Grafana

Configure governed, just-in-time AI access to Grafana resources

Set up Apono Agent Privilege Guard for Grafana to give AI agents controlled, temporary access to Grafana resources.

An Apono admin configures the Grafana integration, an agentic access flow, and the Grafana MCP. Each user then connects a supported AI client through the Local Agentic Gateway, which brokers requests between the AI client, Apono, and Grafana.

Limitations

Before you integrate Grafana, review the following limitations:

  • Grafana OSS data source access: Apono cannot grant access to data sources in Grafana OSS because Grafana OSS does not support managing data source permissions.

  • Organization Roles: Human users cannot request Organization Roles because assigning an Organization Role would replace their predefined role and could reduce their existing permissions. Organization Roles are intended only for agentic users.

Set up the Apono account

An Apono admin completes this setup once.

After the Apono account setup is complete, each user can connect a supported AI client to the Agentic Gateway.

Prerequisite

Requirement
Details

Grafana integration

A connected, healthy Grafana integration with the Organization Role resource selected

Verify that the integration exists and is healthy on the Connected tab. If no Grafana integration is connected, follow the Grafana integration docs.

Create an agentic access flow

Create a Self Serve access flow that allows agents to request temporary access to Grafana resources on behalf of permitted users:

  1. Follow the procedure in Self Serve Access Flows to define the requestors, resources, access duration, and approval process. As you create the flow, apply the following settings for agentic access.

Setting
Configuration

Access Flow Name

Enter a unique, user-friendly name, such as Agentic - Grafana.

When Requestor

Select the users or groups on whose behalf an agent can request access. The agent can request access only on behalf of its associated user, so that user must match these requester conditions. For Can request for, select Themselves.

Request access to

Select your Grafana integration, and then select the Organization Role resource type.

Follow the Integrations instructions in the Define the resource section of the Self Serve Access Flows guide. NOTE: Use Read Only for query-only access. Grant Read Write or Admin only when required for the agent’s intended tasks.

Grant for

Set the access duration to 5 minutes.

Approval

Select Automatic

Settings

Click the Restrict to agentic access toggle to enable the setting.

Allow Extend Duration does not apply to agentic access flows. When access expires, the agent requests access again.

  1. Configure any other Self Serve access flow settings according to your organization’s access policies.

  2. Click Save Access Flow.

Enable MCP features and the Grafana MCP

Follow these steps:

  1. On the Account Settings page, under AI & Automation, click the Enable MCP features toggle to enable the setting. The toggle turns green.

  2. On the MCPs tab, under Apono Managed Tools, click the toggle on the Grafana MCP card to enable the tool.

Learn more about Model Context Protocol servers.

After setup, use the AI Agents tab to view discovered agents and their associated users. Use the AI Sessions tab to review agent activity, including access grants, tool calls, and intent policy decisions.

Set up the Agentic Gateway on a local machine

Learn more about local and remote agentic gateways setups.

Each user running the gateway completes this setup on their local machine.

Prerequisites

Requirement
Details

Apono account setup completed

Enablement of MCP feature for the Apono account

Confirm that an Apono admin has set up the Apono Account:

  • Connected the applicable integration

  • Created an agentic access flow with Restrict to agentic access enabled

  • Enabled MCP features and the Grafana MCP

Supported operating systems

Supported operating systems:

  • macOS

  • Windows 11 (native)

  • WSL2 (Ubuntu)

Node.js 20+

Required runtime

The gateway is launched with npx, which runs @apono-io/apono-mcp@latest, downloads the gateway binary, and manages the Apono sign-in. No separate Apono CLI installation is required.

uvx

Required by the Grafana MCP. Install uv and ensure uvx is available in your PATH.

Configure your AI client

If the Agentic Gateway is already configured for this client, skip to Verify your agent.

Follow these steps:

  1. Run the following command for your operating system. If this is the first run, a separate browser tab opens.

macOS

Windows 11 (native)

In Command Prompt or PowerShell:

WSL2 (Ubuntu)

  1. (First run only) Log in to Apono in the open browser tab.

Follow these steps:

  1. In Claude, from the main navigation, click Claude > Settings > Developer. The Settings page appears.

  2. Click Edit Config. The claude_desktop_config.json file opens.

  3. Add the following configuration.

  1. Save the file.

  2. Quit and restart Claude desktop.

  3. (First run only) Log in to Apono in the browser tab that opens.

Quick Start Installation

Follow these steps:

  1. Click the following button to install the MCP Server. The MCP page in Cursor opens.

Add to Cursor

  1. Click Install.

  2. Quit and restart Cursor.

  3. (First run only) Log in to Apono in the browser tab that opens.

Manual Installation

Follow these steps:

  1. In Cursor, from the main navigation, click Tools & MCPs. The Tools page appears.

  2. Under Home MCP Servers, click New MCP Server. The mcp.json file opens.

  3. Add the following configuration.

  1. Save the file.

  2. Quit and restart Cursor.

  3. (First run only) Log in to Apono in the browser tab that opens.

Verify your agent

Perform the following tests:

  1. Ask the assistant to list your available integrations. The Grafana target should appear.

  2. Ask it to perform an action, such as "Request access to account X and list its resources". The agent will request access through the agentic access flow.

Apono handles Grafana authentication for you. Once the request is approved, it fetches short-lived credentials and wires up the connection automatically. The call should return live Grafana data.

If either task fails, troubleshoot your setup.

Troubleshooting

Apono Account

Access is granted, but Grafana grants fail.

Verify that the Grafana integration is healthy in Apono. If the integration is unhealthy, review the Grafana integration settings.

Local Machine

No targets or integrations are listed.

Follow these steps:

  1. Reauthenticate to Apono.

  1. Fully restart the AI client so the updated credentials take effect.

  2. If the target is still unavailable, confirm with an Apono admin that the platform setup is complete. This includes the integration, agentic access flow, MCP feature enablement, and applicable Apono Managed MCP.

  3. Follow the troubleshooting instructions in the applicable platform setup guide.

Grafana MCP fails to start.

Follow these steps:

  1. Install uvx on the local machine.

  2. After installing uv, fully restart the AI client so it can detect the updated PATH.

Writes are blocked or awaiting approval.

By default, every Update/Create/Delete action waits for your approval, and Admin actions are denied. Ask your admin to adjust the Grafana MCP's Intent Policy if needed.

More details are needed on failures.

Add --debug to the gateway's args in your client config to enable verbose request/response logging, then check the gateway log.

Configuration changes are not reflected in the agent.

Fully restart the client. MCP servers are only launched at startup.

PreviousApono Agent Privilege Guard for Databricks
NextApono Agent Privilege Guard for Kubernetes

Last updated

Was this helpful?