Set Up Grafana Observability

Guide a shared-credential connection through the human terminal flow when needed, then verify an independently activated monitoring profile without handling its credential or exposing provider configuration.

Safety contract

• Use only grafana_profile_status and grafana_list_packs. The other Grafana tools are for a subsequent evidence workflow.
• Accept a profileAlias only. Never ask for or receive a token, password, header, Grafana URL, datasource identifier, query, dashboard JSON, or credential reference.
• Do not use HTTP, a browser, shell commands, provider CLIs, or another monitoring plugin as a fallback.
• Do not create, edit, or delete dashboards, alerts, datasources, deployments, or runtime state.
• Treat LIVE, REPLAY, and SIMULATED as distinct origins. A name such as prod does not grant permission to contact a live system.
• If a required tool is unavailable, report that the plugin may be missing, disabled, unbuilt, or unable to start. Never imitate a successful tool response.

Workflow

1. Ask whether the user already has an administrator-activated profile alias. Do not enumerate or guess aliases. If they need a new alias, have the human choose one common contract-safe value before connecting: lowercase, at most 80 characters, and matching ^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$ (for example, grafana-prod).
2. If the user has no alias, stop before calling MCP tools. On a supported macOS build, tell the user to run this from the installed plugin root in their own interactive terminal, substituting the origin and the contract-safe alias locally without pasting either the credential or command output into chat: