Assessment: Grafana MCP server
Grafana's MCP server, written in Go, has the cleanest take on read-only I've seen: turning it on doesn't just refuse writes, it removes the write tools from the list altogether — and the code says out loud that it's meant for deployments whose datasource credentials are themselves read-only. Guardrail and credential pointing the same way. Generous, verifiable read.
The standout
The standout is the disable-by-category design. Tools are grouped, and a deployment can switch whole categories off; read-only mode removes the write and query-write tools entirely rather than leaving them present-but-refusing. The comment in main.go is the tell: read-only mode is intended to pair with datasource credentials that are already read-only — so the server-side guard and the database-side permission agree, which is textbook defense in depth. Tools are annotated, and CI is heavy (11 workflows).
The method, check by check
| ✓ | Annotations | Per-tool annotations; read and write tools clearly separated. |
| ✓ | Access / read-only | Read-only mode removes write tools from the surface entirely — not present-but-refusing. |
| ✓ | Defense in depth (11) | Designed to pair with read-only datasource credentials, so guard and permission agree. Textbook. |
| ✓ | Tests & CI | Well tested, 11 CI workflows. |
| — | Path handling | API-backed; no filesystem surface. |
| ⚠ | Confirmation (8) | When write tools are enabled, individual destructive actions still rely on the host to gate rather than a server-required confirmation. |
✓ present · ⚠ the tier-two hardening still open · — not applicable
Verdict
A model for the access tier: removing write tools rather than merely refusing them, and explicitly designing the guard to sit on top of read-only credentials, is defense in depth done properly. The tier-two item left is per-action confirmation when writes are enabled. Sound on the basics, ahead on the access model and defense in depth.
Want the same read on yours?
The whole server against both tiers, a document you can forward. How it works · lesliekadenge@gmail.com.
Checkable against github.com/grafana/mcp-grafana. Offered in good faith; named only for what it does well.