registry / record
github.com/grafana/mcp-grafana
Does github.com/grafana/mcp-grafana MCP work in Claude Code and Cursor? Throne executed github.com/grafana/mcp-grafana mcp in a single-use Firecracker microVM and replayed both recorded client behaviours. Compatibility verdict: inconclusive. Is github.com/grafana/mcp-grafana mcp safe? Static security scan: 8 finding(s) to review under security ruleset v1. The full per-step results, security findings, scan date, and evidence hash are below.
> throne registry github.com/grafana/mcp-grafana
sealed
- scan id
- 55bc777ec4134b9791c1ffb2ab8be22f
- target
- https://github.com/grafana/mcp-grafana
- sealed at
- 2026-06-16 16:49:04Z
- evidence hash
- sha256:ff208d880cccc43aa1e72a20f7a1228990c10aa69f213ff1af725d2aa3ed8f05
server never launched: no package.json or pyproject.toml at the repository root, Throne can launch Node (npm/pnpm/yarn) and Python (uv) projects
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
server never launched: no package.json or pyproject.toml at the repository root, Throne can launch Node (npm/pnpm/yarn) and Python (uv) projects
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
not run, server never launched
APIKey assigned a literal value shou… (18 chars), verify it is not a live credential
mcp-grafana-HEAD/k8s_client_test.go:409APIKey assigned a literal value glsa… (25 chars), verify it is not a live credential
mcp-grafana-HEAD/mcpgrafana_test.go:1160APIKey assigned a literal value glsa… (25 chars), verify it is not a live credential
mcp-grafana-HEAD/mcpgrafana_test.go:1222spawn() called with a dynamically built command (heuristic, review): '\'powershell\', [\'-Command\', `Expand-Archive -Path "${archivePath}" -DestinationPa'
mcp-grafana-HEAD/.claude-plugin/install-binary.mjs:125spawn() called with a dynamically built command (heuristic, review): "BINARY_PATH, process.argv.slice(2), { stdio: 'inherit' });"
mcp-grafana-HEAD/.claude-plugin/install-binary.mjs:149spawn() called with a dynamically built command (heuristic, review): "BINARY_PATH, process.argv.slice(2), { stdio: 'inherit' });"
mcp-grafana-HEAD/.claude-plugin/install-binary.mjs:2144 non-local endpoint host(s) referenced in code, verify each is expected for this server's purpose: docs.victoriametrics.com (mcp-grafana-HEAD/tools/loki_backend_victorialogs.go:29), grafana.com (mcp-grafana-HEAD/mcpgrafana.go:79), opentelemetry.io (mcp-grafana-HEAD/observability/semconv.go:8), user (mcp-grafana-HEAD/validate_url.go:46)
mcp-grafana-HEAD/mcpgrafana.go:79obsolete protocol version string '2024-11-05' in source
mcp-grafana-HEAD/observability/observability_test.go:364- target
- https://github.com/grafana/mcp-grafana github
- engine
- sandboxed
- claude code
- calibration: partial recorded=9,spec=0,assumed=9
- cursor
- calibration: partial recorded=11,spec=0,assumed=7
- chatgpt desktop
- calibration: unavailable recorded=0,spec=2,assumed=16
- steps exercised
- 18 of 18
- test suite
- v1.0.0
- security ruleset
- v1.0.0
- sealed at
- 2026-06-16 16:49:04Z
- evidence hash
- sha256:ff208d880cccc43aa1e72a20f7a1228990c10aa69f213ff1af725d2aa3ed8f05
- valid until
- 2026-09-14
maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.
this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.