Grafana MCP Server with OAuth 2.1

Secure Grafana MCP (Model Context Protocol) server with OAuth 2.1 authentication on AWS, enabling AI agents to query Grafana dashboards, metrics, traces, and logs.

This MCP server enables AI agents to interact with Grafana for:

• Querying dashboards and metrics
• Analyzing traces and logs
• Investigating incidents
• Providing intelligent troubleshooting

Works with the sample-grafana-prometheus-stack for complete agentic observability demo.

Security Features

✅ OAuth 2.1 compliant (RFC9728)
✅ Multi-layer WAF protection
✅ VPC isolation with private subnets
✅ Encrypted at rest and in transit
✅ Non-root containers
✅ Secrets Manager integration

Architecture

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│  CloudFront  │────│     WAF      │────│     ALB      │
│     CDN      │    │  Protection  │    │              │
└──────────────┘    └──────────────┘    └──────────────┘
                                               │
                    ┌──────────────────────────┴────────┐
                    │                                   │
                    ▼                                   ▼
            ┌──────────────┐                  ┌──────────────┐
            │   Cognito    │                  │  ECS Fargate │
            │  User Pool   │                  │              │
            │ (OAuth 2.1)  │                  │ ┌──────────┐ │
            └──────────────┘                  │ │  OAuth   │ │
                    │                         │ │ Wrapper  │ │
                    │ JWT Validation          │ └────┬─────┘ │
                    └─────────────────────────┤      │       │
                                              │      ▼       │
                                              │ ┌──────────┐ │
                                              │ │ Grafana  │ │
                                              │ │   MCP    │ │
                                              │ │  Server  │ │
                                              │ └──────────┘ │
                                              └──────────────┘

Components

• Cognito User Pool: OAuth 2.1 authorization with MFA support
• CloudFront + WAF: Global CDN with multi-layer protection
• ECS Fargate: Serverless container hosting
• OAuth Wrapper: JWT token validation and proxying
• Grafana MCP Server: Official MCP server for Grafana integration

Deployment

Prerequisites

• AWS CLI configured
• AWS CDK installed: npm install -g aws-cdk
• Docker running
• Grafana instance url with service account token: Deploy sample-grafana-prometheus-stack to automate generating this stack.

Automated Setup

scripts/complete-setup.sh