dsh-tool-grafana
DeepSeek Harness 的 Grafana 能力：将社区 mcp-grafana 服务器与 Grafana 专属提示指导和故障排除技能组合在一起
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-tool-grafana@0.1.3Tool Grafana 以 dsh-tool-grafana 发布，当前版本为 0.1.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
Grafana capability for DeepSeek Harness (dsh).
This plugin owns no Grafana tool logic. It composes the community
mcp-grafana server as a child
@deepseek-ai/dsh-mcp-client
plugin — the model sees mcp__grafana__* tools exactly as in any MCP-aware
agent — and layers on what a plain MCP bridge cannot provide:
grafana:workflow, order 115)
encoding the upstream context-window discipline: summary before full JSON,
JSONPath for partial reads, datasource discovery before querying.grafana-troubleshooting) teaching a
systematic alert → dashboard → metrics → logs → incident workflow,
invocable on both model and user surfaces.┌─ dsh-tool-grafana (this plugin) ─────────────┐
│ config validation · prompt section · skill │
└──────────────┬─────────────────────────────────────┘
│ ctx.plugin(dsh-mcp-client, plan)
▼
┌─ mcp-grafana (community Go binary, stdio) ────────┐
│ mcp__grafana__search_dashboards │
│ mcp__grafana__query_prometheus / loki / ... │
└───────────────────────────────────────────────────┘
The same mcp-grafana binary remains directly usable by Cursor, Claude Code,
OpenClaw, etc. — one core, both ecosystems.
dsh plugin --profile web add dsh-tool-grafana
That is the whole installation: the package ships a bundle patch
(cordis.patch.yml + dsh.bundle declaration), so the plugin mounts with
its schema defaults — no YAML required. Finish setup in Settings →
Plugins → Grafana observability: enter the Grafana URL and the
service-account token, then restart the profile.
To pin categories, a launcher, or defaults without the card, add a
same-id row to ~/.dsh/profiles/web/cordis.patch.yml — the profile
layer wins over the shipped bundle layer:
- insert:
- id: grafana
name: 'dsh-tool-grafana'
config:
url: https://myinstance.grafana.net # default; the settings card can override
# The token is resolved through the DSH credential store under this
# reference — never inline in this file:
tokenCredentialRef: GRAFANA_SERVICE_ACCOUNT_TOKEN
readOnly: true
categories: [search, datasource, dashboard, prometheus, loki, alerting]
launcher:
kind: uvx
version: '0.7.9' # pin the upstream release; omit to track latest
# kind: binary
# path: /usr/local/bin/mcp-grafana # go install github.com/grafana/mcp-grafana/cmd/mcp-grafana@vX.Y.Z
Card values are stored in the DSH settings document / credential store and
override the patch config per field; the patch url remains the
fallback default.
| Field | Default | Meaning |
|---|---|---|
url | '' | Default Grafana base URL; the settings card value (web) overrides it. Both empty fails activation with guidance |
tokenCredentialRef | GRAFANA_SERVICE_ACCOUNT_TOKEN | Credential reference resolved through ctx.credentials (see below). No inline token field exists, by design |
categories | upstream default set* | mcp-grafana --enabled-tools categories |
readOnly | true | Default for --disable-write; the settings card toggle overrides it (web) |
launcher | {kind: 'uvx', version: ''} | How to start the server process; pin version (uvx) or use a versioned binary/docker tag to avoid upstream drift |
env | {} | Extra env merged into the server process |
toolCallTimeoutMs | 60000 | Per-tool-call timeout (dsh-mcp-client) |
* search, datasource, dashboard, folder, prometheus, loki, alerting, incident, oncall, sift, navigation, annotations. Heavy backends
(clickhouse, cloudwatch, snowflake, athena, elasticsearch,
quickwit, graphite, influxdb) and the runpanelquery/examples/
agento11y/assistant groups stay opt-in.
The token is resolved through the DSH credential seam (ctx.credentials),
not read from a plugin-owned env var. With the default local provider
(dsh-credentials-local), the first configured source wins:
GRAFANA_SERVICE_ACCOUNT_TOKEN=… dsh web$DSH_HOME/.credentials.yaml (what the Web Models
page writes; writable from inside DSH).env in the invocation directory.env at $DSH_HOME/.envThere is no inline token config field, so the token can never be committed
into cordis.patch.yml or leak through --dump-config output.
Connection changes take effect on profile restart. The token and URL
are resolved once at activation and handed to the mcp-grafana process
environment; stdio MCP servers cannot receive env updates after spawn.
(Native-tool plugins like the dsh-grafana dashboard editor resolve per
tool call and pick up changes live — that is the trade-off of composition
over re-implementation.)
The package ships a dsh.client entry (client.js) that mounts a card
under Settings → Plugins → Grafana observability:
grafana settings namespace, shown
verbatim after savingPrecedence is card value > patch config > activation error, per field.
npm install
npm run build # tsc → lib/
npm test # node --test (unit + real-Cordis integration)
The integration test boots the plugin under a real Cordis context with the
real dsh-system-prompt and dsh-skill services, stubbing only the child
mcp-client mount so no Grafana is needed.
dsh-mcp-client directly? You can — one YAML row works.
This plugin exists for the delta MCP can't express: validated config,
prompt-level usage discipline, and bundled workflow knowledge../invariant).MIT