Observability
Step-by-step connection and configuration for Sentry, Prometheus, OpenSearch, Elasticsearch, Datadog, Grafana, PagerDuty, Splunk and New Relic.
Where the agent goes to find out what actually happened: the error, the metric, the log line, the incident that was open at the time.
Sentry
sentry · runs @sentry/mcp-server via npx · works with sentry.io and with
Sentry-compatible backends such as GlitchTip.
Create an auth token. Sentry → Settings → Auth Tokens → Create New Token, with
issue and project read scopes (project:read, event:read, org:read). No write
scopes.
Note the organization slug — the segment in sentry.io/organizations/<slug>/.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Access token | yes | The token above. |
| Organization slug | yes | my-org |
| Self-hosted host | no | sentry.example.com for self-hosted or GlitchTip. Blank means sentry.io. |
| Use plain HTTP | no | Only for a self-hosted host served over http://. |
Verify. Health check is whoami, so a wrong token fails immediately.
Prometheus
prometheus · runs prometheus-mcp-server via uvx.
Confirm the server URL is reachable from members' machines. Prometheus itself has no user model, so if it is exposed at all it is usually behind a reverse proxy doing basic auth — that proxy's URL is what goes in the form.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Server URL | yes | http://prometheus.internal:9090 |
| Username | no | Only if it sits behind basic auth. |
| Password | no | Required when a username is set. |
Verify. Health check is the server's own health_check.
OpenSearch
opensearch · runs opensearch-mcp-server-py via uvx.
Create a read-only user if the security plugin is enabled — a user mapped to a
role with indices:data/read/* on the log indices, and nothing else.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Cluster URL | yes | https://opensearch.internal:9200 |
| No authentication | no, defaults on | Leave on only for a cluster with the security plugin disabled. Turn it off to use the username and password below. |
| Username / Password | no | Used when No authentication is off. |
| CA certificate path | no | Absolute path on the machine running Triagic, for a private CA. |
| Verify TLS certificate | no, defaults on | Turn off for a self-signed certificate or an https:// URL pointing at a bare IP. |
Verify. Health check is the cluster-health call.
| If it reports | It usually means |
|---|---|
CERTIFICATE_VERIFY_FAILED, SSLCertVerificationError | The certificate isn't trusted by that machine. Set CA certificate path, or turn off Verify TLS certificate if it is self-signed. |
Elasticsearch
elasticsearch · runs @elastic/mcp-server-elasticsearch via npx · read-only is
structural in this version: the toolset is search, mappings, indices and shards, with
no write tools at all.
Create an API key in Kibana → Stack Management → API keys, restricted to read
privileges on the indices you need. Copy the encoded value — the base64 id:key
form. A username and password also work; the API key wins if both are filled in.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Cluster URL | yes | https://es.internal:9200 |
| API key | no | The encoded key. Preferred over username/password. |
| Username / Password | no | The alternative. Send one style or the other, not both. |
| Elasticsearch version | no, defaults 9.x | Pick 8.x for an 8.x cluster, or the handshake may be refused. |
| CA certificate path | no | Absolute path on the machine running Triagic. |
| Verify TLS certificate | no, defaults on | Turn off for a self-signed certificate. |
Verify. Health check lists indices matching *.
| If it reports | It usually means |
|---|---|
security_exception, missing authentication credentials, 401 | The key must be the base64 id:key form from Kibana, not the raw key id. |
self-signed certificate, unable to verify the first certificate | Set the CA path, or turn verification off. |
Datadog
datadog · runs datadog-mcp via npx with --read-only, which rejects every
create, update, delete, mute, cancel and trigger action.
Create an API key. Datadog → Organization Settings → API Keys.
Create an application key. Organization Settings → Application Keys, in the same organization. Scope it to read-only permissions if your plan supports scoped app keys.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| API key | yes | |
| Application key | yes | Must belong to the same organization as the API key. |
| Site | no, defaults datadoghq.com | datadoghq.eu for EU orgs; us3.datadoghq.com, us5.datadoghq.com and ddog-gov.com also exist. |
Verify. Health check lists monitors — chosen because Datadog's own key-validation tool reports bad keys as a successful result and would pass for a broken config.
| If it reports | It usually means |
|---|---|
401 / authentication failed | One of the keys is wrong, they come from different organizations, or Site doesn't match where that organization lives. |
403 / Authorization denied | Usually Site again — keys are per-region, and the default rejects keys minted in an EU or US3/US5 org. Otherwise the app key lacks scopes. |
Grafana
grafana · runs the official grafana/mcp-grafana image via Docker with
--disable-write, which turns off dashboard updates, incident creation, alerting and
annotation mutations, snapshots and Sift.
Create a service account in Grafana → Administration → Users and access → Service accounts, with the Viewer role, then Add service account token and copy it.
Work out the URL as the container sees it. This server runs inside Docker, so
localhost is the container itself. A Grafana on the same machine must be addressed
as http://host.docker.internal:3000.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Grafana URL | yes | https://grafana.example.com, or http://host.docker.internal:3000 for a local one. |
| Service account token | yes | Viewer-role token. The deprecated API keys are not used. |
Verify. Health check searches dashboards — deliberately not the datasource list, which stock RBAC hides from Viewers.
| If it reports | It usually means |
|---|---|
connection refused, no such host | The container couldn't reach that URL. See host.docker.internal above. |
401 | Token expired or revoked, or the service account is disabled. |
403 | Give the service account at least Viewer — folder-scoped permissions can also hide everything from it. |
PagerDuty
pagerduty · runs pagerduty-mcp via uvx · read-only by absence: write tools
only exist when the server is started with a flag this catalog never passes.
Create a user API token. PagerDuty → User Settings → API Access → Create API User Token. This is not an Events API v2 integration key; those do not work here. Mint it from an account with at least Responder-level visibility of the services you care about.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| User API token | yes | |
| API host | no, defaults https://api.pagerduty.com | Use https://api.eu.pagerduty.com for accounts on the EU service region. |
Verify. Health check reads the token's own user record.
| If it reports | It usually means |
|---|---|
401 | Either the wrong kind of key, or an EU account being called on the US host — PagerDuty runs separate control planes and the error is identical either way. |
403 | The token's user cannot see that data. |
Splunk
splunk · a hosted endpoint, not a local process: the desktop talks HTTPS to the
MCP Server app running inside your own Splunk instance. Nothing is installed locally.
An admin has to install the app first
This integration talks to MCP Server for Splunk Platform (Splunkbase app 7931). No credential will make it work until that app is installed and enabled on the instance.
Install app 7931 on the Splunk instance and enable it.
Create an authentication token. Splunk → Settings → Tokens → New Token, with
its audience set to mcp. Searches run under the token's own Splunk role, so a
read-only role is what keeps this read-only — and that role needs the
mcp_tool_execute capability.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Splunk URL | yes | The management port: https://splunk.example.com:8089. Not the web UI on 8000. |
| Authentication token | yes | The mcp-audience token. |
Verify. Health check reads instance info.
| If it reports | It usually means |
|---|---|
404 | The management port answered but has no MCP endpoint — app 7931 isn't installed or isn't enabled. |
401 / 403 | Token expired, audience not tagged mcp, or the owning role lacks mcp_tool_execute. |
self-signed certificate | Splunk ships a self-signed certificate on 8089 by default. Install its CA on the machine, or point the URL at a front end with a trusted certificate. |
New Relic
new-relic · runs newrelic-mcp via npx.
Writes are not blocked here
The tool set is almost entirely query-side, but it does include incident acknowledgement, browser-monitor creation and deployment markers, and there is no switch to drop them. The key's own capabilities are the boundary.
Create a User key from a read-only user. New Relic → Administration → API keys → Create a key → User key. Licence keys and browser keys do not work.
Find the account ID — the numeric id under Administration → Access management.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| User API key | yes | NRAK-… |
| Account ID | yes | 1234567 |
| Region | no, defaults US | Pick EU for an EU-datacentre account. |
Verify. Health check fetches account metadata, so it fails on both a bad key and an account the key cannot see.
| If it reports | It usually means |
|---|---|
401 / 403 | Wrong key type, or the wrong Region — an EU key fails against the US endpoint with exactly this error. |
account not found | The key works but its user isn't on that account. |