export_all_alert_rules · Mcp Read Only Grafana MCP

WHAT IT DOES

What export_all_alert_rules does on Mcp Read Only Grafana

AI agents use export_all_alert_rules to create or update resources in Mcp Read Only Grafana — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mcp Read Only Grafana environment.

WHY IT NEEDS A POLICY

Why export_all_alert_rules needs a policy

This tool generates and exports configuration data in a structured format. While the export itself is non-destructive and could be considered a read operation, the [WRITE] tag in the description indicates the server design classifies it as a write-level operation, likely because it may create or stage exported artifacts. Export operations can have side effects (file creation, state changes in external systems).

From the tool's definition Tool description explicitly tags it as [WRITE]. The tool exports alert rules in provisioning format, which is a reversible data operation that creates/generates an artifact (export file) without permanently modifying or deleting underlying alert rules.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

export_all_alert_rules Rate-limited

export_all_alert_rules stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "export_all_alert_rules": {
      "limits": [
        {
          "counter": "export_all_alert_rules_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Mcp Read Only Grafana, so you can run agents against it safely.

FAQ

Questions about export_all_alert_rules

What does the export_all_alert_rules tool do? +

[WRITE] Export all alert rules in provisioning format. It is categorised as a Write tool in the Mcp Read Only Grafana MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on export_all_alert_rules? +

Register the Mcp Read Only Grafana MCP server in PolicyLayer and add a rule for export_all_alert_rules: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Read Only Grafana. Nothing to install.

What risk level is export_all_alert_rules? +

export_all_alert_rules is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit export_all_alert_rules? +

Yes. Add a rate_limit block to the export_all_alert_rules rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block export_all_alert_rules completely? +

Set action: deny in the PolicyLayer policy for export_all_alert_rules. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides export_all_alert_rules? +

export_all_alert_rules is provided by the Mcp Read Only Grafana MCP server (lukleh/mcp-read-only-grafana). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.