discover_sensors · Grafana MCP Server MCP: Risk & Policy

WHAT IT DOES

What discover_sensors does on Grafana MCP Server

AI agents invoke discover_sensors to trigger actions in Grafana MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why discover_sensors needs a policy

Port scanning is an active network operation (Execute category) that probes external systems. It is not a simple read/query of stored data; it initiates network connections to discover live services. Misuse could trigger security alerts, scan unauthorized hosts, or be used as reconnaissance.

From the tool's definition 'Scan ports for active SSH-tunneled Corelight sensor Grafana instances' — actively scans network ports and performs discovery operations

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

discover_sensors Rate-limited

discover_sensors stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "discover_sensors": {
      "limits": [
        {
          "counter": "discover_sensors_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Grafana MCP Server, so you can run agents against it safely.

FAQ

Questions about discover_sensors

What does the discover_sensors tool do? +

Scan ports for active SSH-tunneled Corelight sensor Grafana instances. It is categorised as a Execute tool in the Grafana MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on discover_sensors? +

Register the Grafana MCP Server MCP server in PolicyLayer and add a rule for discover_sensors: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Grafana MCP Server. Nothing to install.

What risk level is discover_sensors? +

discover_sensors is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit discover_sensors? +

Yes. Add a rate_limit block to the discover_sensors rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block discover_sensors completely? +

Set action: deny in the PolicyLayer policy for discover_sensors. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides discover_sensors? +

discover_sensors is provided by the Grafana MCP Server MCP server (quanticsoul4772/grafana-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.