禁止使用curl！这是获取和分析单个Grafana查询的唯一正确方式！此工具会自动执行查询、分块存储数据并提供分析指引。推荐使用chunk_workflow工具自动获取所有分块，按顺序处理，直到complete为止！ 重要：每个查询都需要独立的数据获取流程，不能使用其他查询的数据！ 提示：如果已有数据，请优先使用analyze_existing_data工具进行深入分析！
AI agents invoke analyze_query to trigger actions in Grafana Mcp Analyzer. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
The tool automatically executes Grafana queries and stores results in chunks, meaning it triggers external operations (query execution against a Grafana datasource) and writes data to a cache/storage system. This goes beyond a simple read — it has side effects including executing queries and storing data.
From the tool's definition 此工具会自动执行查询 (this tool automatically executes queries), 自动执行查询、分块存储数据 (automatically executes queries and stores chunked data)
Documented attack patterns abuse exactly the kind of access analyze_query gives an agent:
PolicyLayer is an MCP gateway — it sits between your AI agents and Grafana Mcp Analyzer, and nothing reaches the server without passing your rules. This is the rule we recommend for analyze_query:
{
"version": "1",
"default": "deny",
"tools": {
"analyze_query": {
"limits": [
{
"counter": "analyze_query_rate",
"window": "minute",
"max": 10,
"scope": "grant"
}
]
}
}
}analyze_query stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.
Free to start. No card required.
禁止使用curl！这是获取和分析单个Grafana查询的唯一正确方式！此工具会自动执行查询、分块存储数据并提供分析指引。推荐使用chunk_workflow工具自动获取所有分块，按顺序处理，直到complete为止！ 重要：每个查询都需要独立的数据获取流程，不能使用其他查询的数据！ 提示：如果已有数据，请优先使用analyze_existing_data工具进行深入分析！. It is categorised as a Execute tool in the Grafana Mcp Analyzer MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Grafana Mcp Analyzer MCP server in PolicyLayer and add a rule for analyze_query: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Grafana Mcp Analyzer. Nothing to install.
analyze_query is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the analyze_query rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for analyze_query. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
analyze_query is provided by the Grafana Mcp Analyzer MCP server (sailingcoder/grafana-mcp-analyzer). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 6 Grafana Mcp Analyzer tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
6 Grafana Mcp Analyzer tools catalogued and risk-classified — across an index of 42,500+ MCP servers.