Guides8 min read

Best MCP Servers for Monitoring and Observability in 2026

Top MCP servers for monitoring and observability: Datadog for metrics and APM, Prometheus for time-series data, Grafana for dashboards, Sentry for error tracking, PagerDuty for incident management, and more.

By MyMCPTools Team·

Monitoring and observability work is fundamentally about correlation: connecting a spike in error rates to a deployment, linking slow response times to a specific database query, or tracing a cascade failure through distributed services. Traditionally, that correlation requires switching between Datadog, your logs search, Grafana dashboards, and Sentry simultaneously — a mentally exhausting process during an active incident. MCP servers change this by giving your AI direct, simultaneous access to all your observability tools.

Here are the best MCP servers for monitoring, observability, and incident response workflows.

1. Datadog MCP Server — Metrics, APM, and Infrastructure Monitoring

Datadog is the most comprehensive monitoring platform in wide use: infrastructure metrics, APM traces, log management, RUM, synthetics, and alerting all in one place. The Datadog MCP server gives your AI direct access to this data — enabling conversational monitoring that can correlate metrics, traces, and logs without you manually navigating between dashboards.

Key capabilities:

  • Query metrics with full Datadog query language (DQL) support
  • Read APM trace data and service performance summaries
  • Access monitor states, alert history, and downtime windows
  • Read log events with filter and aggregation support
  • Check infrastructure host and container health

Best for: Incident correlation during an outage. Ask "query Datadog for any metrics that spiked in the 10 minutes before our alert fired at 14:32 UTC — look at p99 latency by service, error rate by endpoint, and infrastructure CPU across the payment cluster — then check the APM traces for the payment-api service in that window and identify the slowest downstream calls" — building a root cause hypothesis in minutes rather than navigating five Datadog views manually.

2. Prometheus MCP Server — Time-Series Metrics and Alerting

Prometheus is the standard metrics backend in Kubernetes-native and cloud-native environments. The Prometheus MCP server gives your AI direct access to your metrics data and alerting rules through PromQL — making metrics exploration and alert tuning conversational rather than requiring PromQL expertise on demand.

Key capabilities:

  • Execute PromQL queries for instant and range metric data
  • List available metrics and their label cardinality
  • Read alerting rules and recording rules from configured rule groups
  • Check current alert states and firing conditions

Best for: Alert rule development and tuning. Ask "query the http_request_duration_seconds metric over the last 7 days, calculate the p95 and p99 latency per service and endpoint, identify the three endpoints with the highest variance between normal operation and peak load, and write PromQL alerting rules that would fire when they exceed the 99th percentile baseline by more than 50%" — developing alert rules grounded in your actual metric distribution rather than arbitrary thresholds.

3. Grafana MCP Server — Dashboard and Visualization Access

Grafana is the visualization layer for most Prometheus deployments — dashboards, panel configurations, and variable definitions all live there. The Grafana MCP server gives your AI access to your dashboard configurations and can read panel data — enabling AI assistance with dashboard development and debugging.

Key capabilities:

  • List and search dashboards across Grafana folders
  • Read dashboard JSON configurations including panel queries and variables
  • Query panel data directly for specific time ranges
  • Access data source configurations and query editors

Best for: Dashboard audit and improvement. Ask "read all dashboards in the 'Production' folder, identify any panels that have no data for the last 7 days (likely broken queries), check for panels using deprecated Prometheus functions, and suggest updated PromQL for the three most-viewed dashboards based on our metric naming conventions" — auditing your dashboard health without manually opening each one in Grafana.

4. Sentry MCP Server — Error Tracking and Exception Analysis

Sentry provides error tracking, performance monitoring, and release health visibility. During incidents, Sentry is often the first tool that shows you what's actually broken — which users are affected, what the stack trace looks like, and whether this error has happened before. The Sentry MCP server makes that data immediately accessible to your AI.

Key capabilities:

  • Query issues by project, severity, status, and date range
  • Read full exception details including stack traces and breadcrumbs
  • Access event frequency trends and affected user counts
  • Check release health metrics and regression detection

Best for: Post-deploy regression detection. Ask "query Sentry for any new issues that first appeared in the last 2 hours tagged to the v2.4.1 release, sort by event frequency, and for the top five show me the full stack trace, the affected user count, and whether the same exception appeared in any previous release" — running an automated release health check that would normally require 20 minutes of Sentry navigation.

5. PagerDuty MCP Server — Incident Management and On-Call

PagerDuty manages incident response: alert routing, on-call schedules, escalation policies, and incident timelines. During and after incidents, the PagerDuty data is critical for understanding what happened, who was paged, and whether the right escalation paths fired. The PagerDuty MCP server gives your AI direct access to this incident data.

Key capabilities:

  • Query incidents by status, service, urgency, and date range
  • Read incident timelines including acknowledgment and resolution events
  • Access on-call schedule information for any team or service
  • Read alert details and routing rule configurations

Best for: Incident postmortem preparation. Ask "pull all P1 and P2 incidents from the last 30 days that had a time-to-acknowledge greater than 10 minutes, group them by service and on-call team, calculate the average time-to-acknowledge per team, and flag any incidents where the escalation policy fired (meaning the primary wasn't reached) — I'm building our monthly on-call health report" — generating postmortem data that typically requires manual PagerDuty report navigation and spreadsheet work.

6. Elasticsearch MCP Server — Log Search and Analysis

Elasticsearch (often combined with Kibana as part of the ELK stack) is a common centralized log storage backend. When debugging production issues, log search is critical — but crafting Elasticsearch queries manually or navigating Kibana's UI during an incident is slow. The Elasticsearch MCP server gives your AI direct log query access.

Key capabilities:

  • Execute Elasticsearch queries with full DSL support
  • Search across indices with field filtering and aggregations
  • Access index mappings to understand log field structure
  • Run log pattern analysis and frequency aggregations

Best for: Log-driven incident investigation. Ask "search the application logs index for the 30-minute window around our incident at 14:32 UTC, filter to ERROR and FATAL level events in the payment-service, group by exception class and count occurrences, then for the top three exception types pull the full log entries from the first occurrence — I need to understand the cascade sequence" — reconstructing an incident timeline from logs without manually building Elasticsearch queries.

7. InfluxDB MCP Server — Time-Series Infrastructure Metrics

InfluxDB is purpose-built for time-series data and is commonly used for infrastructure metrics, IoT sensor data, and high-frequency telemetry where Prometheus's cardinality limits become a constraint. The InfluxDB MCP server provides conversational access to your time-series data.

Key capabilities:

  • Execute Flux queries for time-series analysis
  • List buckets, measurements, and field keys
  • Query data with windowing and aggregation functions
  • Access retention policies and continuous query configurations

Best for: Capacity planning and trend analysis. Ask "query InfluxDB for the last 30 days of disk utilization data across our database servers, calculate the growth trend per server, project when each server will exceed 85% capacity at the current growth rate, and flag any that will breach that threshold within 60 days" — running a capacity planning analysis without writing Flux queries manually.

Recommended Stacks for Monitoring Teams

  • Cloud-native stack: Prometheus + Grafana + Sentry + PagerDuty (metrics + visualization + errors + incidents)
  • Enterprise stack: Datadog + PagerDuty + Elasticsearch (all-in-one APM + incident management + log search)
  • Incident response stack: Datadog + Sentry + PagerDuty (correlated alerts, errors, and incident timelines during active incidents)
  • Full observability stack: Datadog + Prometheus + Grafana + Sentry + PagerDuty + Elasticsearch — complete coverage from metrics to errors to logs to incidents

Browse all Analytics MCP servers and DevOps MCP servers on MyMCPTools. For related guides, see Best MCP Servers for DevOps and Best MCP Servers for Site Reliability Engineers.

Recommended Tools

Better Stack

Free Plan

Get alerted when your APIs, browser tests, payment pipelines, or MCP server dependencies go down. Used by 100K+ developers.

Start monitoring free →

1Password

14-day Free Trial

Store and inject API keys, payment credentials, tokens, and file access secrets into your MCP server configs. Trusted by 150K+ developers.

Try 1Password free →

🔧 MCP Servers Mentioned in This Article

📊

Datadog MCP Server

The Datadog MCP Server is Datadog's official, vendor-hosted Model Context Protocol endpoint — not a package. Each Datadog site has its own URL of the form https://mcp.<your-site>/api/unstable/mcp-server/mcp (US1: mcp.datadoghq.com, EU1: mcp.datadoghq.eu), and OAuth 2.0 is the recommended way in; a Personal or Service Access Token as an Authorization bearer header is the documented fallback for CI, with DD_API_KEY plus DD_APPLICATION_KEY headers as a third option. Datadog ships first-party client integrations rather than expecting hand-written config: a Claude Code plugin (/plugin install datadog@claude-plugins-official, then /ddsetup and /ddtoolsets), a Claude connector from the Connectors Directory, plugins for Cursor, VS Code/Copilot, JetBrains and OpenCode, and a ChatGPT app in Preview for US1. Tools are grouped into toolsets selected with a ?toolsets= query parameter, and only `core` — logs, metrics, traces, dashboards, monitors, incidents, hosts, services, events, notebooks — loads by default; two dozen more cover alerting, DBM, DDSQL, RUM, profiling, security, Kubernetes, error tracking, feature flags, cost management and data observability, with apm, cases, code-exec and remote-actions in Preview and excluded from toolsets=all. Access requires the mcp_read or mcp_write role permission in addition to the normal resource permission, which is why a working connection can still return no data. Limits at time of writing are 50 requests per 10 seconds of tool-call burst and 50,000 tool calls per month, and the server is not GovCloud compatible.

Local📘
🔧

Prometheus MCP Server

The Prometheus MCP Server lets an AI assistant drive a live Prometheus instance through the HTTP API instead of you hand-writing PromQL in the expression browser — ask it why queries got slow, what is currently firing, or which recording rules would make an SLO cheap to evaluate, and it composes and runs the queries itself. One point of provenance worth knowing before you install: this began life as tjhop/prometheus-mcp-server and was adopted into the Prometheus organisation, so that path now 301-redirects to prometheus/prometheus-mcp, while release binaries and container images are still published under the tjhop namespace. The tool surface goes far past a single query endpoint. Instant and range queries (query, range_query, exemplar_query) sit alongside discovery tools — label_names, label_values, metric_metadata, list_targets, alertmanagers — and operational ones: list_alerts, list_rules, config, flags, build_info, healthy, ready, plus TSDB admin endpoints such as clean_tombstones, delete_series, snapshot, reload, wal_replay_status and quit. It also embeds the official prometheus/docs corpus as both tools (docs_list, docs_read, docs_search) and MCP resources under prometheus://docs, so the model can cite metric-naming best practice rather than invent it. Two features exist specifically to keep long investigations inside a context window: optional TOON (Token-Oriented Object Notation) encoding of API responses in place of JSON, and a configurable response-truncation limit that capable models can override per tool call. Prometheus-compatible backends are handled explicitly rather than assumed — a --prometheus.backend flag selects an implementation, and the Thanos profile removes the tools Thanos returns 404 for (config, alertmanagers, quit, reload, the TSDB admin set) while adding list_stores. Install as a Go binary from the releases page, as a Debian/RPM system package with a bundled systemd unit, via the OCI Helm chart at oci://ghcr.io/tjhop/charts/prometheus-mcp-server, or as a container: `docker run --rm -i ghcr.io/tjhop/prometheus-mcp-server:latest --prometheus.url "https://your-prometheus:9090"` for stdio, or add `--mcp.transport http --web.listen-address ":8080"` for streamable HTTP. Every flag has a PROMETHEUS_MCP_SERVER_* environment-variable equivalent. Secured Prometheus instances are reached with a standard Prometheus http_config file via --http.config, and the MCP endpoint itself can be put behind TLS and basic auth with a Prometheus web-configuration file via --web.config.file. Read the credential-forwarding note before exposing it: over HTTP transport the server forwards each request's Authorization header to Prometheus verbatim without validating it, requests without one fall back to the default client's credentials, and basic_auth_users in the web config conflicts with that forwarding — so anyone who can reach the endpoint can query Prometheus as at least the default client.

Local
📊

Grafana MCP Server

The official Grafana MCP server connects Claude and other AI assistants directly to your Grafana instance and its surrounding observability ecosystem, turning natural-language questions into dashboard lookups, incident investigations, and datasource queries. Dashboard tools cover search, retrieval, JSONPath-scoped property extraction, patch-based editing, and per-panel query/datasource introspection, with context-window-aware helpers like get_dashboard_summary so an agent never has to pull a full multi-megabyte dashboard JSON just to answer a simple question. Query tools speak PromQL against Prometheus (including histogram-percentile helpers), LogQL against Loki, and native query languages for InfluxDB, ClickHouse, CloudWatch, Graphite, Athena, Snowflake, Elasticsearch/OpenSearch, and Quickwit datasources — most gated behind opt-in --enabled-tools flags to keep the default tool surface lean. It also wraps Grafana Incident for creating and updating incidents, Sift for automated error-pattern and slow-request investigations, full alerting CRUD (rules, contact points, notification policies) across Grafana-managed and external Alertmanager sources, Grafana OnCall schedule/shift/alert-group management, RBAC-gated admin tools for teams/users/roles, deeplink generation so the LLM never has to guess a dashboard URL, annotations, snapshots, PNG rendering via the Grafana Image Renderer, and provisioning-repo validation for git-sync workflows. Authentication is a Grafana service account token (Editor role, or granular RBAC scopes) passed as GRAFANA_SERVICE_ACCOUNT_TOKEN alongside GRAFANA_URL, and every tool category can be individually disabled to control context-window usage. On install, the recommended route is uvx: `uvx mcp-grafana` pulls the PyPI package mcp-grafana, which is published by Grafana Labs from this same repository — so despite the server being written in Go, the copy-paste command most Claude Desktop and Cursor configs use is a Python-tooling one, not a binary download. The alternatives are `go install github.com/grafana/mcp-grafana/cmd/mcp-grafana@latest` for a real binary, or the grafana/mcp-grafana container — `-t stdio` for local clients, or the default HTTP mode on :8000 (add `-t streamable-http`) with MCP_GRAFANA_SERVER_TOKEN set to authenticate callers when you expose it.

Local
🔧

Sentry MCP Server

The Sentry MCP Server is Sentry's official Model Context Protocol integration, purpose-built for human-in-the-loop coding agents like Claude Code, Cursor, and Windsurf. Rather than exposing every Sentry API endpoint, it focuses tightly on developer debugging workflows: searching and triaging issues, pulling stack traces and event details, inspecting performance traces, and querying project/team/org metadata in natural language. The primary deployment is a hosted remote MCP server at mcp.sentry.dev, built on Cloudflare's remote-MCP infrastructure, so most users connect with zero local setup — just add the remote URL to their client. For self-hosted Sentry instances or local development, a stdio transport is also available via npx @sentry/mcp-server, authenticated with a Sentry User Auth Token scoped to org:read, project:read, project:write, team:read, team:write, and event:write. AI-powered search tools (search_events, search_issues) translate natural-language queries into Sentry's query syntax, but require a configured LLM provider (OpenAI, Azure OpenAI, Anthropic, or OpenRouter) — all other tools work without one. Claude Code users can also install it as a plugin (claude plugin install sentry-mcp@sentry-mcp) for automatic subagent delegation whenever a conversation touches Sentry errors, issues, or traces. This turns "why did this deploy break in production" into a direct conversational debugging session instead of tab-switching into the Sentry dashboard.

Auth required📘
🔧

PagerDuty MCP Server

PagerDuty MCP Server is PagerDuty's official, actively maintained local MCP server (github.com/PagerDuty/pagerduty-mcp-server) for managing incident response directly from an MCP-enabled client like Claude, Cursor, or VS Code. Beyond the standard tool surface for incidents, services, on-call schedules, and event orchestrations, it ships embedded React 'MCP Apps' that render interactive UIs inside supporting IDEs: an Incident Command Center with a real-time incident feed, timeline/notes/alert inspection, one-click acknowledge/escalate/resolve, and AI-powered similar-incident detection; an On-Call Manager for schedule overrides and escalation-policy edits; an On-Call Compensation Report tracking hours worked, interruption rates, and EU Working Time Directive compliance with CSV export; a Service Dependency Graph visualizing upstream/downstream impact; and an Onboarding Wizard for first-time account setup. The server runs as a single Python process via `uv run pagerduty-mcp`, avoiding a separate HTTP server to manage. Authentication uses a PagerDuty User API Token generated from My Profile → User Settings → API Access (Freemium accounts have role-based limits on who can generate one), used subject to PagerDuty's Developer Agreement. This combination of deep incident-lifecycle tooling and embedded operational dashboards makes it one of the more feature-complete official vendor MCP servers for on-call/DevOps teams.

Local
🔍

Elasticsearch MCP Server

The Elasticsearch MCP Server (elastic/mcp-server-elasticsearch) is Elastic's official server for connecting AI agents to Elasticsearch data over the Model Context Protocol, enabling natural-language querying, analysis, and retrieval across your indices without building custom APIs. Once connected, an assistant can list available indices, inspect field mappings, and run searches or ES|QL queries described in plain English — "show me the top error messages from the last 24 hours" — against an Elasticsearch 8.x or 9.x cluster. Five tools ship in 0.4.x: list_indices, get_mappings, search, esql and get_shards. Important status note: the README now carries a deprecation caution — the standalone server receives only critical security updates going forward, and Elastic has superseded it with the Elastic Agent Builder MCP endpoint at {KIBANA_URL}/api/agent_builder/mcp, available in Elastic 9.2.0+ and Elasticsearch Serverless projects, which is the recommended path for new integrations. The install route also changed at 0.4.0 and this is the trap: 0.3.1 and earlier were published to npm as @elastic/mcp-server-elasticsearch, that package is now marked deprecated on the npm registry and frozen at 0.3.1 (published 2025-07-01), and 0.4.0 onwards ships only as the Docker image docker.elastic.co/mcp/elasticsearch — so every `npx -y @elastic/mcp-server-elasticsearch` config still circulating installs a version two releases behind with no esql tool. The container supports stdio and streamable-HTTP transports (SSE is deprecated); in HTTP mode it listens on :8080 with the MCP endpoint at /mcp and a health check at /ping. Configure it with the `ES_URL` environment variable pointing at your cluster plus either an `ES_API_KEY` or an `ES_USERNAME`/`ES_PASSWORD` pair for authentication; an optional `ES_SSL_SKIP_VERIFY=true` is available for development-only TLS bypass. Run in stdio mode with `docker run -i --rm -e ES_URL -e ES_API_KEY docker.elastic.co/mcp/elasticsearch stdio` and add the equivalent block to your Claude Desktop, Cursor, or VS Code MCP config.

Local📘
🗄️

InfluxDB

Time-series database MCP for InfluxDB. Write and query metrics using Flux or InfluxQL. Ideal for monitoring, IoT, and observability data.

Local
📊

Logfire

Provides access to OpenTelemetry traces and metrics through Logfire.

Local

📚 More from the Blog