dsh-grafana-query

When a DeepSeek Harness agent needs to read Grafana metrics, the biggest worry is the permission boundary. Most Grafana integrations ship with dashboard editing or alerting-rule mutation, so a single prompt-injection or a stray reasoning step can leave lasting side effects. dsh-grafana-query narrows the surface to exactly one verb: read. It executes PromQL through the Grafana uid data-source proxy endpoints and inspects unified alerting rule states. Version 0.1 contains no create, edit, delete, silence, acknowledge, or pause operation anywhere; dashboard and panel JSON are explicitly out of scope.

The plugin exposes six tools: instance health check, data-source listing, instant PromQL queries, range PromQL queries with an enforced step and per-series point budget, current alerting rule states, and provisioned alert rule definitions. Every layer carries a hard cap the plugin enforces on its own — 200 to 500 points per series, 20 000 points per range response, 100 series per query, 500 alert rules per call, and a 5 MB response ceiling. Oversized results are dropped whole rather than sliced mid-series, and meta.truncated plus pre-truncation totals always tell you exactly what was kept. Error payloads are scrubbed: the token, the Authorization header, and raw response bodies never leak. The single exception is a structured Prometheus HTTP 400 error, which passes through capped at 200 characters after a redaction pass so the agent can fix its PromQL.

It is built for ops and SRE teams who want a Harness agent to triage a firing alert, pull a multi-hour CPU utilisation trend, or compare up metrics across two Prometheus data sources — without granting the agent any write capability. Grafana 9.0 or newer is all you need on the server side; on the Grafana side a Viewer-role service account with the Alerting Full read-only fixed role is sufficient. No admin rights, no cloud access-policy tokens, no dashboard editor required.