Reliability connector security
The Grafana adapter is pack-owned and implements the provider-neutral
ReliabilityConnector port. The generic host supplies only registered-adapter
authority, secret resolution, cancellation, and confined network execution; it
contains no reliability vocabulary or Grafana connector module.
Verified remote context
Section titled “Verified remote context”Every call carries host-verified context. The adapter compares all six values to configuration before capability discovery:
- issuer;
- audience;
- canonical remote resource;
- tenant;
- workspace;
- connector identity.
Any mismatch returns context_mismatch before the transport or credential
resolver is touched. This complements the MCP authorization requirement to bind
tokens to the intended audience/resource and prohibit token passthrough; see the
authorization specification.
Pinned capabilities and scopes
Section titled “Pinned capabilities and scopes”The adapter does not accept remote tool names from callers. This is the closed allowlist:
| Pack capability | Pinned remote capability | Exact profile scope set |
|---|---|---|
get_service | list_prometheus_label_values | datasources:query, datasources:uid:prometheus-primary |
get_incident | get_incident | Grafana Viewer role (role:viewer) |
query_metrics | query_prometheus | datasources:query, datasources:uid:prometheus-primary |
query_logs | query_loki_logs | datasources:query, datasources:uid:loki-primary |
query_traces | pinned proxied tempo.query_traces | datasources:query, datasources:uid:tempo-primary |
query_alerts | alerting_manage_rules with fixed action: list | alert.rules:read, folders:uid:reliability-alerts |
get_incident_timeline | get_incident | Grafana Viewer role (role:viewer) |
Grafana documents datasources:query with resource-specific datasource scopes,
alert.rules:read with folder scopes, and Viewer access for read-only incident
operations in its MCP tools reference.
Tempo tools are discovered through Grafana’s proxied datasource surface, so the
connector pins the admitted remote name and schema digest rather than inheriting
the live proxy catalog.
Each capability must use a unique credential profile identifier, even where two
capabilities reach the same remote function. A profile is accepted only when
permission is read and its scopes exactly equal the table above. Write scopes,
extra scopes, reused profiles, and missing profiles fail during adapter creation.
Separate remediation profiles
Section titled “Separate remediation profiles”The remediation adapter has a second, explicitly write-only configuration. Its three domain actions map to fixed provider operations and exact verbs; callers cannot submit a provider tool name.
| Domain action | Fixed provider operation | Exact request verb |
|---|---|---|
| Alert silence | alerting_create_silence | alerts:silence |
| Incident state update | update_incident | incidents:update |
| Registered runbook execution | execute_registered_runbook | runbooks:execute |
Each action uses a dedicated host-owned write credential profile. The profile
must differ from the dedicated reconciliation read profile and must exactly
match the pinned connector, tenant, resource set, verb, validity window, and
schema digest in the approved plan. Effective request authority may narrow those
values but cannot expand them. Reconciliation uses only the fixed
get_mutation_operation read call; rollback uses only the inverse declared in
the approved plan, never a caller-selected method.
Schema and annotation handling
Section titled “Schema and annotation handling”Before each provider call, capability discovery must return the pinned input
schema digest. Missing or changed digests return schema_drift before
invocation. Remote annotations are untrusted metadata: they never grant
authority. An annotation that contradicts the pinned non-destructive contract
causes capability_denied.
This follows the MCP tools specification: clients must treat annotations as untrusted, validate results, enforce access controls, rate limits, output sanitization, and timeouts. See MCP tools.
Output boundary
Section titled “Output boundary”Remote results must match a closed { items, next_cursor, partial_error }
envelope. The adapter then:
- redacts token-, password-, cookie-, credential-, and secret-shaped fields;
- bounds item count and UTF-8 bytes;
- hashes normalized redacted content with SHA-256;
- marks content
untrusted-provider-output; - maps timeout, cancellation, rate limit, malformed response, and partial failure into typed outcomes.
Returned text can describe commands or request broader scopes, but remains data. No returned field can select another capability, profile, scope, or host action.