1
# Netdata MCP
2
3
-All Netdata Agents and Parents (v2.6.0+) are Model Context Protocol (MCP) servers, enabling AI assistants to interact with your infrastructure monitoring data.
3
+Netdata provides [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers that enable AI assistants to interact with your infrastructure monitoring data. You can connect via:
4
5
-Every Netdata Agent and Parent includes an MCP server, listening at same port the dashboard is listening at (default: `19999`).
5
+- **[Netdata Cloud](#netdata-cloud-mcp)** — A single cloud-hosted endpoint at `https://app.netdata.cloud/api/v1/mcp` with full visibility across all your nodes. No bridges, no firewall changes.
6
+- **[Local Agent or Parent](#local-agent-or-parent-mcp)** —
7
+ Connect directly to any Netdata Agent or Parent
8
+ (v2.6.0+) on your network at
9
+ `http://YOUR_IP:19999/mcp`.
10
7
-Netdata provides comprehensive access to all available observability data through MCP, including complete metadata:
11
+Both options provide comprehensive access to all
12
+available observability data through MCP:
13
14
- **Node Discovery** - Hardware specifications, operating system details, version information, streaming topology, and associated metadata
15
- **Metrics Discovery** - Full-text search capabilities across contexts, instances, dimensions, and labels
21
- **Function Execution** - Execute Netdata functions on any connected node (requires Netdata Parent)
22
- **Log Exploration** - Access logs from any connected node (requires Netdata Parent)
23
19
-For sensitive features currently protected by Netdata Cloud SSO, a temporary MCP API key is generated on each Netdata instance. When presented via the `Authorization: Bearer` header, this key unlocks access to sensitive data and protected functions (like `systemd-journal`, `windows-events` and `processes`). This temporary API key mechanism will eventually be replaced with a new authentication system integrated with Netdata Cloud.
20
-
24
AI assistants have different visibility depending on where they connect:
25
23
-- **Netdata Cloud**: (coming soon) Full visibility across all nodes in your infrastructure
24
-- **Netdata Parent Node**: Visibility across all child nodes connected to that parent
25
-- **Netdata Child/Standalone Node**: Visibility only into that specific node
26
+| Connection | Visibility |
27
+|------------|-----------|
28
+| **Netdata Cloud** | All nodes across your entire infrastructure |
29
+| **Netdata Parent** | All child nodes connected to that parent |
30
+| **Netdata Child/Standalone** | Only that specific node |
31
+
32
+| Feature | Cloud MCP | Agent/Parent MCP |
33
+|---------|-----------|------------------|
34
+| **Scope** | All nodes | Single agent/parent |
35
+| **Endpoint** | `app.netdata.cloud/api/v1/mcp` | `YOUR_IP:19999/mcp` |
36
+| **Transport** | Streamable HTTP | HTTP, SSE, WebSocket |
37
+| **Authentication** | Cloud API token (`scope:mcp`) | Local MCP API key |
38
+| **Network access** | Internet only | Direct access to Netdata IP required |
39
+| **Local setup** | None | Bridge may be needed for some clients |
40
+
41
+## Netdata Cloud MCP
42
+
43
+Connect AI assistants to your entire Netdata Cloud
44
+infrastructure through a single MCP endpoint —
45
+no local setup, no bridges, no firewall changes.
46
+
47
+### Prerequisites
48
+
49
+1. **Netdata Cloud account** with a **Business plan**
50
+2. **API token** with `scope:mcp` — [Create one in API Tokens settings](/docs/netdata-cloud/authentication-and-authorization/api-tokens.md)
51
+3. **Nodes claimed to Netdata Cloud** —
52
+ The Cloud MCP server can only access nodes
53
+ connected to your Netdata Cloud space
54
+
55
+### Endpoint
56
+
57
+```
58
+https://app.netdata.cloud/api/v1/mcp
59
+```
60
+
61
+**Transport:** Streamable HTTP (stateless, works behind load balancers and CDNs)
62
+
63
+### Authentication
64
+
65
+All requests to the Cloud MCP endpoint require a
66
+Bearer token in the `Authorization` header:
67
27
-## Transport Options
68
+```
69
+Authorization: Bearer YOUR_NETDATA_CLOUD_API_TOKEN
70
+```
71
+
72
+#### Creating an API Token
73
+
74
+1. Log in to [Netdata Cloud](https://app.netdata.cloud)
75
+2. Click your profile picture in the bottom-left corner
76
+3. Select **User Settings**
77
+4. Navigate to the **API Tokens** section
78
+5. Create a new token with **`scope:mcp`**
79
+6. Copy and store the token securely — you won't be able to see it again
80
+
81
+For more details, see [API Tokens](/docs/netdata-cloud/authentication-and-authorization/api-tokens.md).
82
+
83
+### Connection Configuration
84
+
85
+#### Generic MCP Client (HTTP Transport)
86
+
87
+For any MCP client that supports Streamable HTTP transport:
88
+
89
+```json
90
+{
91
+ "mcpServers": {
92
+ "netdata-cloud": {
93
+ "type": "http",
94
+ "url": "https://app.netdata.cloud/api/v1/mcp",
95
+ "headers": {
96
+ "Authorization": "Bearer YOUR_NETDATA_CLOUD_API_TOKEN"
97
+ }
98
+ }
99
+ }
100
+}
101
+```
102
+
103
+#### Clients Requiring stdio Bridge
104
+
105
+For MCP clients that only support stdio transport, use `npx mcp-remote` as a bridge:
106
+
107
+```json
108
+{
109
+ "mcpServers": {
110
+ "netdata-cloud": {
111
+ "command": "npx",
112
+ "args": [
113
+ "mcp-remote@latest",
114
+ "https://app.netdata.cloud/api/v1/mcp",
115
+ "--header",
116
+ "Authorization: Bearer YOUR_NETDATA_CLOUD_API_TOKEN"
117
+ ]
118
+ }
119
+ }
120
+}
121
+```
122
+
123
+Replace `YOUR_NETDATA_CLOUD_API_TOKEN` with your
124
+[API token](/docs/netdata-cloud/authentication-and-authorization/api-tokens.md)
125
+(must have `scope:mcp`).
126
+
127
+### Cloud MCP Troubleshooting
128
+
129
+#### Authentication Errors
130
+
131
+- Verify your API token has `scope:mcp`
132
+- Ensure the token is passed as `Authorization: Bearer <token>` (not as a query parameter)
133
+- Check that your Netdata Cloud subscription
134
+ includes a space in the Business plan
135
+
136
+#### No Nodes Visible
137
+
138
+- Confirm your nodes are claimed to Netdata Cloud and appear in the web dashboard
139
+- Check that agents are online and streaming to Cloud
140
+
141
+#### Connection Issues
142
+
143
+- The endpoint uses HTTPS — no `--allow-http` flag is needed
144
+- Test connectivity: `curl -H "Authorization: Bearer YOUR_TOKEN" https://app.netdata.cloud/api/v1/mcp`
145
+
146
+## Local Agent or Parent MCP
147
+
148
+Connect directly to any Netdata Agent or Parent on your network. All Netdata Agents and Parents (v2.6.0+) include a built-in MCP server at `http://YOUR_IP:19999/mcp`.
149
+
150
+Some MCP features — such as live process information, network connections, and full log access — are considered sensitive. These are protected by a local API key that Netdata generates automatically on startup. Without this key, AI assistants can still access metrics, alerts, and node information, but sensitive functions remain locked.
151
+
152
+### Transport Options
153
154
Netdata implements the MCP protocol with multiple transport options:
155
162
- **Direct Connection** (v2.7.2+): AI clients that support HTTP or SSE transports can connect directly to Netdata
163
- **Bridge Required**: AI clients that only support stdio need the `nd-mcp` (stdio-to-websocket) or `mcp-remote` (stdio-to-http or stdio-to-sse) bridge
164
40
-### Official MCP Remote Client (mcp-remote)
165
+#### Official MCP Remote Client (mcp-remote)
166
167
If your AI client doesn't support HTTP/SSE directly and you don't want to use `nd-mcp`, you can use the official MCP remote client (requires Netdata v2.7.2+):
168
183
184
**Note:** The `--allow-http` flag is required for non-HTTPS connections. Only use this on trusted networks as traffic will not be encrypted.
185
61
-## Finding the nd-mcp Bridge
186
+### Finding the nd-mcp Bridge
187
188
> **Note**: With the new HTTP and SSE transports, many AI clients can now connect directly to Netdata without nd-mcp. Check your AI client's documentation to see if it supports direct HTTP or SSE connections.
189
197
1. **If you have Netdata installed locally** - Use the existing nd-mcp
198
2. **If Netdata is only on remote servers** - Build nd-mcp on your desktop/laptop
199
75
-### Option 1: Using Existing nd-mcp
200
+#### Option 1: Using Existing nd-mcp
201
202
If you have Netdata installed on your desktop/laptop, find the existing bridge:
203
79
-#### Linux
204
+##### Linux
205
206
```bash
207
# Try these locations in order:
222
- **Static installations**: `/opt/netdata/usr/bin/nd-mcp`
223
- **Built from source**: `/usr/local/netdata/usr/bin/nd-mcp`
224
100
-#### macOS
225
+##### macOS
226
227
```bash
228
# Try these locations:
235
find / -name "nd-mcp" 2>/dev/null
236
```
237
113
-#### Windows
238
+##### Windows
239
240
```powershell
241
# Check common locations:
245
where nd-mcp.exe
246
```
247
123
-### Option 2: Building nd-mcp for Your Desktop
248
+#### Option 2: Building nd-mcp for Your Desktop
249
125
-If you don't have Netdata installed loca you can build just the nd-mcp bridge. Netdata provides three implementations - choose the one that best fits your environment:
250
+If you don't have Netdata installed locally you can build just the nd-mcp bridge. Netdata provides three implementations - choose the one that best fits your environment:
251
252
1. **Go bridge** (recommended) - [Go bridge source code](https://github.com/netdata/netdata/tree/master/src/web/mcp/bridges/stdio-golang)
253
- Produces a single binary with no dependencies
304
- Node.js bridge: `/path/to/bridges/stdio-nodejs/nd-mcp.js`
305
- Python bridge: `/path/to/bridges/stdio-python/nd-mcp.py`
306
182
-### Verify the Bridge Works
307
+#### Verify the Bridge Works
308
309
Once you have nd-mcp (either from existing installation or built), test it:
310
318
# Press Ctrl+C to stop the test
319
```
320
196
-## Using MCP Remote Client
321
+### Using MCP Remote Client
322
323
The official MCP remote client (`mcp-remote`) is an alternative bridge that enables stdio-only AI clients to connect to Netdata's HTTP and SSE transports (requires Netdata v2.7.2+). Unlike nd-mcp which only supports WebSocket, mcp-remote provides broader transport compatibility.
324
200
-### When to Use MCP Remote
325
+#### When to Use MCP Remote
326
327
Use `mcp-remote` when:
328
- Your AI client only supports stdio communication
330
- You're running Netdata v2.7.2 or later
331
- You don't want to build/install nd-mcp
332
208
-### Installation
333
+#### Installation
334
335
No installation required - `mcp-remote` runs via `npx`:
336
341
--header "Authorization: Bearer YOUR_API_KEY"
342
```
343
219
-### Transport Options
344
+#### Transport Options
345
346
`mcp-remote` supports multiple transport strategies:
347
366
--header "Authorization: Bearer YOUR_API_KEY"
367
```
368
244
-### Common Options
369
+#### Common Options
370
371
| Option | Description | Example |
372
|----------------|------------------------------------------------------|---------------------------------------------------------|
379
| `--host` | OAuth callback host (default: localhost) | `--host 127.0.0.1` |
380
| Port number | OAuth callback port (optional) | `9696` |
381
257
-### Authentication
382
+#### Authentication
383
384
For Netdata MCP, pass the API key via the Authorization header:
385
394
395
**Security Note:** The `--allow-http` flag is required for non-HTTPS connections. Only use this on trusted networks as traffic will not be encrypted.
396
272
-### Troubleshooting
397
+#### Troubleshooting
398
399
**Connection Issues:**
400
```bash
435
}
436
```
437
313
-### Version Management
438
+#### Version Management
439
440
Always use the latest version:
441
453
454
For more details, see the [official mcp-remote documentation](https://github.com/geelen/mcp-remote).
455
331
-## Finding Your API Key
456
+### Finding Your API Key
457
458
To access sensitive functions like logs and live system information, you need an API key. Netdata automatically generates an API key on startup. The key is stored in a file on the Netdata server you want to connect to.
459
461
462
**Note**: This temporary API key mechanism will eventually be replaced by integration with Netdata Cloud.
463
339
-### Find the API Key File
464
+#### Find the API Key File
465
466
```bash
467
# Try the default location first:
474
sudo find / -name "mcp_dev_preview_api_key" 2>/dev/null
475
```
476
352
-### Copy the API Key
477
+#### Copy the API Key
478
479
The file contains a UUID that looks like:
480
484
485
Copy this entire string - you'll need it for your AI client configuration.
486
362
-### No API Key File?
487
+#### No API Key File?
488
489
If the file doesn't exist:
490
492
2. Restart Netdata: `sudo systemctl restart netdata`
493
3. Check the file again after restart
494
370
-## AI Client Configuration
495
+### AI Client Configuration
496
497
AI clients can connect to Netdata MCP in different ways depending on their transport support:
498
374
-### Direct Connection (HTTP/SSE)
499
+#### Direct Connection (HTTP/SSE)
500
501
For AI clients that support HTTP or SSE transports:
502
530
}
531
```
532
408
-### Using nd-mcp Bridge (stdio)
533
+#### Using nd-mcp Bridge (stdio)
534
535
For AI clients that only support stdio:
536
549
}
550
```
551
427
-### Using Official MCP Remote Client
552
+#### Using Official MCP Remote Client
553
554
```json
555
{
574
- `YOUR_API_KEY`: The API key from the file mentioned above
575
- `/usr/sbin/nd-mcp`: With your actual nd-mcp path (if using the bridge)
576
452
-### Multiple MCP Servers
577
+#### Multiple MCP Servers
578
579
You can configure multiple Netdata instances:
580
593
}
594
```
595
471
-### Legacy Query String Support
596
+#### Legacy Query String Support
597
598
For compatibility with older tooling, Netdata still accepts the `?api_key=YOUR_API_KEY` query parameter on the `/mcp` endpoints. New integrations should prefer the `Authorization: Bearer YOUR_API_KEY` header, but the query-string form remains available if you are migrating gradually.
599
475
-## AI Client Specific Documentation
600
+### AI Client Specific Documentation
601
602
For detailed configuration instructions for specific AI clients, see:
603