@kansodata/kansodata-grafana-plugin

OpenClaw plugin and operational skill for secure Grafana read-only diagnostics with gated future write operations.

openclaw plugins install clawhub:@kansodata/kansodata-grafana-plugin

OpenClaw external plugin and operational skill for secure Grafana diagnostics.

Current Scope (v0.1.0)

This version is read-focused and hardened by default:

Read-only Grafana API tools for health, dashboards, datasources, alert rules, and folders
Explicit action gates with fail-closed defaults for future write operations
Config validation, token redaction, normalized HTTP errors, and timeout controls
Operational skill for inspect/diagnose/propose workflows

bash

npm install
npm run build

Primary configuration comes from env vars (or OpenClaw plugin config with same keys).

Variable	Required	Default	Description
`GRAFANA_URL`	Yes	-	Grafana base URL (HTTPS recommended; strict TLS default).
`GRAFANA_TOKEN`	Yes	-	Grafana service-account token.
`GRAFANA_ORG_ID`	No	unset	Optional org context header (`X-Grafana-Org-Id`).
`GRAFANA_TIMEOUT_MS`	No	`10000`	Request timeout in ms (`1000`-`60000`).
`GRAFANA_TLS_STRICT`	No	`true`	If true, only HTTPS URL accepted.

json

{
  "read": true,
  "create": false,
  "update": false,
  "delete": false,
  "alerting_write": false
}

Read-only tools:

Future-write stubs (explicitly disabled in v1):

See:

grafana_list_alert_rules now uses safe endpoint fallback:

The client also maps non-array grouped payloads into a flat compact output for agents.

bash

npm run lint
npm run typecheck
npm run build
npm test
npm pack

When GRAFANA_URL and GRAFANA_TOKEN are available, integration tests run:

bash

npm test

If env vars are missing, integration tests are skipped automatically and only unit tests run.