Part of Grafana, not a vendor of its own. The four checks, setup and context cost live in the Grafana guide.

Part of the Grafana stack

Grafana Loki and MCP

What it is

Grafana's log store. Logs go in labeled by stream, and come out through LogQL, which looks like PromQL with a log filter on the end.

How an agent reaches it

The main Grafana MCP server, with nothing extra to install. All seven Loki tools are on by default, so a working Grafana connection already reaches them.

The tools that touch it

query_loki_logs

Runs a LogQL query and returns matching entries. Also serves VictoriaLogs datasources.

list_loki_label_names

Lists the label keys present in logs for a datasource and time range.

list_loki_label_values

Lists the unique values for one label key.

query_loki_stats

Index-level statistics about the streams a selector matches, before you query them.

query_loki_patterns

Detected log patterns for a stream selector and time range.

analyze_loki_labels

Audits a label strategy and returns a per-label verdict, optionally diagnosing query performance.

suggest_loki_alloy_label_config

Generates an Alloy loki.process snippet enforcing an approved label set.

Seven tools, all on by default, counted from the captured tools/list for the Grafana MCP server. One more tool reaches Loki without naming it: find_error_pattern_logs searches Loki for error patterns elevated against the previous period.

The limit an agent runs into

Grafana Cloud caps a Loki query at 500 series. With 1,800 hosts reporting, a broad aggregation returns 1,800 series and fails with an HTTP 400, not a partial result. Self-hosted Loki is not bound by that published cap; its own limit is 5,000 entries per query, set in local config.

What to do: Narrow the stream selector before widening the time range. query_loki_stats exists to tell you how many streams a selector matches before you pay for the query.

Reference

Tools

7, all on by default

Query language

LogQL

Also serves

VictoriaLogs datasources

Grafana Cloud cap

500 series per query

Self-hosted default

5,000 entries per query

Failure mode

HTTP 400, not a truncated result