grafana/gcx

gcx — Grafana CLI

Grafana — in your terminal and your agentic coding environment. gcx works with Grafana Cloud, Enterprise, and OSS (Grafana 12+). See the compatibility matrix for details.

Query production. Investigate alerts. Let the Assistant root-cause issues. Ship fixes with observability built in. Without leaving your editor.

"Don't guess. Check the actual production data."

What is gcx?

gcx is a CLI for Grafana — Cloud, Enterprise, and OSS alike. It gives you and your AI coding agent structured access to your Grafana instance: dashboards, alerts, SLOs, metrics, logs, traces, and more. Core features (resources, alerting, signal queries) work on any Grafana 12+; Grafana Cloud adds product-specific commands on top.

gcx works with any agentic coding tool. It ships with a suite of agent skills for common workflows like alert investigation, dashboard creation and GitOps, SLO management, and observability setup - ready to use out of the box.

Contributing a new Grafana domain capability to gcx? Ask your coding agent to use integrate-with-gcx before choosing a command, provider, or datasource path.

Quick Start

# For Grafana Cloud instances
gcx login prod --server https://.grafana.net  # select oauth, then press Enter to skip cloud token selection
For self-hosted Grafana instances
gcx login local --server http://localhost:3000 --token
check how busy your API routes are (works on any Grafana)
gcx metrics query 'sum by (handler)(rate(grafana_http_request_duration_seconds_count[5m]))' --since 1h
check your grafana cloud metrics usage in the last day (Grafana Cloud only)
gcx metrics query -d grafanacloud-usage 'grafanacloud_org_metrics_billable_series'  --since 24h  --step 1h
list and search your dashboards
gcx dashboards list
gcx dashboards search "node exporter"
render a dashboard, allowing up to three minutes for the render
gcx dashboards snapshot my-dashboard --timeout 3m

Installation

Quick install (Linux/macOS):

curl -fsSL https://raw.githubusercontent.com/grafana/gcx/main/scripts/install.sh | sh

Downloads the latest release, verifies the SHA-256 checksum, and installs to ~/.local/bin. Override the location with GCX_INSTALL_DIR:

curl -fsSL https://raw.githubusercontent.com/grafana/gcx/main/scripts/install.sh | GCX_INSTALL_DIR=/usr/local/bin sh

To upgrade, run the same command again, then check gcx --version. If the version does not change, you have a second gcx earlier in your PATH — run which -a gcx and see The version does not change after an upgrade.

Homebrew (macOS and Linux):

brew install gcx

Installs the gcx formula from homebrew-core. Homebrew has a prebuilt bottle for macOS and Linux, so the install takes seconds and needs no tap.

To update to the latest version:

brew update && brew upgrade gcx

The Grafana tap also carries gcx. Use it if you want Homebrew to compile the binary on your machine:

brew install grafana/grafana/gcx

That build needs Homebrew's go, which Homebrew installs as a build dependency. The first install takes 30–60 seconds while Go fetches dependencies.

Pre-built binary (Linux/macOS/Windows):

Download the latest archive for your OS and architecture from the releases page, extract it, and move the binary to your PATH:

tar xzf gcx_*.tar.gz
chmod +x gcx && sudo mv gcx /usr/local/bin/

On macOS, the manually-downloaded binary may be blocked on first run with "Apple could not verify…" or killed: 9 — see macOS Gatekeeper and killed: 9 for the one-time workaround. The curl | sh installer above handles this automatically.

Go install:

go install github.com/grafana/gcx/cmd/gcx@latest

Shell completion:

gcx completion zsh > "${fpath[1]}/_gcx"   # zsh
gcx completion bash > /etc/bash_completion.d/gcx  # bash
gcx completion fish > ~/.config/fish/completions/gcx.fish  # fish

Verify: gcx --version

Authentication

gcx login creates or re-authenticates a context. It auto-detects whether the server is Grafana Cloud (*.grafana.net) or on-premises and adjusts the prompt accordingly. Pick the path below that matches your setup.

Grafana Cloud, browser-based OAuth (interactive, recommended):

gcx login my-stack --server https://my-stack.grafana.net

Opens a browser for OAuth, then saves the access token, refresh token, and proxy endpoint to the my-stack context's named stack entry and makes the context current. Best for day-to-day use on Cloud stacks. If OAuth doesn't suit your setup, pick "Service account token" at the prompt.

gcx stops before the browser flow when the current process cannot write to the OS credential store. Agent users must approve the same command outside the sandbox. See Keychain credential storage.

Service account token (Cloud or on-premises, recommended for CI/automation):

gcx login my-grafana --server https://your-instance.grafana.net --token glsa_xxx --yes

Use a Grafana service account token with a role matching what the token needs to do: Viewer is enough for querying (metrics, logs, traces, profiles) and reading dashboards or folders; Editor covers pushing and editing dashboards and folders; managing datasource configuration needs Admin. On Grafana Cloud and Enterprise, RBAC custom roles can scope query access tighter (for example datasources:read plus datasources:query on specific datasources). Tokens work for both Cloud and on-premises and are recommended for automation. On-premises stacks can also use basic authentication or configured mTLS client certificates.

Basic authentication (self-hosted Grafana):

gcx login my-grafana --server https://grafana.example.com --basic-auth --user admin

Prompts for a password without echoing it. For automation, supply GRAFANA_PASSWORD and add --yes. See Basic authentication for credential storage, auth switching, and validation behaviour.

Grafana Cloud product APIs (SLO, Synthetic Monitoring, IRM, etc.):

Cloud product commands need a separate Grafana Cloud platform credential in addition to Grafana instance auth. A Cloud Access Policy token has the widest command compatibility and is recommended for automation. Provide one at login:

gcx login my-stack --server https://my-stack.grafana.net --token glsa_xxx --cloud-token glc_xxx --yes

Or add Cloud access later by re-running gcx login against the same context. The interactive Cloud step can keep the existing CAP or unexpired OAuth credential, accept a new CAP, run the experimental browser-based Cloud OAuth flow, or skip Cloud functionality:

gcx login --context my-stack

You can also run the Cloud OAuth flow directly:

gcx cloud login --context my-stack

Direct Cloud OAuth stores the OAuth token, expiry, granted scopes, and endpoint pair, but it is experimental and not every Cloud product command supports it yet. A CAP supports many Cloud management operations, but cannot enumerate user organisation memberships.

To list your Cloud organisation memberships (slugs and roles):

gcx cloud login --context my-stack
gcx cloud orgs list --context my-stack

Default Cloud logins include profile alongside stack-management scopes. Rerun login for existing credentials. --scope profile replaces the scope set, so use the default login to retain stack access. If GRAFANA_CLOUD_TOKEN or cloud..token is set, unset it when using browser OAuth for organisation listing: access-policy tokens take precedence over OAuth tokens. The command uses the selected context's Cloud API endpoint, including dev and ops environments. Membership is not a guarantee of stack-creation permission. This differs from gcx api /api/orgs, which targets organisations inside a Grafana instance.

gcx derives the Cloud stack slug from --server when possible. Set it explicitly only for custom domains where gcx cannot derive it:

gcx config set stacks.my-stack.slug your-stack-slug

You do not need to set Cloud endpoints for grafana.com; gcx defaults to https://grafana.com. For a custom environment, authenticate and store a coherent OAuth/API destination pair: supplying one endpoint to a login command uses it for both operations unless you explicitly supply both to gcx cloud login. Changing a named entry's api-url or oauth-url invalidates its old credential, so re-authenticate after the edit.

Environment variables (CI/CD, agents):

export GRAFANA_SERVER="https://your-instance.grafana.net"
export GRAFANA_TOKEN="your-service-account-token"
export GRAFANA_CLOUD_TOKEN="your-cloud-access-policy-token"
Optional: only needed if gcx cannot derive the stack slug from GRAFANA_SERVER.
export GRAFANA_CLOUD_STACK="your-stack-slug"

Env vars resolve at every command invocation, so you can run gcx commands directly without a prior gcx login.

For safety, an auto-discovered repository .gcx.yaml cannot attach runtime tokens, prompted login credentials, or external mTLS keypairs to destinations the file supplies. If you intend that file to own credentials or direct provider endpoints, authorize it explicitly with --config .gcx.yaml or GCX_CONFIG=.gcx.yaml; a --server or endpoint flag alone is not sufficient. Provider-specific runtime endpoints are accepted only when their matching runtime credential is supplied in the same invocation; that pair does not authorize an auto-discovered repository stack's TLS or proxy configuration.

Verify: gcx config check

See the login reference for the full guide, including re-authentication, environment-variable setup, and troubleshooting for common errors.

See It in Action

Query production from your terminal:

$ gcx metrics query 'sum by (instance)(rate(grafana_http_request_duration_seconds_count[5m]))' --since 1h
┌───────────────────────────────────────────┬───────────────────────────────────────────┬───────────────────────────────────────────┐
│ INSTANCE                                  │ TIMESTAMP                                 │ VALUE                                     │
├───────────────────────────────────────────┼───────────────────────────────────────────┼───────────────────────────────────────────┤
│ localhost:3000                            │ 2026-04-28T11:59:00+01:00                 │ 0.0073020555555555556                     │
│ localhost:3000                            │ 2026-04-28T12:00:00+01:00                 │ 0.11167158333333332                       │
│ localhost:3000                            │ 2026-04-28T12:01:00+01:00                 │ 0.1024372962962963                        │
│ localhost:3000                            │ 2026-04-28T12:02:00+01:00                 │ 0.09583333333333333                       │
...

Check what's firing:

$ gcx alert rules list --state firing
┌──────────────────────────────────────┬─────────────────────────────────────────────────────────────────────┬──────────┬──────────┬──────────┐
│ UID                                  │ NAME                                                                │ STATE    │ HEALTH   │ PAUSED   │
├──────────────────────────────────────┼─────────────────────────────────────────────────────────────────────┼──────────┼──────────┼──────────┤
│ e62566b8-da2d-45e0-853a-40abebc9f863 │ adaptive_traces_forecast_gme_distributor_alert                      │ firing   │ ok       │ no       │
│ cfhcfnhd8xam9a                       │ GraphiteProxy: Reads (dev) Native - Error Budget Burn Rate is High  │ firing   │ ok       │ no       │
│ affq1sffre0apd                       │ Unified Storage: HIGH_SLOW Latency - Error Budget Burn Rate is High │ firing   │ ok       │ no       │
│ 16ddf4b0-7d8c-5dad-a71a-81f87a1e47a2 │ BillingSeriesAbsent                                                 │ firing   │ ok       │ no       │
│ 09d44d08-b4cc-5d0e-8544-514e380f6bb3 │ k6CloudSecretsUsageReportingNoData                                  │ firing   │ ok       │ no       │
│ eb62d01f-5f73-543b-947b-2c849890d5f6 │ MissingBackups                                                      │ firing   │ ok       │ no       │
│ 5f9e01d4-0b2d-5b51-a787-26535ded4719 │ MissingBackups                                                      │ firing   │ ok       │ no       │
│ e4646576-9c07-5dfd-b22c-1e5b4da761ef │ MissingBackups                                                      │ firing   │ ok       │ no       │
│ b89d5170-d0bd-5869-ad22-7a0a944b3aae │ MissingBackups                                                      │ firing   │ ok       │ no       │

Review SLO status:

$ gcx slo definitions list
┌───────────────────────┬───────────────────────────────────────────────────────┬─────────────┬────────────┬────────────┐
│ UUID                  │ NAME                                                  │ TARGET      │ WINDOW     │ STATUS     │
├───────────────────────┼───────────────────────────────────────────────────────┼─────────────┼────────────┼────────────┤
│ y5yc8cy86yqtmey930foh │ CB additional identifier                              │ 90.00%      │ 28d        │ created    │
│ sgz23sbv2c19v0r32s8y1 │ Checkout App - p95 Latency                            │ 99.50%      │ 28d        │ updated    │
│ nwd4dk7j38spanror727k │ GraphiteProxy: Reads (dev) Native                     │ 99.50%      │ 28d        │ created    │
│ e1cteeyl2ukmilw1tqugw │ KG fusion test grafana-slo-app                        │ 99.50%      │ 28d        │ created    │
│ bwyf5d8g1614ugri7u0w7 │ KG fusion test grafana-slo-stats-service              │ 99.50%      │ 28d        │ created    │
│ tfkp5e0ronnl1ywpbv9b5 │ OTLPGateway: MetricWrites (dev) - Mimir               │ 99.90%      │ 28d        │ created    │
│ wvgxovr2k60efxizv1y9f │ Unified Storage: HIGH_SLOW Latency                    │ 99.50%      │ 28d        │ updated    │
└───────────────────────┴───────────────────────────────────────────────────────┴─────────────┴────────────┴────────────┘

Visualize metrics directly in your terminal:

$ gcx metrics query  'sum by (handler)(rate(grafana_http_request_duration_seconds_count{}[5m]))' --since 1h -o graph

Explore more

# Grafana resources
gcx resources list-types                        # discover available resource types
gcx dashboards list                             # list all dashboards
gcx dashboards search "node exporter"           # full-text search by title/tag/folder
gcx resources get folders                       # list all folders
gcx alert rules list                            # list alert rules
Grafana Cloud products
gcx synthetic-monitoring checks list            # list synthetic monitoring checks
gcx irm oncall schedules list                   # list on-call schedules
gcx k6 load-tests list                          # list k6 load tests
Query more datasources
gcx logs query '{app="nginx"} |= "error"' --since 1h
gcx traces query '{.cluster="dev-us-central-0"}' --since 1h

For an empty dashboard or missing application telemetry, follow Diagnose missing telemetry with gcx.

Synthetic Monitoring check manifests support optional spec.folderUid for folder assignment. See the check management guide for create/update semantics and cross-stack push guidance.

Install Agent Skills

gcx ships a portable Agent Skills bundle for setup, dashboard creation and GitOps, datasource exploration, alert investigation, structured debugging, SLO management, Synthetic Monitoring workflows, Knowledge Graph diagnosis, project scaffolding, resource generation and import, and end-to-end observability rollout.

See the full skill inventory in the Claude plugin README.

For Claude Code

Use the dedicated Claude Code plugin:

/plugin marketplace add grafana/gcx
/plugin install gcx@gcx-marketplace

For other .agents-compatible harnesses

For example: OpenAI Codex, OpenCode, and Pi. View the skills shipped in the bundle with:

gcx agent skills list

Install the bundle into ~/.agents/skills with:

gcx agent skills install --all

If your installed skills drift from the bundle shipped in your current gcx version, gcx may show an interactive reminder suggesting:

gcx agent skills update

update refreshes skills that are already installed; it does not add newly bundled skills. After upgrading gcx, install a new skill by name. To refresh existing skills and add every newly bundled one, run gcx agent skills update followed by gcx agent skills install --all — install --all on its own stops with an error if any already-installed skill differs from the new bundle.

list also shows locally present retired skills and their replacements. update warns about deprecated and retired skills, but never deletes retired files or installs replacements automatically. Remove an unwanted skill explicitly with gcx agent skills uninstall ; retired names remain supported after their content leaves the bundle. Use the same --dir for each command when managing a non-default installation. See skill lifecycle for the catalog and ownership limits.

To disable that reminder entirely, set:

export GCX_NO_UPDATE_NOTIFIER=1

The Agentic Workflow

Here's what it looks like when your coding agent has access to production. This example uses the Grafana Assistant, which requires Grafana Cloud — see the compatibility matrix; the workflows below work on any Grafana.

1. An alert fires — P95 latency on the checkout service crosses the SLO threshold.

2. The Assistant investigates — Your coding agent calls the Grafana Assistant through gcx. The Assistant has already started its investigation — it traces the issue to a missing index on customer_id causing full table scans under load.

3. It fixes the issue — Drafts the migration, adds the index.

4. It prevents recurrence — Instruments the service with OpenTelemetry spans, sets up a Synthetic Monitoring check on the checkout flow, and creates an alert rule on query duration.

5. It ships — Opens a PR, tests pass, deploys to production. The alert resolves.

Investigation, fix, instrumentation, monitoring — without the developer ever leaving their editor. The Grafana Assistant provides the intelligence; gcx provides the interface. And because it all builds on everything you've already configured in Grafana — your dashboards, your alerts, your datasources — no other tool can give you this depth out of the box.

$ gcx assistant investigations list
ID    TITLE                                     STATUS     UPDATED
abc1  Checkout P95 latency breach               active     2m ago
def2  Memory leak in payment-svc                resolved   1h ago

Beyond alert investigation

The agentic workflow above is one example. gcx supports a wide range of workflows:

• Resource GitOps — Pull resources to local files, let your agent edit them, push back to Grafana (gcx resources pull / gcx resources push)
• Explore your data — Discover datasources, metrics, labels, and log streams before writing queries (gcx datasources list, gcx metrics labels)
• Bring Assistant context into your agent — Read a conversation by ID or a shared Grafana Assistant URL, including AI SDK main-thread transcripts (gcx assistant conversation get -o json)
• SLO management — Create, monitor, and investigate SLOs from your terminal (gcx slo definitions list, gcx slo reports list)
• Onboarding & setup — Instrument a Kubernetes cluster and configure Grafana Cloud products (gcx instrumentation setup)
• Observability as Code — Scaffold a project, import existing dashboards as Go code, lint, and deploy (gcx dev scaffold, gcx dev import)

Compatibility

Grafana version support

| Grafana | Support level | |---------|---------------| | Grafana Cloud | Full support. Everything in this README, including Cloud-only products (SLO, Synthetic Monitoring, IRM, k6, Fleet, Adaptive Telemetry, Assistant). | | Grafana 13+ (OSS / Enterprise) | Full support of self-hosted features. All app-platform API groups gcx relies on are enabled by default. | | Grafana 12.x (OSS / Enterprise) | Not actively supported. Most features will still work, but we will only release patches with security updates. Features built on app-platform API groups that are not yet enabled by default in 12 need an explicit feature toggle — see ‡ below for the known case. | | Grafana < 12 | Unsupported. gcx detects the server version and exits with code 6 (version incompatible). |

Grafana is progressively migrating its APIs to app-platform (Kubernetes-style) API groups, and each group flips to enabled-by-default in a different release. When a command needs an API group your stack does not serve, upgrade or enable the corresponding feature toggle. Per-command declaration of these requirements (min version, feature toggles) is tracked in #989.

Version support policy: gcx supports the current Grafana major version (Currently 13.x), plus the previous major for 3 months after the new one ships. This will be reflected in the compatibility matrix above.

Feature availability by deployment

| Feature | Commands | OSS | Enterprise | Cloud | BYOC | |---------|----------|:---:|:----------:|:-----:|:----:| | Resource management (dashboards, folders) | resources | ✓ | ✓ | ✓ | ✓ | | Alert rules | alert | ✓ ‡ | ✓ ‡ | ✓ | ✓ | | Raw API passthrough | api | ✓ | ✓ | ✓ | ✓ | | Observability as Code | dev | ✓ | ✓ | ✓ | ✓ | | Signal queries (metrics, logs, traces, profiles) | metrics, logs, traces, profiles | ✓ † | ✓ † | ✓ | ✓ | | SLO, Synthetic Monitoring, IRM, k6, Fleet, etc. | slo, synthetic-monitoring, irm, k6, fleet | ✗ | ✗ | ✓ | ◐ | | Adaptive Metrics / Logs / Traces | metrics adaptive, logs adaptive, traces adaptive | ✗ | ✗ | ✓ | ◐ | | Grafana Assistant | assistant | ✗ | ✗ | ✓ | ✗ |

‡ Grafana-managed rule writes — reading alert rules (gcx alert rules, gcx alert groups) and datasource-managed ruler writes (gcx alert ruler) work on Grafana 12+. Writing Grafana-managed rules via the resources tier (gcx resources pull/push alertrules) requires Grafana 13+, where the rules.alerting.grafana.app API is enabled by default. On Grafana 12 it must be enabled explicitly with the kubernetesAlertingRules feature toggle (experimental in 12.x, requires a restart,