Menu
Investigate production issues, query logs and metrics, and explore dashboards on the Mattermost Grafana instance at grafana.internal.mattermost.com.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | grafana |
| description | Investigate production issues, query logs and metrics, and explore dashboards on the Mattermost Grafana instance at grafana.internal.mattermost.com. |
| allowed-tools | mcp__grafana__list_datasources, mcp__grafana__search_dashboards, mcp__grafana__get_dashboard_by_uid, mcp__grafana__get_dashboard_summary, mcp__grafana__get_dashboard_panel_queries, mcp__grafana__query_prometheus, mcp__grafana__list_prometheus_metric_names, mcp__grafana__list_prometheus_metric_metadata, mcp__grafana__list_prometheus_label_names, mcp__grafana__list_prometheus_label_values, mcp__grafana__query_loki_logs, mcp__grafana__list_loki_label_names, mcp__grafana__list_loki_label_values, mcp__grafana__query_loki_stats, mcp__grafana__query_loki_patterns, mcp__grafana__get_annotations, mcp__grafana__list_oncall_schedules, mcp__grafana__get_current_oncall_users, mcp__grafana__list_alert_groups, mcp__grafana__generate_deeplink |
You are investigating production issues on the Mattermost Grafana instance.
Loki ProductionPrometheus Prod| Product | Namespace UID |
|---|---|
| Community | rxocmq9isjfm3dgyf4ujgnfz3c |
| Hub | c4ja3w3h8tgwiy5c5dbmhmkpje |
These namespace UIDs appear as the namespace label in both Loki and Prometheus. Always filter by namespace when the user's question is scoped to a specific product.
list_datasources)| Data source | UID |
|---|---|
| Loki Production | P4F55509B51A00EB7 |
| Prometheus Prod | P27C405C01959D762 |
Use these directly. Only call list_datasources if a query fails with an unknown UID error.
Use query_loki_logs with:
datasourceUid: the UID for Loki Productionquery: a LogQL expression, e.g. {namespace="rxocmq9isjfm3dgyf4ujgnfz3c"} |= "error"timeRange: {from: "now-1h", to: "now"} unless the user specifies otherwiselimit: 100 (default); increase if neededWhen exploring unknown log structure, first call list_loki_label_names and list_loki_label_values to understand available labels.
For volume/rate queries, prefer query_loki_stats over fetching raw lines.
Use query_prometheus with:
datasourceUid: the UID for Prometheus Prodquery: a PromQL expressiontime for current value; provide it for historical point-in-timeWhen discovering metrics, use list_prometheus_metric_names and list_prometheus_label_names. Use list_prometheus_metric_metadata to understand a metric's type and help text before writing PromQL.
Use search_dashboards with a descriptive query. Then use get_dashboard_summary to understand panel layout before fetching the full JSON with get_dashboard_by_uid. Use get_dashboard_panel_queries to see what PromQL/LogQL a panel runs.
Use generate_deeplink to produce a Grafana Explore or dashboard URL to share with the user. Always include the relevant time range.
list_datasources.search_dashboards.Always prefer targeted queries over broad ones — filter by namespace and narrow time ranges first, then widen if needed.
Use when running an adversarial security review of a code change — a GitHub PR, a local working-tree diff, or an explicit file list — and when wiring security review into a teamimplement run. Use when asked to security-review, audit, or vulnerability-assess freshly written or proposed code.
Analyze a GitHub pull request for risk level and generate concrete QA recommendations. Accepts a PR URL or "owner/repo#number" reference. Uses `gh` CLI to fetch the diff and metadata, computes blast radius, scores six risk dimensions, and returns a structured JSON risk assessment. Use when the user invokes /qa-analysis:qa-analysis with a GitHub PR URL or reference, or asks for a PR risk assessment, QA recommendations, or "what should I test?" for a given pull request.
Add an MCP (Model Context Protocol) server to a Mattermost plugin so the Agents plugin can call its tools. Use when implementing cross-plugin MCP, exposing AI tools from a Mattermost plugin to the Agents plugin, or wiring up the `pluginmcp` helper from mattermost-plugin-agents.
Create a new Mattermost plugin from the starter template in the current directory. Use when creating a new plugin from scratch, scaffolding a Mattermost plugin, or bootstrapping a plugin project.
Orchestrates test-driven fixes for Mattermost security tickets (Jira/Atlassian) with a Staff Security Engineer mindset: failing secure-behavior tests first, then implementation, then security review and edge-case loops, then opening a non-draft PR that follows `.github/PULL_REQUEST_TEMPLATE.md` when present, with a vague public description (no exploit detail). Use when the user invokes /security-fix:security-fix with a mattermost.atlassian.net browse URL, MM-* security work, backend permission or authorization bugs, or asks for this security TDD workflow.
Update all GitHub Actions workflow dependencies (uses: owner/action@vX) to their latest released versions. Fetches current releases from GitHub, updates all workflow YAML files to use SHA pinning with version comments, and commits.