Netdata MCP Server: Setup for Claude, Cursor and Other Apps

• Lists alerts that are firing right now

  Shows active warning and critical alerts across all your nodes.

  Try: “Which alerts are critical right now?”

  Network · list_raised_alerts

• Lists every server Netdata monitors

  Returns each node's ID, hostname, connection status and parent-child links. Use it first to find the right machine.

  Try: “List all my monitored servers and which ones are offline.”

  Network · list_nodes

• Pulls charts and numbers for a metric over a time range

  Queries time-series data with grouping by dimension, instance, node or label. Returns the data points with statistics and each part's contribution.

  Try: “Show CPU usage for web-01 over the last 6 hours, grouped by core.”

  Network · query_metrics

• Finds metrics that behaved oddly according to Netdata's ML

  Ranks metrics by how much of the time Netdata's machine learning flagged them as anomalous, from 0 to 100 percent.

  Try: “What looked anomalous on db-02 between 2 and 3 pm yesterday?”

  Network · find_anomalous_metrics

• Finds what changed during an incident

  Compares a problem time period with a normal baseline and returns the metrics that shifted most. Narrow it with filters on large setups or it may time out.

  Try: “What changed on api-03 during last night's slowdown?”

  Network · find_correlated_metrics

• Finds metrics that swing the most

  Ranks metrics by how much they fluctuate compared with their average.

  Try: “Which metrics on this cluster are the most unstable this week?”

  Network · find_unstable_metrics

• Shows recent alert state changes

  Lists how alerts moved between states over time, such as clear to warning to critical.

  Try: “Which alerts flapped in the last 24 hours?”

  Network · list_alert_transitions

• Lists all alerts, including cleared ones

  Returns every alert across all nodes, including cleared, undefined and uninitialized ones, not just those firing.

  Try: “Show every alert configured on my nodes, with its current state.”

  Network · list_running_alerts

• Searches the available metrics by name or label

  Lists metric contexts that match a search across names, titles, instances, dimensions and labels, filtered by node and time window.

  Try: “Which metrics exist for disk latency on db-01?”

  Network · list_metrics

• Explains specific metrics

  Returns titles, units, dimensions, instances, labels and collection status for the metrics you name.

  Try: “What does the system.cpu metric measure and what dimensions does it have?”

  Network · get_metrics_details

• Shows details for specific servers

  Returns hardware specs, operating system, capabilities, health and the functions each node supports.

  Try: “Give me the hardware and OS details for web-01.”

  Network · get_nodes_details

• Lists live checks you can run on a node

  Returns the names, descriptions and requirements of the functions Netdata can run on nodes.

  Try: “What live functions can I run on web-01?”

  Network · list_functions

• Runs a live check on a server and returns a table

  Runs functions such as running processes, network connections, mount points or systemd services on a node. The source marks it read-only for now.

  Try: “Show the top processes by memory on web-01.”

  Runs code · execute_function

Watch out for

• Your token sits in your app's config file

  The Cloud token is sent as a Bearer header and saved in plain text in your MCP config. Create it with only the mcp scope and do not share the file. github.com

• It can run live checks on your servers

  One tool runs functions like listing processes and network connections on a node. The source marks every tool as read-only for now, but that can change when Netdata adds configuration functions. github.com

• The local agent route exposes a network port

  The agent answers MCP on port 19999. Use the allow mcp from setting to limit which networks can reach it, especially on internet-facing parents. github.com

Security advisories