HomeBack to recipes
RecipesMonitoringAlert Routing from Grafana

TL;DR

Alert Routing from Grafana is a monitoring workflow that chains Grafana + Slack to automate a common task. Grafana alerts are enriched with runbook links and routed to the correct Slack channel based on severity and team labels. Once configured, it saves ~5 hours/week per on-call rotation, plus 3x faster MTTR on incidents and runs through Claude Code, Cursor, Windsurf or any MCP-compatible AI agent.

📊💬
MonitoringIntermediate

Alert Routing from Grafana

Grafana alerts are enriched with runbook links and routed to the correct Slack channel based on severity and team labels.

10 min setup, intelligent alert routing2 MCPs requiredSaves ~5 hours/week per on-call rotation, plus 3x faster MTTR on incidents

How it works

📊Grafana
💬Slack
Automated
1Grafana alert fires with labels (team, severity)2Match alert to routing rules3Attach runbook URL from alert annotations+2 more steps

Partial support — 1 of 2 MCPs hostable

Hosted execution needs every MCP on the whitelist. Use the local CLI for this recipe until the missing MCPs are added.

Not yet hostable:

📊Grafana
mcpizy recipe install grafana-slack-alert-routing

Why this combo?

Grafana has the metric data and alerting logic; Slack has the people who need to act. Routing alerts by team label with attached runbooks means whoever gets paged already knows what to do — no digging through wikis while production is on fire.

Without this workflow

All alerts go to one #alerts channel. Engineers ignore it because it's too noisy. Critical alert missed. Postmortem blames the process.

With MCPizy

Alerts route to the right team channel by severity. Runbook attached. Auto-resolves when the metric recovers. On-call engineer gets exactly what they need.

Business value

Concrete ROI — not marketing fluff.

Time saved

~5 hours/week per on-call rotation, plus 3x faster MTTR on incidents

  • Cuts incident response time from 30min to under 2min — the right person sees the right alert with the runbook attached
  • Kills alert fatigue: noisy #alerts channels become signal-rich team channels — on-call trust restored
  • Auto-resolve prevents 'is this still an issue?' noise — threads close when metrics recover
  • Reduces on-call burnout and attrition — SREs stay longer, tribal knowledge retained

Workflow steps

  1. 1
    Grafana alert fires with labels (team, severity)
  2. 2
    Match alert to routing rules
  3. 3
    Attach runbook URL from alert annotations
  4. 4
    Post enriched alert to correct Slack channel
  5. 5
    Auto-resolve thread when alert clears

Use cases

  • Route critical alerts to on-call, warnings to team channels
  • Attach runbook links automatically based on alert name
  • Auto-resolve Slack threads when the metric recovers to normal
  • Separate routing rules per service so teams only see their own alerts

MCPs required

📊

Grafana

Grafana MCP Server

View
💬

Slack

Slack MCP Server

View

Agent prompt (copy into Claude Code)

This prompt is the workflow. Paste into Claude Code, Cursor, or Windsurf.

You are an alert-routing agent. Receives Grafana webhook alerts.

On alert firing:
1. Read alert payload: labels (team, severity, service), annotations (runbook_url, summary, description)
2. Look up routing rules: routes.yaml matches labels.team + severity → slack_channel + mentions
3. Build Slack block:
   - header: severity-colored emoji (:rotating_light: critical, :warning: warning)
   - summary + description
   - context: "runbook: <annotations.runbook_url>"
   - actions: [Silence 1h] [Acknowledge] [View dashboard]
4. Call slack.send_message(channel=routed, blocks=[...], thread_ts=alert_group_id if exists)
5. Save thread_ts keyed by alert_group so subsequent firings update the same thread

On alert resolved:
6. Update original thread with ":white_check_mark: Resolved at ${timestamp}" and set reactions cleanup.

For critical severity, also call pagerduty if configured.

Trigger & credentials

How this workflow fires and what env vars you need.

.env.example
WebhookTrigger
POST /webhook/grafana (Grafana → Alerting → Contact points → Webhook)
📊Grafana· 2 vars
GRAFANA_URL

Grafana server URL

e.g. https://grafana.company.com

GRAFANA_WEBHOOK_SECRET

Shared secret for validating incoming webhooks

e.g. a-long-random-string

💬Slack· 2 vars
SLACK_BOT_TOKENGet key

Slack bot OAuth token with chat:write

e.g. xoxb-...

SLACK_DEFAULT_ALERTS_CHANNEL

Fallback channel if no routing rule matches

e.g. #oncall

One-command deploy

Install everything — MCPs, prompt, env template — in a single call.

$ mcpizy recipe install grafana-slack-alert-routing

✓ Installs all 2 MCP servers
✓ Writes prompt to ~/.mcpizy/prompts/grafana-slack-alert-routing.md
✓ Generates .env.example in current directory
✓ Ready to paste into Claude Code

Requires mcpizy CLI v1.1+ — install via npm i -g mcpizy.

Quick install (MCPs only)

10 min setup, intelligent alert routing
$ mcpizy install grafana && mcpizy install slack

More Monitoring recipes

💬🟢

Database Change Alerts

Get a Slack alert whenever a critical Supabase table row is created, updated, or deleted — ideal for audit trails.

🐛💬

Error Alerting Pipeline

Sentry new issues are de-duplicated, enriched with commit info, and routed to the right Slack channel based on project.

🐘📊

Database Monitoring Dashboard

Stream Postgres metrics — query latency, lock waits, vacuum stats — into Grafana for a live operations dashboard.

🟡📊

Analytics Dashboard

Connect ClickHouse to Grafana to build real-time analytics dashboards over billions of events with sub-second query times.

Frequently asked questions

What is this workflow?

Alert Routing from Grafana is a monitoring automation that uses Grafana + Slack together via the Model Context Protocol. Grafana alerts are enriched with runbook links and routed to the correct Slack channel based on severity and team labels.

How long does setup take?

Setup takes around 10 min setup, intelligent alert routing. You install the required MCP servers with `mcpizy install grafana && mcpizy install slack`, connect your accounts, and the workflow is ready to run.

How much time does this workflow save?

Once running, this workflow saves ~5 hours/week per on-call rotation, plus 3x faster MTTR on incidents. The concrete business value: Cuts incident response time from 30min to under 2min — the right person sees the right alert with the runbook attached; Kills alert fatigue: noisy #alerts channels become signal-rich team channels — on-call trust restored.

Which MCP servers do I need for this?

You need 2 MCP servers: Grafana (mcpizy install grafana), Slack (mcpizy install slack). All are installable in one command via the MCPizy CLI and configured in your `.claude.json` or `.cursor/mcp.json`.

Does this work with Claude Code, Cursor, and Windsurf?

Yes. The workflow runs with any MCP-compatible AI agent — Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with Copilot, and custom agents built on the MCP SDK. The MCP servers are identical across clients; only the config file path (`.claude.json` vs `.cursor/mcp.json`) changes.

Start building this workflow

Install the required MCPs from the marketplace and automate this in 10 min setup.

$ mcpizy install grafana && mcpizy install slack

📊Install Grafana💬Install Slack

Free to install. Connect your accounts and this workflow runs itself.