# Netdata

Hands your AI agent live monitoring data: metrics, logs, alerts and anomaly detection. Useful when you need to know what a server is doing without opening the dashboard.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 81115
- Author: netdata
- License: GPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/netdata/netdata/tree/HEAD/docs/netdata-ai/mcp
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/netdata

## What it does

Every Netdata Agent and Parent from v2.6.0+ is itself an MCP server, listening on the same port as the dashboard, `19999` by default. Through it an agent sees node hardware and OS details, searches metrics across contexts, instances, dimensions and labels, and reads active alerts plus their transition history. Metric queries take aggregations and groupings, and scoring traces root cause through correlations and anomaly detection.

There are three transports: WebSocket at `ws://YOUR_IP:19999/mcp`, HTTP Streamable at `http://YOUR_IP:19999/mcp`, and SSE at `http://YOUR_IP:19999/sse`. HTTP and SSE arrived in v2.7.2, so clients that speak them connect directly. Clients limited to stdio need a bridge: `nd-mcp` for WebSocket, or `mcp-remote` for HTTP and SSE. With `mcp-remote` over plain HTTP the `--allow-http` flag is required, and that traffic is unencrypted — worth remembering on a network you don't control.

Some data stays locked. Sensitive functions such as `systemd-journal`, `windows-events` and `processes` open with a temporary MCP API key generated on each Netdata instance and passed in the `Authorization: Bearer` header. Visibility depends on where you connect: a Parent covers its child nodes, a standalone node covers only itself. Running functions and reading logs from other nodes requires a Netdata Parent.

## Requirements
- Remote server: `https://app.netdata.cloud/api/v1/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http mcp https://app.netdata.cloud/api/v1/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add mcp --url https://app.netdata.cloud/api/v1/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp": {
            "url": "https://app.netdata.cloud/api/v1/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp": {
            "type": "http",
            "url": "https://app.netdata.cloud/api/v1/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http mcp https://app.netdata.cloud/api/v1/mcp
```

## When to use it
- see what a server was doing when it went down
- find the node eating memory
- walk an alert's transition history
- pull metrics by context and label without building charts
- read a node's system journal from the chat window

## Example prompts
- List active alerts across all nodes and tell me which have been firing longest
- Find CPU anomalies over the last hour and name the likely cause
- Read `systemd-journal` on web-01 and pull the errors from last night

## Similar
- [observability-and-instrumentation](https://affpapa.org/en/nevibecode/skills/observability-and-instrumentation.md) — skill · 54800 installs
- [portless](https://affpapa.org/en/nevibecode/skills/portless.md) — skill · 6000 installs
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md