[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
docker.io/grafana/mcp-grafana	minor	2.0.2 → 2.1.1	2.2.0
ghcr.io/github/github-mcp-server	patch	v2.0.2 → v2.0.3
ghcr.io/stacklok/dockyard/npx/context7	patch	4.4.1 → 4.4.4
ghcr.io/stackloklabs/mkp/server (source)	patch	0.4.4 → 0.4.5

---

Release Notes

grafana/mcp-grafana (docker.io/grafana/mcp-grafana)

v2.1.1

Compare Source

Fixed

• Classic (v1) dashboards are read and patched as v1 again on Grafana versions whose v1→v2 conversion adds a default grid layout preference, such as Grafana Cloud 13.3. Since v2.1.0, get_dashboard_by_uid reported every such dashboard as v2, so update_dashboard patches with $.panels[...] paths failed, and retrying with v2 paths migrated the dashboard to v2 (#​1369)

v2.1.0

Compare Source

Added

• alerting_rules_write and alerting_routing_write can create Mimir/Cortex or Loki ruler alert rules and Mimir/Cortex Alertmanager receivers with managed_by: "datasource". Grafana-managed creation stays the default. The target datasource comes from datasource_uid or, when exactly one compatible datasource exists, is selected automatically; existing rules in the group and the rest of the Alertmanager configuration are preserved (#​1342)
• query_prometheus renders its results as an interactive chart (time series, heatmap, bars, stat or table, chosen from the response shape) in MCP hosts that support MCP Apps. The text output is unchanged (#​1309)
• Every tool declares the Grafana RBAC actions it needs in its _meta (grafana.com/requiredPermissions), and the README's permissions column is generated from those declarations, adding 20 missing tools and correcting stale entries (#​1306)

Fixed

• update_dashboard detects v2 dashboards that Grafana still reports as stored at v1, instead of saving them as v1 and silently dropping auto grid, tabs and conditional rendering (#​1357)
• query_sql and run_panel_query replace $__from, $__to and $__interval only as whole tokens, so plugin macros such as ClickHouse's $__fromTime, $__toTime and $__interval_s (and tokens like $__to_date in other dialects) are no longer corrupted (#​1346)
• query_prometheus returns endTime is required or startTime must be provided when queryType is 'range' instead of a PromQL parser error when those times are missing (#​1347)
• --enable-write-tools=generate_deeplink now works with --disable-write, so shorten=true returns a short link (#​1337)
• get_panel_image uses separate default sizes for panels (1000x750), dashboards (1200x900) and Explore (1000x1000) at scale 1, clamps scale to 1-3, and caps each rendered dimension at 3000 pixels (#​1323)
• Listing datasource-managed (Prometheus, Mimir, Loki) alert rules pages through results and stops once enough matches are found, with a 10 MiB per-page and 30s overall bound, instead of decoding every rule at once (#​1335)
• Several tool bugs (#​1313):
  • create_annotation converts Graphite when from milliseconds to seconds
  • update_dashboard returns the saved title instead of null
  • Pyroscope label tools return [] instead of null
  • get_tempo_trace returns a not-found error for unknown trace IDs instead of {}
  • Incident results no longer include empty placeholder assignments
  • install_plugin only suggests creating a datasource for datasource plugins
• Generic empty-result hints for Prometheus and Loki are shorter, using fewer tokens per empty response (#​1336)
• The MCP apps no longer ship duplicate woff fonts, shrinking the trace viewer by about 19% (#​1312)
• Docker images report their real version from --version (#​1315)

Changed

• Breaking: list_users_by_org is paginated, with new query, limit (default 100, max 1000) and page inputs, and returns {totalCount, page, perPage, orgUsers} instead of an array of users. Agents pick up the new shape from the tool description and need no changes; only code that parses the tool output directly must read orgUsers (#​1313)
• generate_deeplink with shorten: true returns an error containing the full link when a short URL cannot be created, instead of silently returning the long URL (#​1313)
• grafana_api_request times out after the Grafana client timeout (10s by default; raise it with --grafana-timeout). get_panel_image render timeouts default to 60s and are capped at 120s. The client cache is bounded to 1000 entries per client type (#​1315)
• Prometheus query and metadata responses larger than 10 MiB fail with an error asking you to narrow the query, instead of being read without limit (#​1331)

Security

• Bump the Go toolchain to 1.26.9, golang.org/x/net to v0.60.0 and the builder images to Go 1.27.2 for CVEs (#​1333)
• Bump vite in the bundled UI apps to remediate a source-map-js CVE (#​1332)
• Releases are signed with keyless cosign: the binaries checksums file, the .mcpb bundle and the Docker images, each with SPDX SBOMs (#​1314)

github/github-mcp-server (ghcr.io/github/github-mcp-server)

v2.0.3: GitHub MCP Server 2.0.3

Compare Source

What's Changed

• build(deps): bump @​modelcontextprotocol/client from 2.2.0 to 2.3.1 in /ui by @​dependabot[bot] in #​3462
• build(deps-dev): bump @​vitejs/plugin-react from 6.1.1 to 6.1.2 in /ui by @​dependabot[bot] in #​3461
• Fix UTF-8 encoding in repository resource URIs by @​lorenzozanee in #​3437
• fix(repos): return a resource link for files over 1 MB in get_file_contents by @​jayhemnani9910 in #​3419
• Add cursor pagination to list_label by @​A-Georgiou in #​3505
• upgrade to Go 1.27.3 for compromised CA mitigation by @​marcherschel in #​3540

New Contributors

• @​lorenzozanee made their first contribution in #​3437
• @​jayhemnani9910 made their first contribution in #​3419
• @​marcherschel made their first contribution in #​3540

Full Changelog: github/github-mcp-server@v2.0.2...v2.0.3

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 10am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Nov 1, 2026 12:26pm UTC