Skip to main content
Connect New Relic so CloudThinker can run NRQL, check golden metrics and errors for a service, read logs and traces, and triage open issues and alert conditions. CloudThinker reaches New Relic through the New Relic MCP server, authenticated with a User API key (NRAK-...).

​
Prerequisites

  • A New Relic account in the US or EU region.
  • The New Relic MCP Server feature left on for your organization. New Relic turns it on by default, but an organization admin can switch it off in the feature control manager, and nothing works while it’s off.
  • A New Relic user in a group with two kinds of role: an organization role that can read the MCP server, and an account role on each account agents should query. See Required permissions.
  • Permission to add connections in your CloudThinker workspace.
New Relic’s MCP server is in public preview, and New Relic doesn’t allow it for FedRAMP or HIPAA-regulated accounts. Don’t connect those accounts.

​
Setup

1

Create a User API key

Open API keys from your user menu in New Relic, or go to one.newrelic.com/api-keys (EU: one.eu.newrelic.com/api-keys). Click Create a key, set Key type to User, name it cloudthinker, and save.Copy the full key now. It starts with NRAK- and New Relic shows it only once.
2

Add the connection

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select New Relic. Fill in:
  • Alias (optional): a short name such as newrelic-prod. Lowercase letters, numbers, and hyphens.
  • Description (optional): which account or environment this is. Agents read it to pick the right instance.
  • NEWRELIC_API_KEY: the NRAK- key.
  • NEWRELIC_REGION: US (mcp.newrelic.com) or EU (mcp.eu.newrelic.com), matching where you sign in.
Click Connect. CloudThinker shows Connecting and Verifying, then a Connected status. Verifying opens a session with the New Relic MCP server for your region and lists its tools. It doesn’t run a query, so a missing account role shows up later, on the first question. If verification fails, it shows Failed and an error message appears. Match the message to Troubleshooting.
License, ingest, and browser keys don’t work here. Only a User key (NRAK-...) can query data. This is the most common setup mistake.

​
Connection details

If you sign in at one.eu.newrelic.com, your region is EU. Otherwise it’s US.

​
Required permissions

A User API key carries the permissions of the user who owns it. There are no per-key scopes, so least privilege comes from the user. The user needs both levels:
Create a dedicated New Relic user and a group for it. In New Relic Access management, grant the group Organization Read Only at the organization level, then Read Only on each account you want investigated. Create the key under that user. New Relic user types can affect billing, so check which type the user gets.

​
Agent capabilities

New Relic keeps some AI tools, such as natural-language NRQL and deployment impact reports, for OAuth sign-in only. That’s a New Relic limit. A User API key can’t use them, so CloudThinker writes the NRQL itself and reads change events directly (see Changes above). When the connection first reaches Connected, CloudThinker runs a read-only discovery and saves what it finds for later chats.

​
Verify the connection

A healthy answer names at least one account ID and its event types, such as Transaction or Log.

​
Example prompts

​
Send New Relic alerts to Resolve

Resolve has no New Relic preset, so you send workflow notifications to a custom signal source.
1

Create the signal in CloudThinker

Go to Resolve → Integrations, select Custom source, and click Add signal. Name it New Relic, click Create endpoint, and copy the Webhook URL and secret key. The secret is shown only once.
2

Add a webhook destination in New Relic

In New Relic, add a Webhook destination. Paste the Webhook URL as the endpoint, and set a bearer token authorization with your secret key, so New Relic sends Authorization: Bearer <your-secret-key>.
3

Notify the destination from a workflow

In a workflow that covers the alert policies you want, add a webhook notification to that destination. Keep New Relic’s default payload template.
4

Send one test event and map the fields

Send a test notification from the workflow. When CloudThinker shows Payload received, click Map the fields, pick the issue title field for Incident title and the priority field for Severity, and click Save mapping. New Relic’s CRITICAL, HIGH, MEDIUM, and LOW priorities are understood as-is.
Success state: the next issue from that workflow shows up in Pulse, the alert feed in Resolve, and agents investigate it through this connection.

​
Troubleshooting

  • The key is missing, deleted, or not a User key. Check that it starts with NRAK-, create a new User key if needed, and update the connection from its detail panel.
  • NEWRELIC_REGION doesn’t match your account. If you sign in at one.eu.newrelic.com, pick EU.
The New Relic MCP Server feature is switched off for your organization. It’s on by default, so an admin turned it off in New Relic’s feature control manager. Ask them to turn it back on, then retest the connection.
The key’s user lacks a role that can read the MCP server, or has no account role on that account. Grant the user’s group Organization Read Only and Read Only on the account.
CloudThinker resolves entities by name before querying them. Use the service name exactly as it appears in New Relic, or ask it to search entities by tag.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Read-only user: a User key has no scopes of its own, so create it under a user whose only roles are Organization Read Only and Read Only on the accounts to query.
  • Key is shown once: store it in your secrets manager when you create it. If you lose it, create a new key and delete the old one.

Custom Signal Source

Capture an event and map its fields

Datadog Connection

Logs, metrics, monitors, and traces