> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# New Relic

> Connect New Relic to CloudThinker for APM, infrastructure monitoring, NRQL queries, alerting, and incident investigation via the New Relic MCP server

Connect your New Relic account to enable CloudThinker agents to monitor application performance, inspect infrastructure, run NRQL queries, review alerts, and investigate incidents across your observability stack.

New Relic authenticates with a **User API key** (`NRAK-…`) and connects through the **New Relic AI MCP server**, which must be enabled before connecting.

***

## Supported regions

| Region | MCP endpoint          |
| ------ | --------------------- |
| **US** | `mcp.newrelic.com`    |
| **EU** | `mcp.eu.newrelic.com` |

<Warning>
  Select the region that matches your account. An EU account connected with the US region (or vice versa) will fail authentication or return empty results.
</Warning>

***

## Prerequisites

You need the **New Relic AI MCP server** enabled and a **User API key** (`NRAK-…`).

**Enable the New Relic AI MCP server:**

CloudThinker connects to New Relic through the New Relic AI MCP server, which is in public preview and must be turned on before connecting. Use with FedRAMP- or HIPAA-governed accounts is strictly prohibited per New Relic's terms.

1. In New Relic, click your **username** in the bottom-left corner.
2. Go to **Administration → Previews & Trials**.
3. Enable the **New Relic AI MCP server** preview toggle.

**Create a User API key:**

1. Open **API keys** (user menu → **API keys**, or go to `one.newrelic.com/api-keys`; EU: `one.eu.newrelic.com/api-keys`).
2. Click **Create a key** and set **Key type** to **User**.
3. Name it (e.g., `CloudThinker`) and save.
4. Copy the key value — the full `NRAK-…` key is shown **only once** at creation.

<Warning>
  Use a **User API key** (`NRAK-…`). License, ingest, and query keys are for data ingestion and will not work for querying — this is the most common setup mistake.
</Warning>

***

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Navigate to **Connections → New Relic** in your CloudThinker workspace and click **Connect New Relic**.
  </Step>

  <Step title="Name the connection">
    Enter an **Alias** (a unique identifier for this instance, e.g. `production`) and a **Description**.
  </Step>

  <Step title="Enter the API key">
    Paste your New Relic **User API key** (`NRAK-…`).
  </Step>

  <Step title="Select the region">
    Choose **US** (`mcp.newrelic.com`) or **EU** (`mcp.eu.newrelic.com`) to match your New Relic account.
  </Step>

  <Step title="Connect">
    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

***

## Connection details

| Field                  | Description                                  | Example                     |
| ---------------------- | -------------------------------------------- | --------------------------- |
| **NEWRELIC\_API\_KEY** | Your New Relic User API key (`NRAK-` prefix) | `NRAK-XXXXXXXXXXXXXXXXXXXX` |
| **NEWRELIC\_REGION**   | The region that matches your account         | `US` / `EU`                 |

***

## Required permissions

The User API key inherits the permissions of the user it belongs to. For least-privilege, scope that user to read-only access.

<Tip>
  For MCP server access, the key's user must be in a group assigned **Organization Read Only**, **Organization Manager**, or **Organization Product Admin** — or a custom role granting the MCP read permission. For least privilege, use **Organization Read Only**. For NRQL and NerdGraph querying, a read-only role is sufficient.
</Tip>

***

## Agent capabilities

Once connected, agents can query and investigate across your New Relic environment.

| Capability            | What the agent can do                                                             |
| --------------------- | --------------------------------------------------------------------------------- |
| **APM**               | Inspect application performance — throughput, error rates, and transaction traces |
| **Infrastructure**    | List hosts and containers, review resource utilization                            |
| **NRQL**              | Run NRQL queries via NerdGraph against any telemetry                              |
| **Alerts**            | Review alert policies, conditions, and open violations                            |
| **Logs**              | Search and analyze logs across services and environments                          |
| **Entities**          | Discover and inspect monitored entities and services                              |
| **Incidents**         | Investigate open issues and retrieve full incident detail                         |
| **Dashboards**        | Inspect dashboard configurations                                                  |
| **Connection health** | Validate that the New Relic connection is working                                 |

### Verify the connection

```text theme={null}
@alex verify the New Relic connection and list monitored entity types and any open alert violations
```

### Example prompts

```text theme={null}
@alex check error rates for the checkout service in New Relic over the last hour
@alex run an NRQL query for the slowest transactions in the production app
@alex list open New Relic alert violations and investigate the root cause
```

***

## Troubleshooting

<Accordion title="Connection fails or unauthorized">
  Verify you are using a **User API key** (`NRAK-…`), not a license, ingest, or query key. Confirm the key was not deleted or rotated in New Relic and that the key's user still has access to the account.
</Accordion>

<Accordion title="Empty results or authentication failure">
  Check that the selected region matches your account — EU accounts must use the EU endpoint. Disconnect and reconnect with the correct region.
</Accordion>

<Accordion title="Permission or authorization errors after connecting">
  The key's user may lack the MCP-server read role. Assign **Organization Read Only**, **Organization Manager**, **Organization Product Admin**, or a custom organization-scoped role with MCP read permission. Confirm the user has access to the account whose data you expect.
</Accordion>

<Accordion title="MCP connection not working at all">
  Confirm the **New Relic AI MCP server** preview is enabled under **Administration → Previews & Trials**. The connection cannot function until the preview is turned on.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **User API key only** — use a User key (`NRAK-…`); license, ingest, and query keys do not authenticate MCP requests.
- **Dedicated read-only service user** — create the key under a read-only user so the key inherits minimal permissions.

***

## Related

<CardGroup cols={2}>
  <Card title="Datadog Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48" href="/guide/connections/datadog" width="24" height="24" data-path="images/icons/datadog.svg">
    Alternative APM and observability
  </Card>

  <Card title="Grafana Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/grafana.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c1329049025cd3c3a0909b400baef7be" href="/guide/connections/grafana" width="24" height="24" data-path="images/icons/grafana.svg">
    Metrics and dashboards
  </Card>
</CardGroup>