signoz-viewer for read-only access, signoz-admin for write access).
Supported platforms
| Platform | Support |
|---|---|
| SigNoz Cloud | All tenants |
| SigNoz (self-hosted) | Self-managed instances |
Prerequisites
- A SigNoz Cloud or self-hosted instance.
- A Service Account to mint an API key (use
signoz-viewerfor read-only access orsignoz-adminif CloudThinker should make changes). - Your SigNoz base URL.
Setup
Create a service account
In SigNoz, open Settings → Workspace Settings → Service Accounts and click New Service Account. Enter a name (e.g.
cloudthinker-svc) and click Create Service Account.Assign a role
On the Overview tab, use the Roles dropdown to pick
signoz-viewer for read-only access or signoz-admin if CloudThinker should make changes. Click Save Changes so the role takes effect.Create an API key
Switch to the Keys tab and click Add Key. Enter a key name (e.g.
cloudthinker-key), optionally set an expiration date, click Create Key, and copy the key.Add the connection in CloudThinker
Navigate to Connections → SigNoz and enter:
- SigNoz URL: your instance base URL, e.g.
https://<hash>.signoz.cloud(base URL only, no path, or requests return a 404) - API Key: the key you copied
- Log Level (optional): leave as
infounless you are debugging
Connection details
| Field | Description | Example |
|---|---|---|
| SIGNOZ_URL | Base URL of your instance, no path suffix | https://<hash>.signoz.cloud |
| SIGNOZ_API_KEY | Service Account key | Copied from the Keys tab |
| LOG_LEVEL | MCP server log verbosity: debug, info, warn, or error | info |
Required permissions
signoz-viewergrants read-only access: querying services, logs, traces, metrics, and inspecting alerts, dashboards, and views.signoz-adminadditionally grants write access: creating, updating, or deleting alerts, dashboards, views, and channels.- Write operations also require explicit approval in CloudThinker before they run.
Agent capabilities
Once connected, agents can perform read operations across your observability data and a set of approval-gated write operations.| Capability | What the agent can do |
|---|---|
| Services (APM) | List instrumented services, inspect top operations by latency |
| Logs | Search logs by time and filter, aggregate and group by patterns |
| Traces | Search traces, fetch full trace waterfalls, drill into dependencies |
| Metrics | List metrics and run time-series queries |
| Dashboards | List and inspect dashboards and templates |
| Alerts | List alert rules, inspect a rule and its state-transition history; create, update, or delete (admin only) |
| Saved views | List, inspect, create, update, or delete saved query views (admin only) |
| Notification channels | List, inspect, create, update, or delete channels (admin only) |
| Documentation | Search and fetch SigNoz documentation |
Verify the connection
Example prompts
Troubleshooting
Every request returns 404
Every request returns 404
SIGNOZ_URL has an extra path suffix. Set it to the base URL only, e.g. https://<hash>.signoz.cloud, with no /api/v1.403 Forbidden
403 Forbidden
The service account’s role is too low for the action. Assign
signoz-admin for write operations, then click Save Changes.Searches return no results
Searches return no results
Log, trace, and metric searches need a time range. Ask the agent to use a recent window (e.g. the last 15 minutes) and widen it only if needed.
Security
- Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
- Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
- Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
- Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
- Base URL only — set
SIGNOZ_URLto the root URL with no path suffix; a trailing path causes all requests to return 404. - Approval for writes — keep write operations approval-gated so alert and dashboard changes stay deliberate.
Related
Datadog Connection
Observability and monitoring
Grafana Connection
Dashboards and metrics