feat: declare required RBAC permissions on each tool

[sd2k]

Every tool now declares the Grafana RBAC actions its calls need, on its MustTool call:

var QueryFoo = mcpgrafana.MustTool("query_foo", "...", queryFoo,
	mcpgrafana.WithReadOnlyHintAnnotation(true),
	mcpgrafana.RequiresPermissions(datasourceQuery...),
)

A caller missing any of them gets a 403 from that tool, so this gives one place to see what a tool requires.

• RequiresPermissions (permissions.go) is a ToolOption. It writes the actions to the tool's _meta under grafana.com/requiredPermissions. Repeated calls add to the list, so a shared group can be combined with extra actions. ToolRequiredPermissions reads them back, including from a tools/list response, so anything embedding or listing the server can get at them.
• tools/rbac.go holds the shared groups (datasourceQuery, dashboardRead, the incident and agento11y groups). Most new tools only need datasourceQuery.
• TestEveryToolDeclaresPermissions lists every tool in read-write and read-only mode and fails if one has no declaration. The failure message says exactly what to add. Tools that need nothing declare RequiresPermissions().
• The README's "Required RBAC Permissions" column is now generated from the declarations. TestReadmeToolPermissions fails on drift, or when a registered tool has no row, and -update-readme regenerates it. This adds the 20 tools that were missing from the table and fixes several stale entries (e.g. the snapshot tools listed dashboards:read). The Scopes column stays hand-written, since scopes depend on how a tool is used.

The tests check that every tool has made a declaration, not that the declared actions are correct.

Notes for review:

• _meta isn't counted by the token check (it counts name, description and input schema), and clients don't pass it to models.
• Tools that call /apis endpoints (dashboard reads and writes, provisioning) declare both the user's legacy action (dashboards:read) and the on-behalf-of token's group/resource:verb permission (dashboard.grafana.app/dashboards:get). Grafana checks both on those paths. The README notes that service accounts only need the legacy names.
• General (not rule-scoped) silences are gated on alert.instances:*, not alert.silences:*, so alerting_silences_write lists both.
• Read-write variants declare their write actions; the read-only agento11y_manage_* variants declare only reads.
• grafana_api_request declares nothing. It runs with whatever the caller already holds.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 7b00840. Configure here.}

[cursor]

OnCall tools drop oncall-app RBAC

Medium Severity

OnCall tools now declare only grafana-irm-app.* actions. Grafana still authorizes OSS and non-IRM OnCall with grafana-oncall-app.*, and only switches to the IRM prefix when IRM is enabled. Callers following these declarations will grant actions that do not match many OnCall instances, so those tools 403. Other dual-checked APIs in this PR list both names.

Additional Locations (2)

• tools/oncall.go#L261-L262
• tools/oncall.go#L553-L554

 

^{Reviewed by Cursor Bugbot for commit 7b00840. Configure here.}

[sd2k]

Not changing this: the OnCall tools only call grafana-irm-app routes (/api/plugins/grafana-irm-app/resources in tools/oncall_proxy.go, and the settings lookup in tools/oncall.go). On an instance running only grafana-oncall-app, they fail regardless of RBAC, so declaring grafana-oncall-app.* actions would list permissions no tool call is ever checked against. If the tools grow an oncall-app fallback, that change should add the matching actions.

[radiohead]

Found three snapshot permission declaration issues, detailed inline. Verified against the linked public Grafana source; no live permission-restricted or OBO endpoint testing was performed. The full local unit suite passed.

[radiohead]

Rechecked commit 000aa4f: all three snapshot permission findings are addressed, and the README permissions and dashboard UID scopes match the corrected declarations. The full local unit suite passed, including the permission declaration and README checks. No new findings in the follow-up diff.