SigNoz

Connect SigNoz to CloudThinker to investigate service latency, search logs, audit alert rules, and drill into distributed traces across your stack

Connect your SigNoz instance to enable CloudThinker agents to investigate service latency, search and aggregate logs, audit alert rules, and drill into distributed traces across your stack.

SigNoz authenticates with a Service Account API key scoped to a role (signoz-viewer for read-only access, signoz-admin for write access).

---

Supported platforms

Platform	Support
SigNoz Cloud	All tenants
SigNoz (self-hosted)	Self-managed instances

SigNoz Cloud and self-hosted share the same interface, so the setup steps below are identical for both.

---

Prerequisites

• A SigNoz Cloud or self-hosted instance.
• A Service Account to mint an API key (use signoz-viewer for read-only access or signoz-admin if CloudThinker should make changes).
• Your SigNoz base URL.

---

Setup

1. Create a service account

   In SigNoz, open Settings → Workspace Settings → Service Accounts and click New Service Account. Enter a name (e.g. cloudthinker-svc) and click Create Service Account.

2. Assign a role

   On the Overview tab, use the Roles dropdown to pick signoz-viewer for read-only access or signoz-admin if CloudThinker should make changes. Click Save Changes so the role takes effect.

3. Create an API key

   Switch to the Keys tab and click Add Key. Enter a key name (e.g. cloudthinker-key), optionally set an expiration date, click Create Key, and copy the key.

4. Add the connection in CloudThinker

   Navigate to Connections → SigNoz and enter:

   • SigNoz URL: your instance base URL, e.g. https://<hash>.signoz.cloud (base URL only, no path, or requests return a 404)
   • API Key: the key you copied
   • Log Level (optional): leave as info unless you are debugging

   Click Connect. CloudThinker verifies the credentials and shows a Connected status.

---

Connection details

Field	Description	Example
SIGNOZ_URL	Base URL of your instance, no path suffix	https://<hash>.signoz.cloud
SIGNOZ_API_KEY	Service Account key	Copied from the Keys tab
LOG_LEVEL	MCP server log verbosity: debug, info, warn, or error	info

---

Required permissions

• signoz-viewer grants read-only access: querying services, logs, traces, metrics, and inspecting alerts, dashboards, and views.
• signoz-admin additionally grants write access: creating, updating, or deleting alerts, dashboards, views, and channels.
• Write operations also require explicit approval in CloudThinker before they run.

Start with signoz-viewer for read-only investigation. Assign signoz-admin only when you want agents to manage alerts or dashboards.

---

Agent capabilities

Once connected, agents can perform read operations across your observability data and a set of approval-gated write operations.

Capability	What the agent can do
Services (APM)	List instrumented services, inspect top operations by latency
Logs	Search logs by time and filter, aggregate and group by patterns
Traces	Search traces, fetch full trace waterfalls, drill into dependencies
Metrics	List metrics and run time-series queries
Dashboards	List and inspect dashboards and templates
Alerts	List alert rules, inspect a rule and its state-transition history; create, update, or delete (admin only)
Saved views	List, inspect, create, update, or delete saved query views (admin only)
Notification channels	List, inspect, create, update, or delete channels (admin only)
Documentation	Search and fetch SigNoz documentation

Write operations change live alerting and dashboards. CloudThinker requires explicit approval, naming the resource, before any write runs. Deletes are irreversible.

Verify the connection

@tony list SigNoz services and confirm that metrics and traces are reachable

Example prompts

@tony find the slowest operations for the checkout service
@tony search error logs and group spikes by service
@tony audit SigNoz alert rules and flag misconfigured thresholds

---

Troubleshooting

Connection fails with 401 Unauthorized

Verify the API key is correct and has not been revoked. Confirm you clicked Save Changes after assigning the role, then re-mint the key.

Every request returns 404

SIGNOZ_URL has an extra path suffix. Set it to the base URL only, e.g. https://<hash>.signoz.cloud, with no /api/v1.

403 Forbidden

The service account’s role is too low for the action. Assign signoz-admin for write operations, then click Save Changes.

Searches return no results

Log, trace, and metric searches need a time range. Ask the agent to use a recent window (e.g. the last 15 minutes) and widen it only if needed.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Base URL only — set SIGNOZ_URL to the root URL with no path suffix; a trailing path causes all requests to return 404.
• Approval for writes — keep write operations approval-gated so alert and dashboard changes stay deliberate.

---

Related

Datadog Connection

Observability and monitoring

Grafana Connection

Dashboards and metrics