{
  "slug": "grafana",
  "repo": "grafana/grafana",
  "name": "Grafana",
  "tagline": "The open and composable observability and data visualization platform for metrics, logs, and traces.",
  "category": "monitoring-status",
  "license_spdx": "AGPL-3.0-only",
  "stars": 77716,
  "contributors": 1200,
  "last_push_days": 0,
  "latest_release": "v11.4.0",
  "safety_score": 87.3,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 7,
  "components": {
    "security_health": 70,
    "maintenance": 98,
    "community": 98,
    "releases": 92
  },
  "language": "TypeScript / Go",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "docker run -d --name grafana -p 3000:3000 -v grafana-storage:/var/lib/grafana grafana/grafana-oss:latest"
  },
  "ai_report": "Grafana is the industry-defining open-source platform for operational telemetry visualization, dashboards, and alerting. Constructed with a high-performance Go backend and an extensible TypeScript and React frontend, Grafana seamlessly queries, aggregates, and visualizes time-series data from hundreds of heterogeneous data sources, including Prometheus, InfluxDB, PostgreSQL, Loki, and Elasticsearch. Its composable architecture separates panel rendering, alerting evaluation engines, and data proxying into modular pipelines, enabling operators to unify multi-cloud telemetry and on-premise infrastructure into unified command dashboards.\n\nGrafana maintains a mature enterprise-grade security posture supported by an active Bug Bounty program and dedicated product security incident response team (PSIRT). While historical directory traversal vulnerabilities highlighted the complexity of plugin asset routing in previous years, Grafana responded by fundamentally re-architecting plugin isolation, enforcing digital signatures on all marketplace plugins, and implementing rigorous automated fuzzing and CodeQL static analysis pipelines. The project maintains an OpenSSF Scorecard of 8.5 with complete branch protection, signed releases, and rapid security advisory dissemination.\n\nFor self-hosted deployments, administrators must transition the default SQLite database to an external PostgreSQL or MySQL instance for production workloads, configure OAuth2/OIDC single sign-on (SSO) or SAML integration, and disable anonymous access (auth.anonymous.enabled = false). Furthermore, set allow_embedding = false to eliminate clickjacking vectors and restrict data source proxy permissions to prevent unauthorized query crafting. Backed by world-class maintainer cadence and omnipresent adoption across cloud infrastructure, Grafana commands an unquestioned Healthy rating and a 95/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:13.604Z",
  "website_url": "https://grafana.com",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/grafana/grafana#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:49:38.627Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}