POST /v1/projects/{projectId}/query and the MCP tool
run_query run one read-only ClickHouse SELECT over the project’s own telemetry.
Dashboards keep queries and preset views as panels over one time range.
What a query reads
Six tables, with only the project’s own rows:
Each table’s columns and their ClickHouse types are in Explore’s table list and at
GET /v1/projects/{projectId}/query/schema. Reads stop at your plan’s
retention: detail for logs, spans and metrics, crashes and
release health for sessions and occurrences.
The examples Explore starts from:
ts whenever you can: a query that reads less runs faster and stays within its limits.
What a query cannot do
The database decides what a query may read, not a parser of your SQL. The query runs as a ClickHouse user of the project whose grants reach the six tables’ own columns and nothing else, whose row policies keep it to the project and your plan’s retention, and whose limits it cannot change:- One
SELECT. A write,SET,SETTINGS,FORMAT,INTO OUTFILEor a second statement is refused. - No other table. No other database or system table, no dictionary, and no virtual column
such as
_partor_part_offset, which would count other tenants’ rows.merge()is refused too. - No outside source. Table functions that read elsewhere (
url,s3,remote,file,mysqland the like) are refused. Generators that read nothing (numbers,values,generateRandom,view) work, within the read limit.
Limits
The project also has a share of the server per minute and per hour, so one project’s queries
cannot slow down another’s.
The rows and bytes a query read come back rounded to two significant digits, and 64-bit integers
as strings.
Audit
Every query is written to your organization’s audit log before it runs, asquery.run: the
project, who ran it (a user or a token), how (the console, a token, OAuth or MCP, with the
tool), and the SHA-256 and length of its SQL. Never its text, and never a row of its result.
A time range
Send arange ({"from": "...", "to": "..."}, RFC 3339, at most 90 days) and three
placeholders take its values, as ClickHouse query parameters, never as text in your SQL:
range says what the placeholders were.
Dashboards fill them with the board’s time range.
Dashboards
A dashboard is a board of panels over one time range: 1 hour, 24 hours, 7 days or 30 days. A project has at most 20 dashboards, and a dashboard at most 24 panels. Each panel is drawn as a line, bars, one number or a table, with the columns to draw, a unit and an optional threshold line.
The presets:
A panel runs when the board opens, when the range changes and on Refresh, two at a time; a
board can refresh itself every 5 minutes. A result is kept in the API for a minute, so a board
reopened within it costs no query. No result is stored: retention and erasure apply to
dashboards as to everything else.
Who edits. Every member creates boards and edits boards and panels; owners and admins delete
them. A project’s changes are limited to 20 a minute per person, and each one is in the audit
log. For now, boards are edited only from the console: agents and tokens read them with
list_dashboards, get_dashboard and run_dashboard_panel, and a write from them is refused
with grant_required.
Board names, panel titles and SQL can be written by anyone in the project. The console shows
them as text, and MCP returns them as untrusted data.
From an agent or a script
get_query_schema and run_query; see
Agents.