nightingale README

The project's README from github.com/ccfos/nightingale. As one markdown file: README.md.

nightingale - cloud native monitoring

Open-Source Alerting Expert

Docs Docker pulls GitHub contributors GitHub Repo stars GitHub forks
GitHub Repo issues GitHub Repo issues closed GitHub latest release License GitHub contributors

English | 中文

🎯 What is Nightingale

Nightingale is an open-source monitoring project that focuses on alerting. Similar to Grafana, Nightingale also connects with various existing data sources. However, while Grafana emphasizes visualization, Nightingale places greater emphasis on the alerting engine, as well as the processing and distribution of alarms.

💡 Nightingale now speaks MCP out of the box: the server itself exposes a built-in MCP endpoint at /mcp, so AI assistants can manage alerting and explore observability data in natural language with no extra process to deploy. See MCP Server below.

The Nightingale project was initially developed and open-sourced by DiDi.inc. On May 11, 2022, it was donated to the Open Source Development Committee of the China Computer Federation (CCF ODTC).

💡 How Nightingale Works

Many users have already collected metrics and log data. In this case, you can connect your storage repositories (such as VictoriaMetrics, ElasticSearch, etc.) as data sources in Nightingale. This allows you to configure alerting rules and notification rules within Nightingale, enabling the generation and distribution of alarms.

Nightingale Product Architecture

Nightingale itself does not provide monitoring data collection capabilities. We recommend using Categraf as the collector, which integrates seamlessly with Nightingale.

Categraf can collect monitoring data from operating systems, network devices, various middleware, and databases. It pushes this data to Nightingale via the Prometheus Remote Write protocol. Nightingale then stores the monitoring data in a time-series database (such as Prometheus, VictoriaMetrics, etc.) and provides alerting and visualization capabilities.

For certain edge data centers with poor network connectivity to the central Nightingale server, we offer a distributed deployment mode for the alerting engine. In this mode, even if the network is disconnected, the alerting functionality remains unaffected.

Edge Deployment Mode

In the above diagram, Data Center A has a good network with the central data center, so it uses the Nightingale process in the central data center as the alerting engine. Data Center B has a poor network with the central data center, so it deploys n9e-edge as the alerting engine to handle alerting for its own data sources.

🤖 MCP Server

Nightingale has a built-in MCP Server: the n9e process itself serves the Model Context Protocol at /mcp over the Streamable HTTP transport. Any MCP client — Claude Code / Claude Desktop, Cursor, ChatGPT connectors, or your own agent — can query and manage Nightingale in natural language, with no extra process to deploy.

Connecting a client

The endpoint is http(s)://<nightingale>:17000/mcp — a root path, not under /api/n9e. Authenticate with a personal access token (create one in the web UI under Profile → Token Management) sent in the X-User-Token header:

{
  "mcpServers": {
    "nightingale": {
      "type": "http",
      "url": "http://127.0.0.1:17000/mcp",
      "headers": { "X-User-Token": "<your-token>" }
    }
  }
}

Every tool call is dispatched onto Nightingale's own HTTP API inside the process, carrying your token, so RBAC and business-group permissions apply exactly as they do for that user in the UI — a client can never reach anything its token's owner cannot.

Tools

74 fine-grained tools (42 read, 32 write) across 13 toolsets: alerts, targets, datasource, mutes, busi_groups, notify_rules, alert_subscribes, event_pipelines, users, metrics, logs, dashboards, roles.

The endpoint is read-only by default — the write tools (create / update / delete) are an explicit config opt-in.

Configuration

Everything below is optional; /mcp is enabled out of the box (etc/config.toml):

[HTTP.A2A]
# DisableMCP = true                        # turn off /mcp (Disable = true turns off /a2a as well)
# MCPToolsets = ["alerts", "dashboards"]   # restrict the exposed toolsets; empty = all of them
# MCPEnableWriteTools = true               # also register the write tools; read-only by default

/mcp reuses [HTTP.TokenAuth] for authentication, so keep that enabled.

OAuth 2.1 instead of a token

/mcp also accepts OAuth access tokens via Authorization: Bearer, in two flavors:

Alongside MCP, the same process exposes an A2A endpoint at /a2a that wraps Nightingale's built-in AI assistant for agent-to-agent integration (doc/api/a2a.md). If you would rather run MCP as a separate process against a remote Nightingale, the standalone n9e-mcp-server provides the same tools.

🔕 Alert Noise Reduction, Escalation, and Collaboration

Nightingale focuses on being an alerting engine, responsible for generating alarms and flexibly distributing them based on rules. It supports 20 built-in notification medias (such as phone calls, SMS, email, DingTalk, Slack, etc.).

If you have more advanced requirements, such as:

Then Nightingale is not suitable. It is recommended that you choose on-call products such as PagerDuty and FlashDuty. These products are simple and easy to use.

🗨️ Communication Channels

🔑 Key Features

Nightingale Alerting rules

Nightingale Alarm Dashboard

Nightingale Integration Center

Nightingale dashboards

🌟 Stargazers over time

Stargazers over time

🔥 Users

User Logos

🤝 Community Co-Building

📜 License

nightingale (ccfos/nightingale)

Searching Database…

13.4K ·GitHub
Nightingale
What is this?Nightingale is an open-source monitoring and alerting platform that focuses on generating, processing and distributing alarms, connecting to existing metrics/log data sources rather than collecting data itself.
Is this a visualization tool like Grafana, or something else?Unlike Grafana, Nightingale focuses on the alerting engine and alarm processing/distribution rather than visualization, though it does include some dashboard features.
How do I get it running and feed it data?Deploy the n9e server and connect existing storage backends (VictoriaMetrics, Elasticsearch, Prometheus, etc.) as data sources; it's recommended to use Categraf as the collector, which pushes data to Nightingale via the Prometheus Remote Write protocol.
Do I need a separate time-series database and collector?Yes — Nightingale doesn't collect data itself; you need a time-series database like Prometheus or VictoriaMetrics for storage and a collector such as Categraf (or other agents via Remote Write, OpenTSDB, Datadog, Falcon protocols) to feed it metrics.
Is Nightingale a good fit if I need on-call scheduling and escalation?No — the README explicitly recommends choosing dedicated on-call products like PagerDuty or FlashDuty for personnel scheduling and alert escalation, as Nightingale is not suitable for that.
Who uses Nightingale in production?It was originally developed and open-sourced by DiDi, and in 2022 was donated to the CCF Open Source Development Committee, suggesting enterprise-scale adoption.
Does it support edge or disconnected data centers?Yes, it offers a distributed deployment mode (n9e-edge) so alerting keeps working at edge sites even if the network link to the central server is down.
What is the built-in MCP server for?Nightingale exposes a built-in MCP endpoint at /mcp so AI assistants like Claude Code, Claude Desktop, Cursor, or ChatGPT connectors can query and manage alerting and observability data in natural language, with no extra process to deploy. It offers 74 fine-grained tools (42 read, 32 write) across 13 toolsets, and is read-only by default until write access is explicitly enabled.
How does authentication work for the MCP endpoint?You authenticate with a personal access token created in the web UI (Profile to Token Management) sent via the X-User-Token header, or alternatively use OAuth 2.1 with Nightingale as its own authorization server or as a resource server for an existing enterprise IdP like Keycloak, Entra ID, Okta, or Auth0.
What notification channels does it support?Nightingale natively supports 20 types of notification media including phone calls, SMS, email, DingTalk, and Slack, with customizable message templates.
What data sources can it pull alerting data from?It supports data sources like Prometheus, Elasticsearch, Loki, ClickHouse, MySQL, and Postgres, and receives data directly via protocols such as Remote Write, OpenTSDB, Datadog, and Falcon.
What are similar projects?openobserve, signoz, grafana, netdata, oxynote, labtether, VictoriaMetrics, prometheus
Which topics is it in?tsdb, logs, sre, alerting, clickhouse, time-series, metrics, elasticsearch, prometheus, rbac, oauth2, oauth
Creator
ccfos
Size
120 MB
Stars
13.4K
Updated
CommitOct 13Releasev9.2.0Oct 11
Age
6y
Commits · 90 Days