diff --git a/.codex/config.toml b/.codex/config.toml
new file mode 100644
index 00000000..15a1abfe
--- /dev/null
+++ b/.codex/config.toml
@@ -0,0 +1,9 @@
+# Project-scoped MCP: Codex loads this only when the project is trusted.
+# The Grafana service-account token stays in the environment
+# (GRAFANA_SERVICE_ACCOUNT_TOKEN, set by nushell-secrets.nu), not in git.
+[mcp_servers.grafana]
+command = "mcp-grafana"
+# Read-only surface; drop this arg to allow dashboard/alert edits.
+args = ["--disable-write"]
+env = { GRAFANA_URL = "https://grafana.writefor.fun" }
+env_vars = ["GRAFANA_SERVICE_ACCOUNT_TOKEN"]
diff --git a/flake.lock b/flake.lock
index 38d58a68..81af97dc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -484,10 +484,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1790823137,
-        "narHash": "sha256-y722MFBMaKNqo6TPOtFgRKzb1md6ZbSxnT/Gpt1SnR4=",
+        "lastModified": 1790913443,
+        "narHash": "sha256-3KvrF3j19qo90q0frvQnU4/Lirh1mb0dk8UA0KUrtog=",
         "ref": "refs/heads/main",
-        "rev": "decf57110a6ecbd45b3ab7ac5ec7db393f17d3a7",
+        "rev": "bc17c93809bc029f2901b86a5e3306a6ef1be4d3",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
diff --git a/home/base/gui/dev-tools.nix b/home/base/gui/dev-tools.nix
index 675fd58e..2583f366 100644
--- a/home/base/gui/dev-tools.nix
+++ b/home/base/gui/dev-tools.nix
@@ -26,5 +26,8 @@ in
       agentPackages.kimi-code
       agentPackages.pi
       agentPackages.omp
+
+      # MCP servers, configured project-scoped in opencode.jsonc / .codex/config.toml
+      mcp-grafana
     ];
 }
diff --git a/opencode.jsonc b/opencode.jsonc
new file mode 100644
index 00000000..2c286220
--- /dev/null
+++ b/opencode.jsonc
@@ -0,0 +1,22 @@
+{
+  // Project-scoped MCP: loaded only while working in this repo, so its tools
+  // cost context here and nowhere else.
+  //
+  // mcp-grafana talks to the homelab Grafana. The service-account token stays in
+  // the environment (GRAFANA_SERVICE_ACCOUNT_TOKEN, set by nushell-secrets.nu),
+  // never in git.
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "servers": {
+      "grafana": {
+        "type": "local",
+        // Read-only surface; drop --disable-write to allow dashboard/alert edits.
+        "command": ["mcp-grafana", "--disable-write"],
+        "environment": {
+          "GRAFANA_URL": "https://grafana.writefor.fun",
+          "GRAFANA_SERVICE_ACCOUNT_TOKEN": "{env:GRAFANA_SERVICE_ACCOUNT_TOKEN}",
+        },
+      },
+    },
+  },
+}