Native Observability 2.2.0 Adds Read-Only AI Diagnostics and Changes Monitoring Exports

The 2.2.0 release of Native Observability adds a read-only interface that allows AI assistants to examine Drupal performance data. According to the release notes, published on 5 November 2026, the new integration uses the Model Context Protocol (MCP) to give authorized clients access to diagnostic tools. The release also changes how monitoring data is exported to OpenTelemetry and Prometheus.

For Drupal administrators, the update introduces two operational considerations: controlling what diagnostic information external AI clients can access and adapting existing monitoring configurations to changes in exported data. It also demonstrates how Drupal's contributed ecosystem can extend established monitoring capabilities into AI-assisted workflows without requiring changes to Drupal core.

The new native_observability_mcp submodule allows AI assistants to retrieve information about route timings, caching behavior and database activity without changing the site's monitoring configuration. Although Native Observability 2.2.0 supports Drupal 10, 11 and 12, the experimental MCP submodule requires Drupal 11 and PHP 8.3 or later. It uses supporting MCP modules and OAuth-based authorization to manage client connections.

Site administrators can choose between three exposure grades. Grade zero, the default, prevents external diagnostic data tools from returning information. Grade one permits aggregated metrics identified by Drupal route names, while grade two additionally allows access to individual request details, including response status, timings, parameter names without values and exception classes. Enabling the highest grade requires administrator confirmation, additional permissions and authorization for the client to access individual requests.

The access controls are designed to keep decisions about diagnostic data exposure within Drupal's administration interface. Clients must receive administrator approval, and their tool calls are logged. The module's MCP tools cannot modify monitoring rules, exclusions or exposure settings. However, read-only access can still involve sharing diagnostic information with an external AI provider, particularly at grade two. The project's documentation advises site owners to review their privacy notices and data-protection responsibilities before enabling individual-request access.

The release also introduces measures intended to reduce the exposure of sensitive information. According to the release notes, MCP, OpenTelemetry and Prometheus exports identify Drupal routes by machine name rather than sending URL paths or query values. Secrets found in reset links, exception messages and outbound errors are redacted before storage, and IPv6 addresses are anonymized. These restrictions govern the information available through the module's external interfaces, although administrators remain responsible for reviewing the services and clients receiving that data.

The export changes affect existing monitoring integrations even when the AI interface is not enabled. OpenTelemetry spans no longer include url.path or exception.message, while Prometheus exports no longer provide the path label. Queries, alerts and dashboards that depend on those fields may therefore need revision.

The release also changes the upgrade procedure. Sites running Native Observability 1.1.x, 2.0.x or 2.1.x can upgrade directly to 2.2.0, but administrators are instructed to back up the installation, apply database updates, rebuild caches and export the updated configuration. The release notes warn that importing an older configuration snapshot can remove the new exposure settings and silently interrupt exports. Existing installations using export or OpenTelemetry modules remain in legacy exposure mode until an administrator selects a grade.

Native Observability maintainer Giorgio Alfredo Pagano described the development and testing of the MCP integration in a technical article published on 5 November 2026. His experiments examined whether an AI assistant could correctly interpret Drupal-specific performance measurements. One recurring error occurred when the assistant interpreted fewer requests reaching Drupal routing as declining traffic, although increased page-cache activity explained the change.

Giorgio reported addressing the problem by adding calculated signals and explanatory information to the diagnostic tools rather than relying on instructions to the AI model alone. In the final evaluation round, the assistant produced correct conclusions in 30 of 30 answers assessed by a second model. However, the evaluation used synthetic data, the test repository is not public, and the measurements were not repeated after subsequent changes to the released code. The results therefore do not establish diagnostic accuracy on production Drupal installations.

The MCP integration retains several technical limitations. Supporting projects, including MCP Server and Tool, have pre-stable releases that are not covered by Drupal.org's security advisory policy. The project's installation documentation specifies Simple OAuth 6.1.4 or later for the optional integration. Giorgio also reports that version-to-version upgrade testing was performed with SQLite, without equivalent testing on MariaDB or PostgreSQL.

The release builds on Native Observability's earlier work collecting Drupal-specific runtime measurements. The DropTimes reported on version 2.0.0 in September 2026, when the module introduced installation-specific measurements of the performance overhead caused by monitoring. Version 2.2.0 extends that approach by making recorded diagnostics accessible to authorized AI clients. Although the MCP integration remains experimental, it provides a concrete example of how Drupal's contributed modules can support emerging AI-assisted operational workflows while giving administrators control over the information made available.