Deploy and register a Grafana Cloud Synthetic Monitoring private probe (synthetic-monitoring-agent) via Docker or Kubernetes so synthetic checks can run from within a private network
domain: grafana.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
In Grafana Cloud, with the Admin role, go to Testing & synthetics > Synthetics > Probes > Add Private Probe; enter a Probe Name, Latitude/Longitude, a Region (defaults AMER/EMEA/APAC, or a custom value), optional labels, click Save, then copy the generated Probe Authentication Token.
Look up the correct Probe API Server URL (and matching backend/secrets-proxy addresses) for your stack's region on the Synthetic Monitoring Config page under 'backend address'; the API server URL must be entered without the https:// scheme.
To deploy via Docker: docker pull grafana/synthetic-monitoring-agent (use the -browser tagged image if you need k6 browser checks), export API_TOKEN=<PROBE_TOKEN> and API_SERVER=<PROBE_API_SERVER_URL>, then run: docker run grafana/synthetic-monitoring-agent --api-server-address=${API_SERVER} --api-token=${API_TOKEN} --verbose=true.
To deploy via Kubernetes: fetch the example namespace.yaml, secret.yaml, and deployment.yaml from github.com/grafana/synthetic-monitoring-agent (examples/kubernetes), put the Probe Authentication Token into secret.yaml and the region's Probe API Server URL into deployment.yaml, then kubectl apply -f namespace.yaml, secret.yaml, and deployment.yaml in order.
Open outbound firewall access from the probe host/pod to the region's API server URL and secrets-proxy address, plus the stack's Prometheus and Loki connection URLs, so the probe can register with Grafana Cloud and ship results.
Confirm registration by checking that the new probe shows as online on the Synthetics > Probes page in Grafana Cloud, then attach checks to it.
Known gotchas
Each private probe has its own unique Probe Authentication Token — you cannot reuse one token across multiple probe deployments.
The Probe API Server URL is region/stack-specific (found via the Config page's 'backend address') and must be supplied without the https:// prefix, or the agent will fail to connect.
k6 browser checks require the -browser-tagged Docker image (or a locally installed Chromium binary for package-based installs) plus 'Disable scripted checks'/'Disable browser checks' unchecked in probe settings; private probes also block k6 targets in 10.0.0.0/8 by default unless --blocked-nets="" is set.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?