Elasticsearch MCP Server
Query and manage Elasticsearch from MCP-capable AI clients, with a tool surface built around security analysis and incident investigation.
- Query DSL
- ES|QL queries
- Mappings and index information
- Cluster health
- Shard and node information
- Aggregations
- Document retrieval
- Multi-cluster access
- Threat hunting and detection validation
- Incident investigation and forensics
- Root cause analysis across log sources
- Cluster health and capacity questions
This server connects an MCP client directly to Elasticsearch, rather than going through Kibana. That matters when the question is about the data or the cluster itself: what a mapping actually looks like, how a query plan behaves, why a shard is hot, what an aggregation returns across three years of an index lifecycle.
The tool surface leans towards security work — threat hunting, detection validation, incident investigation, audit questions — because that is where the gap between “the data is in Elasticsearch” and “somebody can answer the question quickly” is widest.
ES|QL and older clusters
ES|QL changes what is worth asking an agent. A piped query is far easier for a model to compose correctly than a deeply nested Query DSL document, and far easier for a human to check afterwards. Where the cluster supports it, that is the path we prefer.
Not every enterprise cluster is current, though. Compatibility across older Elasticsearch versions — different API shapes, different authentication, proxies in front of the cluster — is a recurring part of the work, and one we handle in delivery rather than asking the customer to solve. Nobody should have to upgrade a production cluster just to let an agent read from it.
Prerequisites
An Elasticsearch instance, credentials (API key or username and password), and an MCP-capable client. Some capabilities depend on your Elasticsearch license tier; see the repository README for current details.
Deploying it inside an enterprise
The same caveat applies as with the Kibana server: out of the box it acts with the permissions of the credentials you hand it. Production deployments need a dedicated role rather than a human account, read and write tools separated, index-level scoping so an agent cannot wander into data the engagement does not cover, and tool-call logging.
Community-maintained. Not an official product of Elastic or of the MCP project.