MCP server
Elasticsearch MCP server
Elastic's Agent Builder MCP endpoint lets AI search indices, run ES|QL queries and read mappings and documents in Elasticsearch.
- Official server
- Databases
At a glance
- Maintained by
- Elastic
- Tools exposed
- 8 listed below
- Reviewed
- September 24, 2026
Why it matters
What it does and why it matters
Elasticsearch powers search and log analytics for many companies. Elastic now provides MCP access through its Agent Builder, with an endpoint in Kibana. An assistant can search indices, generate and run ES|QL queries, list indices, read mappings and fetch documents.
For support and operations teams, that means asking questions of logs and search data in plain English, such as "how many checkout errors did we see yesterday, by region".
The older standalone Elasticsearch MCP server is deprecated and receives only critical security fixes. The Agent Builder endpoint requires Elastic 9.2 or later. Core tools read and query data. Custom and workflow tools can take actions, depending on how you set them up, so review what you publish.
Use cases
Best business use cases
Log questions
Search tuning
Document lookup
Operational reports
Product docs
Tools
Available tools
Tool names as published by the maintainer at review time. Versions change, so check the repository for the current list.
Read and write: Core built-in tools read and query data; custom and workflow tools can take actions depending on setup.
-
platform.core.searchSearches Elasticsearch data using natural language.
-
platform.core.execute_esqlRuns an ES|QL query and returns a table.
-
platform.core.generate_esqlWrites an ES|QL query from a plain-language question.
-
platform.core.list_indicesLists indices, aliases and data streams.
-
platform.core.get_index_mappingGets mappings for one or more indices.
-
platform.core.get_document_by_idGets a full document by its ID.
-
platform.core.index_explorerFinds relevant indices for a plain-language query.
-
platform.core.product_documentationSearches Elastic product documentation.
Workflows
Example workflows
Investigate an error spike
-
1
An alert shows more checkout errors.
-
2
Ask the assistant to count errors by service for the last day.
-
3
It generates and runs an ES|QL query.
-
4
It highlights the service with the jump.
-
5
An engineer investigates with that lead.
Check an index before a change
-
1
Ask for the mapping of the products index.
-
2
The assistant reads and explains it.
-
3
It samples documents.
-
4
It flags fields that may not be indexed as expected.
-
5
The team updates the mapping plan.
Prompts
Example prompts
“How many checkout errors did we log yesterday, by region?”
“Show the mapping for the products index and explain each field type.”
“Find the log entries for request ID abc-123.”
Setup
Installation and configuration
Examples for Claude Desktop and Claude Code. Replace the placeholder values with your own keys, and store secrets outside version control.
Claude Desktop: claude_desktop_config.json
{
"mcpServers": {
"elastic-agent-builder": {
"command": "npx",
"args": [
"mcp-remote",
"${KIBANA_URL}/api/agent_builder/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"KIBANA_URL": "${KIBANA_URL}",
"AUTH_HEADER": "ApiKey ${API_KEY}"
}
}
}
}Claude Code: terminal
claude mcp add --transport http elastic-agent-builder https://YOUR_KIBANA_URL/api/agent_builder/mcp --header "Authorization: ApiKey YOUR_API_KEY"- Hosted server: {KIBANA_URL}/api/agent_builder/mcp (or {KIBANA_URL}/s/{SPACE_NAME}/api/agent_builder/mcp).
- Local server: Via npx mcp-remote bridge to the Kibana endpoint.
- Needs: Kibana URL; Elastic API key with Kibana privilege feature_agentBuilder.read (or OAuth 2.1).
Security
Security considerations
-
Scoped API key
Use an API key with only the Agent Builder read privilege.
-
Index permissions
Limit which indices the key can read.
-
Custom tools
Review any custom or workflow tools before publishing them.
-
Logs hold personal data
Mask personal data in logs where possible.
Related servers
Servers that pair well with it
Sentry
Sentry's official MCP server lets AI search errors, events and traces, read issue details, get AI analysis and update issues.
Snowflake
Snowflake's managed MCP server exposes admin-defined tools, such as Cortex agents, Cortex Analyst, Cortex Search and SQL, to AI assistants.
BigQuery
Google's remote BigQuery MCP server lets AI list datasets and tables and run SQL, with a read-only query tool and IAM controls.
Keep exploring
Solutions and services that use it
Related services
View all related services- MCP integration Connect AI assistants to your CRM, files, databases and tools through Model Context Protocol servers, with safe permissions.
- Database design Data models that stay fast and correct as your business grows, with backups and access rules in place.
- Web applications Custom browser-based software for the work your team does every day, from booking tools to operations systems.
- Dashboards and reporting Dashboards that pull numbers from the systems you already use and show what matters without a spreadsheet.
- Multi-tenant architecture One product serving many customer accounts, with each account's data kept separate and secure.
- Product scaling Keep a growing product fast and stable as users, data and features increase.
Solutions
View all solutions- Automated reporting Reports that build themselves from your systems on schedule, with a plain-language summary of what changed.
- Knowledge assistant (RAG) Ask a question in plain words and get an answer from your own documents, with links to the sources.
- Forecasting dashboards Forecast demand from your sales history and seasonality, and flag items to reorder before they run out.
- Payroll automation Turn pay rules, attendance and leave into tested software so the monthly run becomes a review and payslips go out in one batch.
- AI sales research agent Short, sourced briefings on each prospect before a call, drafted by an AI agent from public information and your CRM.
Case studies
View all case studiesGuides and articles
View all guides and articles- How to connect AI to your database safely Let staff ask questions of your data in plain English without risking production systems or sensitive records.
- PostgreSQL vs MySQL The two most popular open-source databases compared for business applications.
- How to automate reporting with AI and MCP Build reports that assemble themselves from your systems through MCP, with a written summary people can trust.
- How to set up automated reporting Replace manual weekly and monthly reports with dashboards and summaries that update themselves.
AI models
View all ai models- text-embedding-3-large OpenAI's most capable embedding model for search and retrieval, with 3,072-dimension vectors and support for English and other languages.
- text-embedding-3-small OpenAI's efficient, lowest-cost embedding model, with 1,536-dimension vectors for search, retrieval and similarity at scale.
- Cohere Embed v4 Cohere's multimodal embedding model for enterprise search, embedding text, images and mixed documents, with flexible vector sizes and long inputs.
- Voyage 4 Voyage AI's current embedding series, now part of MongoDB, with large, standard and lite models that share one embedding space.
- Embeddings Models that turn text into vectors for search, retrieval, clustering and recommendations.
- Cohere Rerank 4 Cohere's multilingual rerank models, which sort search results by relevance, in a best-quality Pro version and a low-latency Fast version.
Glossary terms
View all glossary terms- Database A database is an organized store of data that software can search, update and keep consistent, such as customers, orders or bookings.
- Natural language processing Natural language processing is the field of AI that deals with understanding and generating human language, in text or speech.
- Semantic search Semantic search finds results by meaning rather than exact words, so a search for "reset my login" can find an article titled "Forgot your password".
- Vector database A vector database stores embeddings, lists of numbers that represent meaning, and quickly finds the ones most similar to a query.
- Backend The backend is the part of an application that runs on servers, storing data, applying business rules and serving the frontend through APIs.
- Embeddings Embeddings are lists of numbers that represent the meaning of text or images, so software can find items that are similar in meaning.
FAQ
Questions people ask us
Have a question that is not here? Ask us directly.
It is deprecated and receives only critical security fixes. Elastic points users to the Agent Builder endpoint.
The Agent Builder MCP endpoint needs Elastic 9.2 or later.
Core tools read and query. Custom tools may act, depending on your setup.