Elasticsearch

Provides an Elasticsearch security-focused MCP server to query and analyze security data via MCP.

typescript

GitHub Stars

typescript

Language

5 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "tocharianou-mcp-server-elasticsearch-sl": {
      "command": "npx",
      "args": [
        "@tocharian/mcp-server-elasticsearch-sl"
      ],
      "env": {
        "ES_URL": "your-elasticsearch-url",
        "ES_API_KEY": "<your_api_key>",
        "ES_CA_CERT": "/path/to/ca.pem",
        "ES_PASSWORD": "your_pass",
        "ES_USERNAME": "elastic",
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }
}

You can connect to your Elasticsearch data from any MCP client to run natural language queries for security analysis, threat hunting, and incident investigation. This MCP server provides a secure bridge that lets you interact with Elasticsearch APIs through your MCP client, making it easy to run queries, list indices, and perform common data inspections in a structured, chat-driven workflow.

How to use

Launch your MCP client and start a conversation with the Elasticsearch MCP server. The server handles your requests and returns structured results that you can view in your client. Use natural language prompts to perform tasks like listing indices, inspecting security data, and tracing events through the data.

How to install

Prerequisites you need on your machine are an active Elasticsearch instance, a valid Elasticsearch license (trial, platinum, or enterprise), and an MCP client such as Claude Desktop.

Install the MCP server package and start it using one of the supported methods.

# Option 1: Install and run via NPM (recommended)\nnpm install -g @tocharian/mcp-server-elasticsearch-sl\nnpx @tocharian/mcp-server-elasticsearch-sl

Additional configuration and usage notes

The server reads configuration from environment variables. At minimum you must provide the Elasticsearch URL. Optional credentials can be supplied as an API key or username/password, and you can disable SSL validation in development environments using an environment flag.

Key environment variables you will use include ES_URL for the Elasticsearch instance URL, ES_API_KEY or ES_USERNAME/ES_PASSWORD for authentication, and NODE_TLS_REJECT_UNAUTHORIZED to control SSL validation in non-production environments.

Security and best practices

Avoid using broad cluster-admin privileges. Create dedicated API keys with scoped permissions and apply fine-grained access control at the index level to reduce the risk of data exposure.

If you enable a trial license on Elasticsearch, ensure you monitor feature usage and audit access as you evaluate the MCP integration.

Troubleshooting

If you encounter issues connecting, verify that your Elasticsearch URL is reachable from the MCP server host, check credentials and permissions, and ensure the network allows the MCP server to reach Elasticsearch.

Review the server logs for authentication or SSL errors, and confirm that TLS settings match between Elasticsearch and the MCP server.

License

The MCP server is distributed under the Apache License 2.0. If your Elasticsearch cluster requires a valid license for features used during security analysis, ensure the license is active before enabling those features.

Tips for getting started quickly

Start with a simple query to list indices and verify connectivity. 2) Enable security-focused queries to monitor access patterns and detect anomalies. 3) Gradually add more data sources and refine your prompts for deeper insights.

Available tools

initialize

Initialize a new MCP session with the server, establishing the protocol version and client capabilities.

tools/list

List available MCP tools or capabilities exposed by the server.

tools/call

Invoke a named tool and pass arguments to perform a specific operation, such as listing indices or querying data.

Built by

VeilStrat

AI signals for GTM teams