Elasticsearch MCP Server with full version support (ES 5.x-9.x) and comprehensive API access
Elasticsearch sl mcp server connects Elasticsearch Sl to AI assistants that speak the Model Context Protocol. Elasticsearch MCP Server with full version support (ES 5.x-9.x) and comprehensive API access.
This is a professional security-focused solution maintained by TocharianOU. It enables comprehensive interaction with all Elasticsearch APIs, specifically optimized for security analysis, threat detection, and incident investigation. Features include advanced security monitoring, anomaly detection, threat hunting, root cause analysis, and comprehensive audit capabilities.
Once connected, the assistant can call these 7 tools directly:
list_indices — List indices with pattern filter, health filter, sorting and token-aware summaryget_mappings — Get field mappings with flat/tree/raw modes, field filtering and multi-index comparees_search — Full Query DSL search with auto-highlight on text/vector fieldsexecute_es_api — Execute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD)get_shards — Shard info with health analysis, problem detection and recommendationslist_data_streams — List and analyze Data Streams with ILM info and backing index detailsesql_query — Execute ES\The server is distributed via npm as @tocharianou/elasticsearch-mcp, so most clients can run it without a manual build step. Add it to your MCP client's configuration and restart the client to pick it up — the copy-paste configs for Claude Desktop, Claude Code and Cursor are on this page.
Before the server will start you need to supply 6 environment variables: ES_URL, ES_USERNAME, ES_PASSWORD, NODE_TLS_REJECT_UNAUTHORIZED, ES_API_KEY, MCP_HTTP_HOST. Keep credentials in your client's env block or a secrets manager rather than committing them.
Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. Elasticsearch Sl sits in that group, and the shape of its toolset — list_indices, get_mappings, es_search among others — tells you what it is really for. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.
| Tool | What it does |
|---|---|
| list_indices | List indices with pattern filter, health filter, sorting and token-aware summary |
| get_mappings | Get field mappings with flat/tree/raw modes, field filtering and multi-index compare |
| es_search | Full Query DSL search with auto-highlight on text/vector fields |
| execute_es_api | Execute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD) |
| get_shards | Shard info with health analysis, problem detection and recommendations |
| list_data_streams | List and analyze Data Streams with ILM info and backing index details |
| esql_query | Execute ES\ |
**For Source Installation:**
```json
{
"mcpServers": {
"elasticsearch-mcp-server-local": {
"command": "node",
"args": [
"/path/to/your/elasticsearch-mcp/dist/index.js"
],
"env": {
"ES_URL": "your-elasticsearch-url",
"ES_USERNAME": "elastic",
"ES_PASSWORD": "your_pass",
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| ES_URL | Endpoint or connection string the server talks to. | Yes |
| ES_USERNAME | Configuration value read at startup. | Optional |
| ES_PASSWORD | Configuration value read at startup. | Optional |
| NODE_TLS_REJECT_UNAUTHORIZED | Configuration value read at startup. | Optional |
| ES_API_KEY | Credential the server authenticates with. | Yes |
| MCP_HTTP_HOST | Endpoint or connection string the server talks to. | Optional |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.