Elasticsearch MCP Server with full version support (ES 5.x-9.x) and comprehensive API access
Elasticsearch sl mcp server connects Elasticsearch Sl to AI assistants that speak the Model Context Protocol. Elasticsearch MCP Server with full version support (ES 5.x-9.x) and comprehensive API access.
This is a professional security-focused solution maintained by TocharianOU. It enables comprehensive interaction with all Elasticsearch APIs, specifically optimized for security analysis, threat detection, and incident investigation. Features include advanced security monitoring, anomaly detection, threat hunting, root cause analysis, and comprehensive audit capabilities.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| query | the ES|QL string (required) |
| params | positional parameters replacing ? placeholders (optional) |
| include_types | include column type info in output (optional, default false) |
| break_token_rule | bypass token limit for large results (optional, default false) |
| skip_lint | bypass harness field validation (optional, default false) |
| list_indices | List indices with pattern filter, health filter, sorting and token-aware summary |
| get_mappings | Get field mappings with flat/tree/raw modes, field filtering and multi-index compare |
| es_search | Full Query DSL search with auto-highlight, plus harness field validation / auto-fix |
| lookup_fields | Find the right field names: ECS vocabulary intersected with the index's real fields |
| execute_es_api | Execute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD) |
| get_shards | Shard info with health analysis, problem detection and recommendations |
| list_data_streams | List and analyze Data Streams with ILM info and backing index details |
| esql_query | Execute ES\ |
{
"mcpServers": {
"elasticsearch-mcp-server": {
"command": "npx",
"args": [
"@tocharianou/elasticsearch-mcp"
],
"env": {
"ES_URL": "your-elasticsearch-url",
"ES_USERNAME": "elastic",
"ES_PASSWORD": "YOUR_ES_PASSWORD",
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
| Variable | Description | Required |
|---|---|---|
| ES_URL | Declared in the maintainer’s client configuration. | Check documentation |
| ES_USERNAME | Declared in the maintainer’s client configuration. | Check documentation |
| ES_PASSWORD | Declared in the maintainer’s client configuration. | Check documentation |
| NODE_TLS_REJECT_UNAUTHORIZED | Declared in the maintainer’s client configuration. | Check documentation |
Inspect PostgreSQL schemas and run read-only queries with the archived MCP reference server. Review its maintenance status before choosing it.
Connect the Notion MCP server to search workspace content and work with pages and databases through Notion’s hosted OAuth service.
Use the Supabase MCP server to inspect database schemas, query project data and retrieve docs through a project-scoped connection.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.