Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Data and BI - official Elastic server

Elastic Agent Builder MCP server

MCP endpoint built into Kibana that exposes Elastic Agent Builder's built-in and custom tools to outside MCP hosts, for example running ES|QL queries, searching indices or querying observability and security data. It replaces the standalone Elasticsearch MCP Server. It is served from your own instance at {KIBANA_URL}/api/agent_builder/mcp with OAuth or API key auth.

Last verified 15 tools5 sources

Install

Claude Code

About Claude Code
Terminal
claude mcp add --transport http --client-id {CLIENT_ID} kibana-mcp {MCP_SERVER_URL}

Cursor

About Cursor
JSON
{
  "mcpServers": {
    "kibana-mcp": {
      "url": "{MCP_SERVER_URL}",
      "auth": {
        "CLIENT_ID": "{CLIENT_ID}",
        "CLIENT_SECRET": "{CLIENT_SECRET}"
      }
    }
  }
}

Generic

JSON
{
  "mcpServers": {
    "elastic-agent-builder": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "${KIBANA_URL}/api/agent_builder/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "KIBANA_URL": "${KIBANA_URL}",
        "AUTH_HEADER": "ApiKey ${API_KEY}"
      }
    }
  }
}

Tools

platform.core.execute_esql
Executes an ES|QL query and returns the results in a tabular format.
platform.core.generate_esql
Generates an ES|QL query from a natural language query.
platform.core.get_document_by_id
Retrieves the full content of an Elasticsearch document by its ID and index name.
platform.core.get_index_mapping
Retrieves mappings for the specified index or indices.
platform.core.index_explorer
Lists relevant indices and mappings based on a natural language query.
platform.core.list_indices
Lists the indices, aliases, and data streams the current user can access.
platform.core.search
Searches Elasticsearch data in natural language, choosing between Query DSL and ES|QL.
platform.core.product_documentation
Searches and retrieves documentation about Elastic products.
platform.core.get_workflow_execution_status
Retrieves the status and output of an Elastic Workflows execution.
observability.get_alerts
Retrieves Observability alerts within a time range.
observability.get_services
Retrieves information about services monitored in APM.
observability.get_logs
Searches and filters logs, returning a histogram, count, samples and patterns.
security.alerts
Searches and analyzes security alerts.
security.attack_discovery_search
Returns related attack discoveries from the last week for given alert IDs.
security.entity_risk_score
Retrieves risk scores for users, hosts, and services.

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • Docs label it GA on Stack 9.3+ and available on Serverless (Elasticsearch, Observability, Security); the deprecated standalone server's README says the endpoint exists from Elastic 9.2.0.
  • API key auth works on Stack and Serverless and needs the feature_agentBuilder.read Kibana privilege.
  • OAuth 2.1 is Serverless only and needs a pre-registered OAuth client; hosts that rely only on dynamic client registration are not supported.
  • The Claude Code and Cursor snippets are the OAuth (Serverless) path, and the generic snippet is the API key path through mcp-remote.
  • Some built-in tools, such as create_visualization and most cases tools, are not exposed over MCP.
  • Many tools need a particular Stack version, license or solution; the 15 listed are a sample of the built-in tools reference.
  • Elastic also lists an 'Elastic Cloud Serverless' connector in the Claude directory.

More MCP servers for data and BI

Related reading

FAQ

What does the Elastic Agent Builder MCP server do?

MCP endpoint built into Kibana that exposes Elastic Agent Builder's built-in and custom tools to outside MCP hosts, for example running ES|QL queries, searching indices or querying observability and security data. It replaces the standalone Elasticsearch MCP Server. The vendor documents 15 tools, including platform.core.execute_esql, platform.core.generate_esql, platform.core.get_document_by_id and platform.core.get_index_mapping.

How do I add the Elastic Agent Builder MCP server to Claude Code?

Run claude mcp add --transport http --client-id {CLIENT_ID} kibana-mcp {MCP_SERVER_URL}, copied from Elastic's docs. This page also has snippets for Cursor and Generic.

Does the Elastic Agent Builder MCP server need authentication?

Yes, OAuth or API key. Transport: Streamable HTTP. Status: GA, last checked October 17, 2026.

Sources

Last verified against 5 Elastic pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.