Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Elastic server

Elastic Security MCP App

Local MCP App server from Elastic that adds interactive security operations dashboards (alert triage, Attack Discovery, case management, detection rules, ES|QL threat hunting, sample data) to MCP hosts. It connects to Elasticsearch and Kibana with the analyst's API key and writes results back through the Elastic Security APIs. It runs locally from https://github.com/elastic/example-mcp-app-security/releases/latest/download/elastic-security-mcp-app.tgz (github-release) with API key auth.

Last verified 7 tools7 sources

Install

Claude Code

About Claude Code
Terminal
claude mcp add elastic-security \
  -e 'CLUSTERS_JSON=[{"name":"primary","elasticsearchUrl":"https://your-cluster.es.cloud.example.com","kibanaUrl":"https://your-cluster.kb.cloud.example.com","elasticsearchApiKey":"your-api-key","sslVerify":true}]' \
  -- npx -y https://github.com/elastic/example-mcp-app-security/releases/latest/download/elastic-security-mcp-app.tgz --stdio

Cursor

About Cursor
JSON
{
  "servers": {
    "elastic-security": {
      "command": "npx",
      "args": [
        "-y",
        "https://github.com/elastic/example-mcp-app-security/releases/latest/download/elastic-security-mcp-app.tgz",
        "--stdio"
      ],
      "env": {
        "CLUSTERS_JSON": "[{\"name\":\"primary\",\"elasticsearchUrl\":\"https://your-cluster.es.cloud.example.com\",\"kibanaUrl\":\"https://your-cluster.kb.cloud.example.com\",\"elasticsearchApiKey\":\"your-api-key\",\"sslVerify\":true}]"
      }
    }
  }
}

VS Code

JSON
{
  "servers": {
    "elastic-security": {
      "command": "npx",
      "args": [
        "-y",
        "https://github.com/elastic/example-mcp-app-security/releases/latest/download/elastic-security-mcp-app.tgz",
        "--stdio"
      ],
      "env": {
        "CLUSTERS_JSON": "[{\"name\":\"primary\",\"elasticsearchUrl\":\"https://your-cluster.es.cloud.example.com\",\"kibanaUrl\":\"https://your-cluster.kb.cloud.example.com\",\"elasticsearchApiKey\":\"your-api-key\",\"sslVerify\":true}]"
      }
    }
  }
}

Tools

triage-alerts
Fetch, filter, and triage security alerts with AI verdicts.
triage-attack-discoveries
Review AI-correlated attack chain findings with confidence scoring.
generate-attack-discovery
Trigger on-demand attack discovery analysis via any AI connector.
manage-cases
Create, search, and manage SOC investigation cases.
manage-rules
Browse, tune, and manage detection rules.
threat-hunt
ES|QL query workbench with entity investigation graph.
generate-sample-data
Generate ECS-compliant security events for demos.

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • Published in Elastic's GitHub org under the repo name example-mcp-app-security and announced on Elastic Security Labs on May 11, 2026.
  • Tool names and descriptions are the view tools from the repo's manifest.json (also named in docs/architecture.md); the README and blog present them as six dashboards (Alert Triage, Attack Discovery, Case Management, Detection Rules, Threat Hunt, Sample Data), and the server also exposes data and action tools such as poll-alerts, execute-esql and update-case.
  • Requires Elasticsearch 9.x with Security enabled, plus Kibana for cases, rules and Attack Discovery, and Node.js 22+ for the npx install.
  • Claude Desktop can install it with a one-click .mcpb bundle from the latest GitHub release.
  • A local HTTP mode serves http://localhost:3001/mcp; Claude.ai access goes through a cloudflared tunnel.
  • Licensed under Elastic License 2.0, which is source-available rather than OSI open source. package.json shows version 1.0.9.
  • Sends anonymised telemetry only when the Kibana telemetry opt-in is enabled.

More MCP servers for auth and security

Related reading

FAQ

What does the Elastic Security MCP App do?

Local MCP App server from Elastic that adds interactive security operations dashboards (alert triage, Attack Discovery, case management, detection rules, ES|QL threat hunting, sample data) to MCP hosts. It connects to Elasticsearch and Kibana with the analyst's API key and writes results back through the Elastic Security APIs. The vendor documents 7 tools, including triage-alerts, triage-attack-discoveries, generate-attack-discovery and manage-cases.

How do I add the Elastic Security MCP App to Claude Code?

Elastic documents a Claude Code config; copy it from the Claude Code section of this page. Snippets for Cursor and VS Code are there too.

Does the Elastic Security MCP App need authentication?

Yes, API key. Transport: stdio, Streamable HTTP. Status: Unlabelled, last checked October 17, 2026.

Sources

Last verified against 7 Elastic pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.