Elasticsearch — Claude Code MCP server
Connects an Elasticsearch cluster to an AI agent for data queries, field checks, and security event analysis.
claude mcp add --env ES_URL=<ES_URL> --env ES_API_KEY=<ES_API_KEY> --env ES_USERNAME=<ES_USERNAME> --env ES_PASSWORD=<ES_PASSWORD> --env ES_CA_CERT=<ES_CA_CERT> --transport stdio elasticsearch -- npx -y @tocharianou/elasticsearch-mcpWhat Elasticsearch does
This MCP server gives an agent access to Elasticsearch APIs through natural-language requests. It detects Elasticsearch versions from 5.x through 9.x, loads the matching client, and registers tools that the cluster can support.
A query harness checks requested fields against the live cluster before a query runs. It can correct some mapping mistakes, suggest real fields after an error, and let a call bypass validation with skip_lint for runtime fields. Setup requires an Elasticsearch instance and credentials: ES_API_KEY, or ES_USERNAME with ES_PASSWORD. The connection cannot start without ES_URL.
What it helps with
- search Elasticsearch indexes for security events
- validate field names before sending a query
- investigate failed login activity
- trace related events during an incident
Example prompts for the agent
- Find failed logins by user in Elasticsearch and show which fields the query used.
- Check this index query against the live mappings and fix an unnecessary
.keywordsuffix. - Investigate these security events and connect them into an attack chain.
How to install Elasticsearch
Platform CLI
claude mcp add --env ES_URL=<ES_URL> --env ES_API_KEY=<ES_API_KEY> --env ES_USERNAME=<ES_USERNAME> --env ES_PASSWORD=<ES_PASSWORD> --env ES_CA_CERT=<ES_CA_CERT> --transport stdio elasticsearch -- npx -y @tocharianou/elasticsearch-mcpReplace <…> with your own values. 5 more environment variables are in the server README
Platform CLI
codex mcp add elasticsearch --env ES_URL=<ES_URL> --env ES_API_KEY=<ES_API_KEY> --env ES_USERNAME=<ES_USERNAME> --env ES_PASSWORD=<ES_PASSWORD> --env ES_CA_CERT=<ES_CA_CERT> -- npx -y @tocharianou/elasticsearch-mcpReplace <…> with your own values. 5 more environment variables are in the server README
Config file
{
"mcpServers": {
"elasticsearch": {
"command": "npx",
"args": [
"-y",
"@tocharianou/elasticsearch-mcp"
],
"env": {
"ES_URL": "<ES_URL>",
"ES_API_KEY": "<ES_API_KEY>",
"ES_USERNAME": "<ES_USERNAME>",
"ES_PASSWORD": "<ES_PASSWORD>",
"ES_CA_CERT": "<ES_CA_CERT>"
}
}
}
}Replace <…> with your own values. 5 more environment variables are in the server README
Config file
{
"servers": {
"elasticsearch": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@tocharianou/elasticsearch-mcp"
],
"env": {
"ES_URL": "<ES_URL>",
"ES_API_KEY": "<ES_API_KEY>",
"ES_USERNAME": "<ES_USERNAME>",
"ES_PASSWORD": "<ES_PASSWORD>",
"ES_CA_CERT": "<ES_CA_CERT>"
}
}
}
}Replace <…> with your own values. 5 more environment variables are in the server README
Platform CLI
gemini mcp add -e ES_URL=<ES_URL> -e ES_API_KEY=<ES_API_KEY> -e ES_USERNAME=<ES_USERNAME> -e ES_PASSWORD=<ES_PASSWORD> -e ES_CA_CERT=<ES_CA_CERT> elasticsearch npx -y @tocharianou/elasticsearch-mcpReplace <…> with your own values. 5 more environment variables are in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Elasticsearch
How do I install Elasticsearch in Claude Code?
Run `claude mcp add elasticsearch -e ES_URL=<ES_URL> -e ES_API_KEY=<ES_API_KEY> -e ES_PASSWORD=<ES_PASSWORD> -- npx -y @tocharianou/elasticsearch-mcp`.
What does the Elasticsearch MCP server do?
It connects Claude Code to Elasticsearch, selects a client for the cluster version, and checks query fields against live mappings.
Which Elasticsearch versions does it support?
It automatically supports Elasticsearch 5.x–9.x. Older releases receive a smaller set of available tools.
