# Elasticsearch

Connects an Elasticsearch cluster to an AI agent for data queries, field checks, and security event analysis.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: TocharianOU
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/TocharianOU/elasticsearch-mcp
- Updated: 2026-10-11
- HTML: https://affpapa.org/en/nevibecode/mcp/elasticsearch

## What it does

This MCP server gives an agent access to Elasticsearch APIs through natural-language requests. It detects Elasticsearch versions from 5.x through 9.x, loads the matching client, and registers tools that the cluster can support.

A query harness checks requested fields against the live cluster before a query runs. It can correct some mapping mistakes, suggest real fields after an error, and let a call bypass validation with `skip_lint` for runtime fields. Setup requires an Elasticsearch instance and credentials: `ES_API_KEY`, or `ES_USERNAME` with `ES_PASSWORD`. The connection cannot start without `ES_URL`.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `ES_URL`, `ES_API_KEY`, `ES_USERNAME`, `ES_PASSWORD`, `ES_CA_CERT`, `NODE_TLS_REJECT_UNAUTHORIZED`, `MAX_TOKEN_CALL`, `MCP_TRANSPORT`, `MCP_HTTP_PORT`, `MCP_HTTP_HOST` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env ES_URL=<ES_URL> --env ES_API_KEY=<ES_API_KEY> --env ES_USERNAME=<ES_USERNAME> --env ES_PASSWORD=<ES_PASSWORD> --env ES_CA_CERT=<ES_CA_CERT> --transport stdio elasticsearch -- npx -y @tocharianou/elasticsearch-mcp
```
Replace <…> with your own values. 5 more environment variables are in the server README

### Codex

**Platform CLI**
```bash
codex mcp add elasticsearch --env ES_URL=<ES_URL> --env ES_API_KEY=<ES_API_KEY> --env ES_USERNAME=<ES_USERNAME> --env ES_PASSWORD=<ES_PASSWORD> --env ES_CA_CERT=<ES_CA_CERT> -- npx -y @tocharianou/elasticsearch-mcp
```
Replace <…> with your own values. 5 more environment variables are in the server README

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "elasticsearch": {
            "command": "npx",
            "args": [
                "-y",
                "@tocharianou/elasticsearch-mcp"
            ],
            "env": {
                "ES_URL": "<ES_URL>",
                "ES_API_KEY": "<ES_API_KEY>",
                "ES_USERNAME": "<ES_USERNAME>",
                "ES_PASSWORD": "<ES_PASSWORD>",
                "ES_CA_CERT": "<ES_CA_CERT>"
            }
        }
    }
}
```
Replace <…> with your own values. 5 more environment variables are in the server README

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "elasticsearch": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@tocharianou/elasticsearch-mcp"
            ],
            "env": {
                "ES_URL": "<ES_URL>",
                "ES_API_KEY": "<ES_API_KEY>",
                "ES_USERNAME": "<ES_USERNAME>",
                "ES_PASSWORD": "<ES_PASSWORD>",
                "ES_CA_CERT": "<ES_CA_CERT>"
            }
        }
    }
}
```
Replace <…> with your own values. 5 more environment variables are in the server README

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e ES_URL=<ES_URL> -e ES_API_KEY=<ES_API_KEY> -e ES_USERNAME=<ES_USERNAME> -e ES_PASSWORD=<ES_PASSWORD> -e ES_CA_CERT=<ES_CA_CERT> elasticsearch npx -y @tocharianou/elasticsearch-mcp
```
Replace <…> with your own values. 5 more environment variables are in the server README

## When to use it
- search Elasticsearch indexes for security events
- validate field names before sending a query
- investigate failed login activity
- trace related events during an incident

## Example prompts
- Find failed logins by user in Elasticsearch and show which fields the query used.
- Check this index query against the live mappings and fix an unnecessary `.keyword` suffix.
- Investigate these security events and connect them into an attack chain.

## Similar
- [elasticsearch-agent](https://affpapa.org/en/nevibecode/agents/elasticsearch-agent.md) — subagent · ★ 40451
- [elasticsearch-reindex](https://affpapa.org/en/nevibecode/skills/elasticsearch-reindex.md) — skill · 1000 installs
- [elasticsearch-ingest](https://affpapa.org/en/nevibecode/skills/elasticsearch-ingest.md) — skill · 1000 installs
- [elasticsearch-best-practices](https://affpapa.org/en/nevibecode/skills/elasticsearch-best-practices.md) — skill · 999 installs
- [elasticsearch-mcp-server](https://affpapa.org/en/nevibecode/mcp/elasticsearch-mcp-server.md) — MCP server · ★ 314
- [crowdsentinel-mcp-server](https://affpapa.org/en/nevibecode/mcp/crowdsentinel-mcp-server.md) — MCP server · ★ 204

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md