Claude MarketplacesSubmit

Elasticsearch

tocharianou/elasticsearch-mcp

Connects Claude directly to Elasticsearch clusters running versions 5.x through 9.x with automatic version detection and client selection. Exposes the full Elasticsearch API surface including search, indexing, data streams, ILM policies, and ES|QL queries (8.11+). The server disables unsupported features based on your cluster version, so Data Streams won't appear on 7.8 and earlier. Supports both stdio for Claude Desktop and HTTP transport for remote access. Built with security operations in mind, offering tools for threat detection, anomaly analysis, and audit workflows, though these require a valid Elasticsearch license (trial, platinum, or enterprise). Configure with API key or username/password auth, and set NODE_TLS_REJECT_UNAUTHORIZED=0 for self-signed certificates in development.

GitHub stars: 8
tools: 8
auth: Secret needed
transport: STDIO, HTTP
env vars: 10
last updated: Oct 11, 2026

Tools

8 tools

Public tool metadata for what this MCP can expose to an agent.

list_indicesList indices with pattern filter, health filter, sorting and token-aware summary

List indices with pattern filter, health filter, sorting and token-aware summary

No parameter schema in public metadata yet.

get_mappingsGet field mappings with flat/tree/raw modes, field filtering and multi-index compare

Get field mappings with flat/tree/raw modes, field filtering and multi-index compare

No parameter schema in public metadata yet.

es_searchFull Query DSL search with auto-highlight, plus harness field validation / auto-fix

Full Query DSL search with auto-highlight, plus harness field validation / auto-fix

No parameter schema in public metadata yet.

lookup_fieldsFind the right field names: ECS vocabulary intersected with the index's real fields

Find the right field names: ECS vocabulary intersected with the index's real fields

No parameter schema in public metadata yet.

execute_es_apiExecute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD)

Execute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD)

No parameter schema in public metadata yet.

get_shardsShard info with health analysis, problem detection and recommendations

Shard info with health analysis, problem detection and recommendations

No parameter schema in public metadata yet.

list_data_streamsList and analyze Data Streams with ILM info and backing index details

List and analyze Data Streams with ILM info and backing index details

No parameter schema in public metadata yet.

esql_queryExecute ES|QL pipe-based queries with harness field validation and tabular output

Execute ES|QL pipe-based queries with harness field validation and tabular output

No parameter schema in public metadata yet.

Sponsors

Promote your product hereReach 125k+ visitors monthly Promote your product hereReach 125k+ visitors monthly

Agent CaffeineSponsoredClose your lid, come back to finished work

SnugSponsoredThe clipboard manager for the AI era Promote your product hereReach 125k+ visitors monthly

WaxSponsoredBlock anything with supervision, without erasing your iPhone Promote your product hereReach 125k+ visitors monthly

knobsSponsoredSee your site on any phone, any day, in any language

Configuration

ES_URL*

Your Elasticsearch instance URL (e.g., https://localhost:9200)

ES_API_KEYsecret

Elasticsearch API key for authentication

ES_USERNAME

Elasticsearch username for basic authentication

ES_PASSWORDsecret

Elasticsearch password for basic authentication

ES_CA_CERT

Path to custom CA certificate for Elasticsearch SSL/TLS

NODE_TLS_REJECT_UNAUTHORIZEDdefault: 1

Set to '0' to disable SSL certificate validation (development only)

MAX_TOKEN_CALLdefault: 20000

Maximum tokens per API call

MCP_TRANSPORT*default: http

Transport mode selection

MCP_HTTP_PORTdefault: 3000

HTTP server port (when using HTTP transport)

MCP_HTTP_HOSTdefault: localhost

HTTP server host (when using HTTP transport)

Readme

Elasticsearch MCP Server

Enhanced Elasticsearch MCP Server Solution - Security & Threat Analysis Focused

This is a professional security-focused solution maintained by TocharianOU. It enables comprehensive interaction with all Elasticsearch APIs, specifically optimized for security analysis, threat detection, and incident investigation. Features include advanced security monitoring, anomaly detection, threat hunting, root cause analysis, and comprehensive audit capabilities.

Key Security Features:

Real-time threat detection and security monitoring
Advanced machine learning for anomaly detection
Root cause analysis and attack chain tracking
Security incident investigation and forensics
Compliance monitoring and audit reporting

View the full README on GitHub

Details

Repository: github.com/tocharianou/elasticsearch-mcp
Website: github.com/TocharianOU/elasticsearch-mcp
Category: Databases
Package: @tocharianou/elasticsearch-mcp
Transport: STDIO, HTTP
Auth: Required
Registry: MCP registry, active

More from tocharianou

Kibana86

Related Databases MCP servers

1

Tiger Skillstimescale/tiger-skills-mcp-serverProvider agnostic skills implementation, with skills sourced from local paths or GitHub repositories7stars

2

Mysql Mcpneverinfamous/mysql-mcpEnterprise-grade MySQL MCP Server with OAuth 2.0, 106 tools, and Docker deployment5stars

3

Mysqlmarcelo-ochoa/serversAn MCP server for MySQL databases.0stars

4

Redis MCP Serveryawlabs/redis-mcpRead-first Redis MCP: SCAN key explorer, keyspace/TTL/memory/slowlog stats, DBA advisor2stars

5

SQL Server MCP (macOS)tharanabope/sql-mcp-mac-windowsSQL Server MCP with RAG capabilities for macOS (Docker SQL Server support)0stars

6

Spark SQLaidancorrell/spark-sql-mcp-serverQuery Spark SQL clusters via Thrift/HiveServer2. Works with Spark, EMR, Hive, Impala.0stars