Elasticsearch MCP: Documentation

Connection

docker run docker.elastic.co/mcp/elasticsearch (stdio or HTTP/SSE). Auth is an ES_API_KEY (recommended) or a username/password pair for the Elasticsearch cluster. Requires cluster access on an ESQL-compatible version (7.17+/8.x/9.x).

Tools

5 tools: list_indices — the cluster's index list; get_mappings — an index's field structure; search — full-text DSL search with relevance ranking; esql — ESQL queries (SQL-like syntax for aggregations and filters); get_shards — how an index's shards are distributed across nodes.

Agent flow

"Find 500 errors from the last hour", "calculate average order size by region using ESQL", "show me the products index mapping", "which nodes hold the shards for logs-app?".

Important

As of Elastic 9.2, this server only receives security patches — no new functionality is being added. Elastic is steering new integrations toward Agent Builder, built directly into Elasticsearch/Kibana; for new projects, look there first. This MCP server still works fine for existing search and ESQL use cases.

Pricing

The MCP server is free, open source. Elasticsearch itself is free self-managed (Basic license); Elastic Cloud is billed per the vendor's plans.