Elasticsearch MCP Server

What is Elasticsearch MCP Server?

The Elasticsearch MCP Server connects AI agents to Elasticsearch data using the Model Context Protocol (MCP), enabling natural language interactions with indices for querying, analysis, and retrieval without custom APIs. This server is deprecated and will only receive critical security updates; it has been superseded by the Elastic Agent Builder MCP endpoint (available in Elastic 9.2.0+ and Elasticsearch Serverless).

How to use Elasticsearch MCP Server?

Deploy the server as a Docker container from AWS Marketplace, then configure it to use either the stdio protocol (direct client communication) or the streamable-HTTP protocol (web-based integrations). Set environment variables (ES_URL, ES_API_KEY or ES_USERNAME/ES_PASSWORD) and run with docker run -i --rm docker.elastic.co/mcp/elasticsearch stdio (or http for HTTP mode).

Key features of Elasticsearch MCP Server

• list_indices: List all available Elasticsearch indices
• get_mappings: Get field mappings for a specific index
• search: Execute a query DSL search
• esql: Run an ES|QL query
• get_shards: Obtain shard information for indices
• Supports stdio and streamable-HTTP transports

Use cases of Elasticsearch MCP Server

• Natural language querying of Elasticsearch via AI agents (e.g., Claude Desktop, Cursor, VS Code)
• Automated data retrieval and analysis without creating custom APIs
• Integrating Elasticsearch data into AI-powered workflows and chatbots
• Building search and analytics applications with natural language interfaces

FAQ from Elasticsearch MCP Server

Is the Elasticsearch MCP Server still supported?

This server is deprecated and will only receive critical security updates. It has been superseded by the Elastic Agent Builder MCP endpoint, available in Elastic 9.2.0+ and Elasticsearch Serverless.

How do I authenticate to Elasticsearch?

Set either ES_API_KEY (API key) or both ES_USERNAME and ES_PASSWORD (basic authentication) as environment variables when running the container.

What protocols does the server support?

The server supports stdio (for direct client connections) and streamable-HTTP (for web-based integrations). Server-Sent Events (SSE) is deprecated—use streamable-HTTP instead.

What are the prerequisites to run the server?

You need an Elasticsearch cluster (8.x or 9.x), Docker installed, an MCP client, and network connectivity between the container and your Elasticsearch cluster. Authentication credentials (API key or username/password) are required.

Where does my data reside?

All data remains in your Elasticsearch cluster; the container does not store data locally. The server communicates with Elasticsearch over HTTPS when using an https:// URL.