Kibana MCP Server: Kibana from Claude and Cursor
Kibana MCP Server
A Kibana MCP server: dashboards, saved objects and Elasticsearch log search through natural language, with an API key or login
- 86 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The agent reads logs that may contain personal data and tokens
- The tools update and bulk delete dashboards and other saved objects
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/kibana-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent reads logs that may contain personal data and tokens
- The tools update and bulk delete dashboards and other saved objects
This is third-party code. Review the repository files before installing.
What it does
The server connects an MCP client such as Claude Desktop to your Kibana. It is built on the Kibana API description from the Elastic Stack 8.x documentation in OpenAPI format, so it can find endpoints by description, show their details and run arbitrary requests with `execute_kb_api`. Dedicated tools work with saved objects: dashboards, visualizations, index patterns, Lens, maps, tags and Canvas. They search, read, create, update, bulk update and bulk delete. Analysis tools show an object's dependencies, the impact of deleting it and dashboard health, including a batch check of all dashboards at once. `search_elasticsearch` searches documents, logs and aggregations in Elasticsearch through Kibana's search route within the user's index privileges. Transport is stdio or HTTP, sign-in is by API key, username and password, or session cookie, and Kibana spaces and a custom CA certificate are supported.
Who it is for. Observability engineers, SREs and analysts who work with dashboards and logs in Kibana and want to do it from Claude Desktop or Cursor.
Good fit when
- You need errors from one service in the logs for the last hour
- Before deleting a dashboard you check what it references and what will break
- You want to scan all dashboards and find the broken ones
- Saved objects need a bulk update after an index rename
Not a fit when
- You need direct Elasticsearch access with document writes: the same author has a separate Elasticsearch server
- The agent must not change dashboards: some tools update and bulk delete, and limiting that takes a Kibana account with fewer rights
- Your Kibana is older than 8.x: the API description comes from Elastic Stack 8.x
Example request
Find errors for the payment service in Kibana for the last hour and show the five most frequent messages.MCP
- Transport
- stdio, http
- Authentication
- key is optional
Environment variables
KIBANA_URLrequired- Kibana server address
KIBANA_API_KEYsecret- API key, the preferred sign-in method
KIBANA_USERNAME- Username for password sign-in
KIBANA_PASSWORDsecret- Password for password sign-in
KIBANA_COOKIESsecret- Session cookies as the third sign-in method
Limitations
The project is community-maintained and is not an Elastic product. You need a Kibana address and one sign-in method: API key (first priority), username and password, or a session cookie. The account needs rights to write and delete objects.
HTTP mode has no protection by default beyond binding to `localhost`: every session acts with the credentials the server was started with. For access from outside set `MCP_BEARER_TOKEN`, otherwise with address `0.0.0.0` anyone who can reach the port gets access to your Kibana.
How to disable. Remove the `kibana` entry from `claude_desktop_config.json` and, if needed, revoke the API key in Kibana. In HTTP mode stop the server process.
FAQ
How do I connect Kibana MCP Server to Claude Desktop?
Add an entry to `claude_desktop_config.json` with the command `npx` and the argument `@tocharianou/mcp-server-kibana`, and set `KIBANA_URL` and `KIBANA_API_KEY` in env.
Which sign-in methods are supported?
API key, username with password and session cookie. If several are set, the priority order is key, login, cookie.
Can the agent search Elasticsearch logs?
Yes, with `search_elasticsearch`. It is read-only and acts within the user's index privileges, and a wildcard-only index such as `*` and a size above 100 are rejected.
How do I secure HTTP mode?
By default it listens on `localhost` only. For remote clients set `MCP_BEARER_TOKEN`: clients must send an Authorization header with that token.
Is the project affiliated with Elastic?
No. The community maintains it, and it builds on the published Kibana API description.
Discussion
No questions or reviews yet.
Related
MCP serversGrafana MCP Server
Grafana MCP server
Grafana's official MCP server: dashboards, Prometheus and Loki queries, alerts and incidents straight from the agent
Datadog's official managed MCP server: logs, metrics, traces and incidents right in your agent
An MCP server and skills on top of Kubernetes network observability: an agent investigates incidents and queries cluster traffic through an eBPF-built index
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
Datadog MCP Server (winor30)
Datadog MCP Server
Independent Datadog MCP server: an agent reads incidents, monitors, logs, metrics, traces and RUM and schedules downtimes.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Kibana MCP Server: Kibana from Claude and Cursor (this card) | no | key is optional | 86 | |
| Elasticsearch/OpenSearch MCP Server | no | key is optional | 317 | works with Elasticsearch and OpenSearch directly, with no Kibana layer |
| Grafana MCP Server | yes | API key | 3,663 | Grafana dashboards and data |
README in short
The README gives installation from npm and source, launch examples with a key, login and cookie, an HTTP mode with protection and a table of environment variables. Below it lists base tools, saved object handling, dependency analysis and examples of natural-language requests.