Elasticsearch Search & Analytics

elastic

Query Elasticsearch indices with search, ES|QL, mappings, and shard inspection via the official Elasticsearch MCP server.

Installs: 672
Namespace: elastic
Version: >=0.4.0 <1.0.0
Last attach: reviewed1 months ago
Reliability: 83.3% uptime (30d)· validated 2026-06-27

Add to your mcp.json

{
  "mcpServers": {
    "elastic": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "ES_URL",
        "-e",
        "ES_API_KEY",
        "docker.elastic.co/mcp/elasticsearch",
        "stdio"
      ],
      "env": {
        "ES_URL": "<ES_URL>"
      }
    }
  }
}

Open in VS CodeDon't have it? Install FrootAI for VS Code

Attach in a FrootAI play (fai-manifest)

mcp_scope:
  attached:
    - elastic

Authentication

api-keybasic-auth

set ES_URL to your cluster URL and authenticate with an API key (ES_API_KEY, preferred) or basic auth (ES_USERNAME + ES_PASSWORD); scope the key read-only to the target indices.

Required credential: ES_URL

Environment variables

Variable	Required	Auth mode	Description
ES_URL	yes	any	URL of the Elasticsearch cluster (e.g. https://your-cluster.es.cloud:9200). Required to connect; use https:// for TLS in transit.
ES_API_KEY	no	api-key	Elasticsearch API key (preferred). Use a key scoped to read-only access on the target indices; pass via env, never inline in args (doctrine #6).
ES_USERNAME	no	basic-auth	Username for basic authentication (alternative to ES_API_KEY).
ES_PASSWORD	no	basic-auth	Password for basic authentication; pass via env, never inline in args (doctrine #6).
ES_SSL_SKIP_VERIFY	no	any	Set to `true` to skip SSL/TLS certificate verification. Development/testing only — never use against production clusters.

Sample tools

elastic.list_indices
List all available Elasticsearch indices.
elastic.get_mappings
Get field mappings for a specific index.
elastic.search
Run an Elasticsearch search using Query DSL.
elastic.esql
Execute an ES|QL query.
elastic.get_shards
Get shard information for all or specific indices.

Used in recipes

FAI cookbook recipes that attach elastic.

Destructive-action audit

No destructive tools — audited read-only

Destructive-action audit (X2.18): no destructive tools — the server exposes read-only query tools only.

Known limitations

Requires an Elasticsearch cluster URL (ES_URL) plus credentials — an API key (ES_API_KEY) or basic auth (ES_USERNAME/ES_PASSWORD); without them the server cannot reach the cluster.
Distributed as a Docker image (docker.elastic.co/mcp/elasticsearch) — Docker must be installed and running; the legacy npm package is deprecated at 0.3.1.
Read-only over your cluster — list/search/mappings/shards/ES|QL only; no document- or index-mutation tools are exposed.
The standalone server is in maintenance mode (critical security fixes only); Elastic's successor is the Agent Builder MCP endpoint in Elasticsearch 9.2.0+.

Spec contributors

Maintainers who landed commits onmcp-specs/elastic.json.

pspsbali

Freshness

When this spec was last reviewed by a maintainer and last machine-validated against the live server.

Spec last reviewed: 1 months ago(2026-06-25)
Auto-validated: never