Kibana Mcp

io.github.mshegolevPublished by GitHub account mshegolevv0.1.1Updated Oct 25, 2026

Kibana/Elasticsearch MCP — log search, aggregations, index discovery, dashboards.

VerifiedSTDIODesktop onlySecurity & MonitoringData & Analytics

Overview

AI-generated overview

Read-only MCP server for Kibana and Elasticsearch that lets an assistant search logs, run aggregations, list indices and browse dashboards.

What you can do
List indices with health, document counts and size, optionally filtered by pattern. Search logs in an index with full-text query, time range, sort order and result size. Aggregate logs by a field with count, average, sum, minimum or maximum metrics. List saved dashboards with search and pagination, and fetch one dashboard with its panel breakdown. Results come back as structured JSON and markdown text.
When to use it
Useful when an assistant needs to investigate logs, count errors by level or service, find which indices exist, or look up Kibana dashboards during debugging or incident review, without opening the Kibana UI.
Requirements
Runs locally as a Python package (pip install kibana-mcp or uvx kibana-mcp), or as a Docker image. Requires KIBANA_URL; optional ELASTICSEARCH_URL for direct Elasticsearch access, otherwise requests go through the Kibana Console proxy. Authentication uses KIBANA_API_KEY, or KIBANA_USERNAME with KIBANA_PASSWORD, or anonymous access. KIBANA_SSL_VERIFY can be set to false for self-signed certificates. Network access to the Kibana or Elasticsearch host is needed.
Before you install
Requires credentials for your Kibana or Elasticsearch instance: KIBANA_API_KEY or KIBANA_PASSWORD are secrets and should be supplied through environment variables, not committed. Setting KIBANA_SSL_VERIFY to false disables certificate checks. The server is described as read-only, but the credentials it holds may grant broader access than the tools use, so scope the API key accordingly. Log data is sent to the assistant's model provider as part of tool results.

Installation

In SourceWeft

  1. Open Kibana Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

kibana-mcp

[PyPI version] [Python 3.10+] [License: MIT] [Tests]

MCP server for Kibana / Elasticsearch — log search, aggregations, index discovery, and dashboard browsing via Claude and any MCP-compatible agent.

Why another Kibana MCP?

Existing integrations require a running Kibana instance with browser-level credentials and often wrap the Kibana UI rather than the stable REST APIs. This server:

  • Hits Elasticsearch REST API directly for log queries (faster, stable across Kibana UI changes)
  • Falls back to the Kibana Console proxy when no direct ES URL is configured (zero extra firewall rules)
  • Supports ApiKey auth (best for agents) as well as Basic auth and anonymous access
  • Returns both structured JSON (outputSchema) and markdown text so it works with any MCP client
  • Is read-only — all tools carry readOnlyHint: true, no data is modified

Tools

ToolAPIDescription
kibana_list_indicesGET ES/_cat/indicesDiscover available indices with health, docs, size
kibana_search_logsPOST ES/{index}/_searchFull-text log search with time range, sort, size
kibana_aggregate_logsPOST ES/{index}/_searchTerms grouping with count/avg/sum/min/max metric
kibana_list_dashboardsGET Kibana/api/saved_objects/_findList saved dashboards with search + pagination
kibana_get_dashboardGET Kibana/api/saved_objects/dashboard/{id}Fetch one dashboard with panel breakdown

Installation

bash
pip install kibana-mcp

Or run directly with uvx:

bash
uvx kibana-mcp

Configuration

Environment Variables

VariableRequiredDescription
KIBANA_URLYesKibana base URL (e.g. https://kibana.example.com)
ELASTICSEARCH_URLNoDirect ES endpoint. If unset, ES requests go through Kibana Console proxy
KIBANA_API_KEYNoES API key (ApiKey base64(id:api_key) format). Recommended for agents
KIBANA_USERNAMENoHTTP Basic auth username (used if API key not set)
KIBANA_PASSWORDNoHTTP Basic auth password
KIBANA_SSL_VERIFYNotrue (default) or false for self-signed certificates

Auth priority: ApiKey > Basic > anonymous.

Copy .env.example to .env and fill in your values.

MCP Client Configuration (Claude Desktop / claude.app)

json
{  "mcpServers": {    "kibana": {      "command": "uvx",      "args": ["kibana-mcp"],      "env": {        "KIBANA_URL": "https://kibana.example.com",        "KIBANA_API_KEY": "your-api-key-here"      }    }  }}

Or with direct ES access for better performance:

json
{  "mcpServers": {    "kibana": {      "command": "uvx",      "args": ["kibana-mcp"],      "env": {        "KIBANA_URL": "https://kibana.example.com",        "ELASTICSEARCH_URL": "https://es.example.com:9200",        "KIBANA_API_KEY": "your-api-key-here"      }    }  }}

Docker

bash
docker run --rm -i \  -e KIBANA_URL=https://kibana.example.com \  -e KIBANA_API_KEY=your-key \  ghcr.io/mshegolev/kibana-mcp

Usage Examples

Log Search

Find the last 50 ERROR logs from the API service in the last hour

→ kibana_search_logs(index="logs-*", query="level:ERROR AND service:api", size=50, time_from="2026-04-18T09:00:00Z")

Show 500 HTTP errors sorted oldest first for incident replay

→ kibana_search_logs(index="nginx-*", query="status:500", sort_order="asc", size=100)

Aggregations

How many logs per log level in the last hour?

→ kibana_aggregate_logs(index="logs-*", group_by="level", time_from="2026-04-18T09:00:00Z")

What is the average response time per service?

→ kibana_aggregate_logs(index="logs-*", group_by="service.keyword", metric="avg", metric_field="response_time_ms")

Index Discovery

What log indices are available?

→ kibana_list_indices()

Show me all filebeat indices

→ kibana_list_indices(pattern="filebeat-*")

Dashboards

Find the infrastructure dashboard

→ kibana_list_dashboards(search="infrastructure")

What panels does dashboard X have?

→ kibana_get_dashboard(dashboard_id="<id from list_dashboards>")

Performance Characteristics

  • Log search (kibana_search_logs): typically 50-500ms with direct ES URL; add 100-200ms when routing through Kibana Console proxy
  • Aggregations (kibana_aggregate_logs): size:0 queries — no hits transferred, usually 10-100ms
  • Index listing: single _cat/indices call, O(index_count) response, typically <100ms
  • Dashboard APIs: Kibana Saved Objects API, typically 50-200ms; latency is Kibana-side, not network
  • Set ELASTICSEARCH_URL directly if your agent does frequent log searches — eliminates the proxy overhead

Development

bash
git clone https://github.com/mshegolev/kibana-mcpcd kibana-mcppip install -e '.[dev]'pytest tests/ -vruff check src testsruff format src tests

License

MIT — see LICENSE.

Source: README.md at commit b1c596c

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts