elasticsearch-investigation-mcp
by Edrient17
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ES_URL | Yes | Elasticsearch address (e.g., http://elasticsearch.example.com:9200) | |
| MCP_HOST | No | Bind address for the MCP server process | |
| ES_API_KEY | Yes | Base64-encoded API key (id:secret) with read and view_index_metadata permissions on the log index | |
| ES_HOST_FIELD | No | Field containing the host name, must match Zabbix's host name | host.name |
| ES_MESSAGE_FIELD | No | Field containing the raw log message | message |
| ES_SERVICE_FIELD | No | Field containing the service name | service.name |
| ES_MCP_AUTH_TOKEN | Yes | Bearer token for MCP clients to authenticate | |
| MCP_ALLOWED_HOSTS | No | Comma-separated list of allowed Host headers to defend against DNS rebinding | |
| ES_TIMESTAMP_FIELD | No | Field containing the log timestamp | @timestamp |
| INVESTIGATION_MAX_SHAPES | No | Maximum number of message shapes | 25 |
| ES_ALLOWED_INDEX_PATTERNS | No | Comma-separated list of allowed index patterns. Only '*' is a wildcard, '.' is literal. If empty, all indices allowed by the API key are used. | |
| INVESTIGATION_MAX_FUTURE_HOURS | No | Maximum allowed future time offset (in hours) before treating queries as errors | 2 |
| INVESTIGATION_MAX_WINDOW_HOURS | No | Maximum time span (in hours) a single call can cover | 26 |
| INVESTIGATION_MAX_MESSAGE_CHARS | No | Maximum number of characters for a single message | 600 |
| INVESTIGATION_MAX_RETURNED_LINES | No | Maximum number of log lines returned | 100 |
| INVESTIGATION_MAX_FETCH_DOCUMENTS | No | Maximum number of documents to fetch from Elasticsearch for one answer | 10000 |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Edrient17/elasticsearch-investigation-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server