Skip to main content
Glama
agrica

elasticsearch7-mcp

by agrica

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
ES_HOSTYesYour Elasticsearch instance URL(s) - supports single URL or comma-separated multiple URLs (also supports legacy HOST)
ES_API_KEYNoElasticsearch API key for authentication (also supports legacy API_KEY)
ES_CA_CERTNoPath to custom CA certificate for Elasticsearch SSL/TLS (also supports legacy CA_CERT)
ES_PASSWORDNoElasticsearch password for basic authentication (also supports legacy PASSWORD)
ES_USERNAMENoElasticsearch username for basic authentication (also supports legacy USERNAME)
ES_ECS_TOOLSNotrue to also expose the ECS log search tools. Default off.false
ES_ADMIN_TOOLSNotrue to also expose the read-only diagnostic tools. Default off.false
ES_MAX_RETRIESNoRetries per request. Default 3; 0 disables them.3
ES_OAUTH_SCOPENoScope to request, if the provider needs one.
ES_INSTANCE_LABELNoFree-text name of this deployment, e.g. production. Shown as the server title, so several instances declared side by side are distinguishable.
ES_OAUTH_AUDIENCENoAudience to request. Auth0 needs it to issue a JWT; Keycloak and Azure AD use ES_OAUTH_SCOPE instead.
ES_OAUTH_CLIENT_IDNoOAuth2 client id. Required once ES_OAUTH_TOKEN_URL is set.
ES_OAUTH_TOKEN_URLNoOAuth2 token endpoint. Setting it turns on OAuth2, which then takes precedence over the API key and basic auth. Must be https:// (plain http:// is accepted only for localhost).
ES_REQUEST_TIMEOUTNoPer-request timeout in milliseconds. Default 30000 — raise it if aggregations over many indices time out.30000
ES_MAX_RESULT_BYTESNoCeiling on one tool result. Default 32768. Past it, detail is omitted and the result says so.32768
ES_OAUTH_AUTH_STYLENopost (default) sends the credentials in the form body; basic sends them in an HTTP Basic header.post
ES_ALLOW_DESTRUCTIVENotrue to also expose the irreversible tools. Default off.false
ES_ECS_INDEX_PATTERNNoIndex pattern the ECS log tools query, e.g. logs-app-*. No default: with ES_ECS_TOOLS on and this unset, the server refuses to start.
ES_OAUTH_CLIENT_SECRETNoOAuth2 client secret. Required once ES_OAUTH_TOKEN_URL is set, unless the _FILE form is used.
ES_OAUTH_CLIENT_SECRET_FILENoPath to a file holding the secret, for a mounted Docker secret. Read and trimmed at startup.

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}

Tools

Functions exposed to the LLM to take actions

NameDescription
list_indicesA

List indices, one compact line each: name, health, status, document count and size in bytes. Large results are trimmed and say so.

get_mappingsA

List the fields of one index as dotted paths with their types, nested fields included, then the raw mapping. Give a concrete index name: an alias or a wildcard returns nothing.

field_capsA

Which fields exist across an index pattern and whether each is searchable and aggregatable. Takes a wildcard, unlike get_mappings, and is the only way to see a field mapped as two different types across indices — which makes an aggregation over it silently partial rather than failing.

analyzeA

Show the terms a text is broken into, which is what a query must produce to match. Pass field with index to use the analyzer that index really applies to that field; that is the form that explains a search returning nothing.

searchA

Search one index with a query DSL body. Matching text fields are highlighted. Paging goes inside queryBody (size, from); size is capped at 100 per call, so page with from for more.

elasticsearch_healthB

Cluster health: status, node counts and shard counts.

create_indexA

Create a new index. Fails if it already exists — use create_mapping to add fields to an existing one.

create_mappingA

Add or update fields on an index, creating the index if it does not exist. Elasticsearch cannot change the type of an existing field.

bulkA

Index up to 1000 documents in one call. The index is refreshed by default, so they are searchable immediately; per-document failures are reported without failing the call.

reindexA

Copy documents between indices. Asynchronous: returns a task id at once and the copy is still running on return — poll it with GET _tasks/.

create_index_templateA

Create or update a composable index template (Elasticsearch 7.8+). It applies only to indices created after it, never to existing ones.

get_index_templateA

Get composable index templates. Omit name to list all.

countA

Count the documents matching a query, without transferring any. Cheaper than search when only the number matters.

get_documentA

Fetch one document by its _id. Reports that it is absent rather than failing.

get_aliasesA

List which aliases point to which indices. A name you query may be an alias, which changes what get_mappings returns.

get_taskA

Check an asynchronous task, such as the one reindex returns: progress, completion and failure.

cluster_infoA

Cluster name, Elasticsearch version and build flavour. The version decides which query DSL features exist.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

A3.7/5.0

Scored across 17 tools

Disambiguation5/5

Each tool targets a distinct operation or resource: field inspection is split cleanly between get_mappings and field_caps, with explicit notes about wildcard vs concrete index behavior. create_index, create_mapping, bulk, and reindex are also clearly differentiated, so an agent should not confuse them.

Naming Consistency3/5

Most tools use get_, list_, or create_ prefixes, but bare nouns and verbs like bulk, count, reindex, field_caps, cluster_info, and elasticsearch_health break the verb_noun pattern. Naming is readable and consistently snake_case, but the conventions are mixed.

Tool Count3/5

17 tools is on the heavy side for a single server and makes agent tool selection slightly harder. Each tool does map to a real Elasticsearch operation, so the count is not excessive, but it is borderline.

Completeness2/5

The surface covers health, mappings, search, indexing, and templates, but lacks delete/update operations for documents and indices, and has no deletion for aliases or templates. This creates significant dead ends for common lifecycle workflows.

Maintenance

ActivityMaintained
ResponsivenessNo issues