elasticsearch7-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ES_HOST | Yes | Your Elasticsearch instance URL(s) - supports single URL or comma-separated multiple URLs (also supports legacy HOST) | |
| ES_API_KEY | No | Elasticsearch API key for authentication (also supports legacy API_KEY) | |
| ES_CA_CERT | No | Path to custom CA certificate for Elasticsearch SSL/TLS (also supports legacy CA_CERT) | |
| ES_PASSWORD | No | Elasticsearch password for basic authentication (also supports legacy PASSWORD) | |
| ES_USERNAME | No | Elasticsearch username for basic authentication (also supports legacy USERNAME) | |
| ES_ECS_TOOLS | No | true to also expose the ECS log search tools. Default off. | false |
| ES_ADMIN_TOOLS | No | true to also expose the read-only diagnostic tools. Default off. | false |
| ES_MAX_RETRIES | No | Retries per request. Default 3; 0 disables them. | 3 |
| ES_OAUTH_SCOPE | No | Scope to request, if the provider needs one. | |
| ES_INSTANCE_LABEL | No | Free-text name of this deployment, e.g. production. Shown as the server title, so several instances declared side by side are distinguishable. | |
| ES_OAUTH_AUDIENCE | No | Audience to request. Auth0 needs it to issue a JWT; Keycloak and Azure AD use ES_OAUTH_SCOPE instead. | |
| ES_OAUTH_CLIENT_ID | No | OAuth2 client id. Required once ES_OAUTH_TOKEN_URL is set. | |
| ES_OAUTH_TOKEN_URL | No | OAuth2 token endpoint. Setting it turns on OAuth2, which then takes precedence over the API key and basic auth. Must be https:// (plain http:// is accepted only for localhost). | |
| ES_REQUEST_TIMEOUT | No | Per-request timeout in milliseconds. Default 30000 — raise it if aggregations over many indices time out. | 30000 |
| ES_MAX_RESULT_BYTES | No | Ceiling on one tool result. Default 32768. Past it, detail is omitted and the result says so. | 32768 |
| ES_OAUTH_AUTH_STYLE | No | post (default) sends the credentials in the form body; basic sends them in an HTTP Basic header. | post |
| ES_ALLOW_DESTRUCTIVE | No | true to also expose the irreversible tools. Default off. | false |
| ES_ECS_INDEX_PATTERN | No | Index pattern the ECS log tools query, e.g. logs-app-*. No default: with ES_ECS_TOOLS on and this unset, the server refuses to start. | |
| ES_OAUTH_CLIENT_SECRET | No | OAuth2 client secret. Required once ES_OAUTH_TOKEN_URL is set, unless the _FILE form is used. | |
| ES_OAUTH_CLIENT_SECRET_FILE | No | Path to a file holding the secret, for a mounted Docker secret. Read and trimmed at startup. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_indicesA | List indices, one compact line each: name, health, status, document count and size in bytes. Large results are trimmed and say so. |
| get_mappingsA | List the fields of one index as dotted paths with their types, nested fields included, then the raw mapping. Give a concrete index name: an alias or a wildcard returns nothing. |
| field_capsA | Which fields exist across an index pattern and whether each is searchable and aggregatable. Takes a wildcard, unlike get_mappings, and is the only way to see a field mapped as two different types across indices — which makes an aggregation over it silently partial rather than failing. |
| analyzeA | Show the terms a text is broken into, which is what a query must produce to match. Pass field with index to use the analyzer that index really applies to that field; that is the form that explains a search returning nothing. |
| searchA | Search one index with a query DSL body. Matching text fields are highlighted. Paging goes inside queryBody ( |
| elasticsearch_healthB | Cluster health: status, node counts and shard counts. |
| create_indexA | Create a new index. Fails if it already exists — use create_mapping to add fields to an existing one. |
| create_mappingA | Add or update fields on an index, creating the index if it does not exist. Elasticsearch cannot change the type of an existing field. |
| bulkA | Index up to 1000 documents in one call. The index is refreshed by default, so they are searchable immediately; per-document failures are reported without failing the call. |
| reindexA | Copy documents between indices. Asynchronous: returns a task id at once and the copy is still running on return — poll it with GET _tasks/. |
| create_index_templateA | Create or update a composable index template (Elasticsearch 7.8+). It applies only to indices created after it, never to existing ones. |
| get_index_templateA | Get composable index templates. Omit name to list all. |
| countA | Count the documents matching a query, without transferring any. Cheaper than search when only the number matters. |
| get_documentA | Fetch one document by its _id. Reports that it is absent rather than failing. |
| get_aliasesA | List which aliases point to which indices. A name you query may be an alias, which changes what get_mappings returns. |
| get_taskA | Check an asynchronous task, such as the one reindex returns: progress, completion and failure. |
| cluster_infoA | Cluster name, Elasticsearch version and build flavour. The version decides which query DSL features exist. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Each tool targets a distinct operation or resource: field inspection is split cleanly between get_mappings and field_caps, with explicit notes about wildcard vs concrete index behavior. create_index, create_mapping, bulk, and reindex are also clearly differentiated, so an agent should not confuse them.
Most tools use get_, list_, or create_ prefixes, but bare nouns and verbs like bulk, count, reindex, field_caps, cluster_info, and elasticsearch_health break the verb_noun pattern. Naming is readable and consistently snake_case, but the conventions are mixed.
17 tools is on the heavy side for a single server and makes agent tool selection slightly harder. Each tool does map to a real Elasticsearch operation, so the count is not excessive, but it is borderline.
The surface covers health, mappings, search, indexing, and templates, but lacks delete/update operations for documents and indices, and has no deletion for aliases or templates. This creates significant dead ends for common lifecycle workflows.