Skip to main content
Glama
ggilligan12

kibana-mcp

by ggilligan12
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python

Kibana MCP Server

Kibana MCP Demo

Model Context Protocol (MCP) server for Kibana Security - manage alerts, rules, and exceptions via AI assistants.

Quick Start

1. Clone and Build

git clone https://github.com/ggilligan12/kibana-mcp.git
cd kibana-mcp
docker build -t kibana-mcp .

2. Configure MCP Client

Add to your MCP client config (Claude Desktop, Cursor, etc.):

Option A: Using Environment Variables (Recommended)

First, set your credentials:

export KIBANA_URL="https://your-kibana.example.com:5601"

# Option 1: API Key (recommended)
export KIBANA_API_KEY="your_base64_api_key"

# Option 2: Username/Password
# export KIBANA_USERNAME="your_username"
# export KIBANA_PASSWORD="your_password"

Then add to your MCP config:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_API_KEY", "kibana-mcp"]
    }
  }
}

For username/password, use:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_USERNAME", "-e", "KIBANA_PASSWORD", "kibana-mcp"]
    }
  }
}

Option B: Direct Credentials (Easier for Claude Desktop)

Using API Key:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_API_KEY=your_base64_api_key",
        "kibana-mcp"
      ]
    }
  }
}

Using Username/Password:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_USERNAME=your_username",
        "-e", "KIBANA_PASSWORD=your_password",
        "kibana-mcp"
      ]
    }
  }
}

Note: Option B is less secure but more convenient for tools like Claude Desktop where environment variables are harder to manage.

Related MCP server: Kibana MCP Server

Available Tools

  • get_alerts - Fetch security alerts

  • tag_alert - Add tags to alerts

  • adjust_alert_status - Change alert status (open/acknowledged/closed)

  • find_rules - Search detection rules

  • get_rule_exceptions - Get rule exception items

  • add_rule_exception_items - Add exceptions to rules

  • create_exception_list - Create new exception lists

  • associate_shared_exception_list - Link exception lists to rules

Local Development

# Install dependencies
uv sync

# Set environment variables (see above)

# Run locally
uv run kibana-mcp

Test Environment

# Start local Kibana/Elasticsearch with test data
pip install -r testing/requirements-dev.txt
./testing/quickstart-test-env.sh

# Access at http://localhost:5601 (elastic/elastic)

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Meilisearch MCP Server

    devlimelabs
    A
    license
    B
    quality
    D
    maintenance
    Enables AI assistants to interact with Meilisearch via the Model Context Protocol, allowing comprehensive index, document, and search management through a standardized interface.
    68
    7 npm
    11
    MIT

  • Kibana MCP Server

    jerrelblankenship
    A
    license
    B
    quality
    D
    maintenance
    Enables AI assistants to interact with Kibana dashboards, visualizations, and Elasticsearch data through read-only resources and executable tools for searching logs, exporting dashboards, and querying data.
    7
    17 npm
    3
    MIT

  • Kibana Dashboard Builder

    brienhackney
    F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to create and manage Kibana dashboards, Lens visualizations, and data views via the Kibana Saved Objects API. It allows for programmatically listing existing resources and assembling new visualizations into dashboards through natural language commands.
    -

  • mcp-server-splunk

    pahar0
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to search, manage, and analyze data in Splunk instances through the Model Context Protocol. Supports SPL queries, index management, alerts, dashboards, and more.
    1
    Apache 2.0