Best Elastic MCP Servers
Elastic is a search company that builds self-managed and SaaS offerings for search, logging, security, observability, and analytics use cases.
Why this server?
Allows sending traces to Elastic APM via OpenTelemetry.
AlicenseAqualityAmaintenanceSelf-hosted semantic code search for AI coding agents. Indexes many repositories at once with tree-sitter AST chunking, local llama.cpp embeddings and Qdrant, so Claude Code, Cursor, Codex and any MCP client can find code by meaning, trace usages and callers, and read the git history behind each chunk. No API keys, and your code never leaves your machine.21834MITWhy this server?
Connects to Elastic products, specifically Elasticsearch, enabling natural language interaction with indices, mappings, and search capabilities.
AlicenseBqualityDmaintenanceConnects to Elasticsearch databases using the Model Context Protocol, allowing users to query and interact with their Elasticsearch indices through natural language conversations.42 npmApache 2.0Why this server?
Facilitates interaction with Elastic's search and analytics engine, providing capabilities for document indexing, search, index management, and cluster health monitoring.
AlicenseBqualityDmaintenanceAn MCP server that enables interaction with Elasticsearch and OpenSearch clusters for searching documents and managing indices. It provides tools for cluster health monitoring, index configuration, and general API requests.16Apache 2.0Why this server?
Provides detection lookup files for enrichment in Elasticsearch, enabling efficient threat detection queries using ES|QL ENRICH.
AlicenseAqualityBmaintenanceMachine-readable detection lookups for SIEM enrichment and AI agents. Query 800+ LOLBAS and GTFOBins binaries plus process parent-child baselines — get risk levels, abuse categories, and MITRE ATT\&CK mappings without embedding data in prompts.6Apache 2.0Why this server?
Converts Sigma rules to Elasticsearch Lucene queries for detection in Elasticsearch.
AlicenseAqualityBmaintenanceSigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.32MITWhy this server?
Provides integration with the Elastic Stack to enable read-only log search, aggregation, and analysis across Elasticsearch and Kibana.
AlicenseAqualityDmaintenanceA read-only MCP server that gives AI assistants natural language access to Elasticsearch/Kibana logs for querying and analysis.71MITWhy this server?
Provides access to Elastic UI (EUI), enabling selection and guidance for log search, observability, and data-dense telemetry dashboards.
AlicenseAqualityBmaintenanceEnables AI coding agents to discover, compare, select, and enforce design systems and component libraries, with installation guidance, component APIs, and strict adherence directives to prevent default substitutions.10MITWhy this server?
Integrates with Elastic Security detection rules: lists rules, checks readiness by validating source data, recent data, required fields, and alert volume, files human-approved enable requests, and enables rules only after approval.
AlicenseAqualityCmaintenanceEnables AI agents to check whether Elastic Security detection rules will actually work in an environment by verifying data source, data freshness, field mappings, and alert volume, then filing enable requests. Requests take effect only after a human reviews and approves them, with read-only credentials, tamper checks, and an audit log.4Apache 2.0Why this server?
Provides tools to manage and query a knowledge base within Elastic, including document ingestion, text chunking, and semantic search retrieval.
FlicenseAqualityDmaintenanceAn MCP server that indexes PDF documentation and text into Elasticsearch for semantic search and retrieval. It enables users to query knowledge bases, ingest new files, and dynamically update content through MCP-compatible clients like Claude Desktop and Cursor.41-