Skip to main content
Glama
mshegolev

mshegolev/kibana-mcp

by mshegolev

kibana-mcp

PyPI version Python 3.10+ License: MIT Tests

MCP server for Kibana / Elasticsearch — log search, aggregations, index discovery, and dashboard browsing via Claude and any MCP-compatible agent.

Why another Kibana MCP?

Existing integrations require a running Kibana instance with browser-level credentials and often wrap the Kibana UI rather than the stable REST APIs. This server:

  • Hits Elasticsearch REST API directly for log queries (faster, stable across Kibana UI changes)

  • Falls back to the Kibana Console proxy when no direct ES URL is configured (zero extra firewall rules)

  • Supports ApiKey auth (best for agents) as well as Basic auth and anonymous access

  • Returns both structured JSON (outputSchema) and markdown text so it works with any MCP client

  • Is read-only — all tools carry readOnlyHint: true, no data is modified

Related MCP server: Elastic MCP Server

Tools

Tool

API

Description

kibana_list_indices

GET ES/_cat/indices

Discover available indices with health, docs, size

kibana_search_logs

POST ES/{index}/_search

Full-text log search with time range, sort, size

kibana_aggregate_logs

POST ES/{index}/_search

Terms grouping with count/avg/sum/min/max metric

kibana_list_dashboards

GET Kibana/api/saved_objects/_find

List saved dashboards with search + pagination

kibana_get_dashboard

GET Kibana/api/saved_objects/dashboard/{id}

Fetch one dashboard with panel breakdown

Installation

pip install kibana-mcp

Or run directly with uvx:

uvx kibana-mcp

Configuration

Environment Variables

Variable

Required

Description

KIBANA_URL

Yes

Kibana base URL (e.g. https://kibana.example.com)

ELASTICSEARCH_URL

No

Direct ES endpoint. If unset, ES requests go through Kibana Console proxy

KIBANA_API_KEY

No

ES API key (ApiKey base64(id:api_key) format). Recommended for agents

KIBANA_USERNAME

No

HTTP Basic auth username (used if API key not set)

KIBANA_PASSWORD

No

HTTP Basic auth password

KIBANA_SSL_VERIFY

No

true (default) or false for self-signed certificates

Auth priority: ApiKey > Basic > anonymous.

Copy .env.example to .env and fill in your values.

MCP Client Configuration (Claude Desktop / claude.app)

{
  "mcpServers": {
    "kibana": {
      "command": "uvx",
      "args": ["kibana-mcp"],
      "env": {
        "KIBANA_URL": "https://kibana.example.com",
        "KIBANA_API_KEY": "your-api-key-here"
      }
    }
  }
}

Or with direct ES access for better performance:

{
  "mcpServers": {
    "kibana": {
      "command": "uvx",
      "args": ["kibana-mcp"],
      "env": {
        "KIBANA_URL": "https://kibana.example.com",
        "ELASTICSEARCH_URL": "https://es.example.com:9200",
        "KIBANA_API_KEY": "your-api-key-here"
      }
    }
  }
}

Docker

docker run --rm -i \
  -e KIBANA_URL=https://kibana.example.com \
  -e KIBANA_API_KEY=your-key \
  ghcr.io/mshegolev/kibana-mcp

Usage Examples

Find the last 50 ERROR logs from the API service in the last hour

kibana_search_logs(index="logs-*", query="level:ERROR AND service:api", size=50, time_from="2026-04-18T09:00:00Z")

Show 500 HTTP errors sorted oldest first for incident replay

kibana_search_logs(index="nginx-*", query="status:500", sort_order="asc", size=100)

Aggregations

How many logs per log level in the last hour?

kibana_aggregate_logs(index="logs-*", group_by="level", time_from="2026-04-18T09:00:00Z")

What is the average response time per service?

kibana_aggregate_logs(index="logs-*", group_by="service.keyword", metric="avg", metric_field="response_time_ms")

Index Discovery

What log indices are available?

kibana_list_indices()

Show me all filebeat indices

kibana_list_indices(pattern="filebeat-*")

Dashboards

Find the infrastructure dashboard

kibana_list_dashboards(search="infrastructure")

What panels does dashboard X have?

kibana_get_dashboard(dashboard_id="<id from list_dashboards>")

Performance Characteristics

  • Log search (kibana_search_logs): typically 50-500ms with direct ES URL; add 100-200ms when routing through Kibana Console proxy

  • Aggregations (kibana_aggregate_logs): size:0 queries — no hits transferred, usually 10-100ms

  • Index listing: single _cat/indices call, O(index_count) response, typically <100ms

  • Dashboard APIs: Kibana Saved Objects API, typically 50-200ms; latency is Kibana-side, not network

  • Set ELASTICSEARCH_URL directly if your agent does frequent log searches — eliminates the proxy overhead

Development

git clone https://github.com/mshegolev/kibana-mcp
cd kibana-mcp
pip install -e '.[dev]'
pytest tests/ -v
ruff check src tests
ruff format src tests

License

MIT — see LICENSE.

Available Tools

5 tools
kibana_aggregate_logsA
Read-onlyIdempotent

Aggregate logs using a terms grouping and optional metric.

Wraps POST {ES_URL}/{index}/_search with size:0 (no hits returned) and a terms aggregation on group_by. This is the efficient way to get counts, averages, or sums grouped by a field value.

When more than 20 buckets are rendered in the text output, a truncation hint is appended — use the structured buckets field for the full list.

Examples: - Use when: "How many logs per log level in the last hour?" → index='logs-*', group_by='level', time_from='2026-04-18T09:00:00Z'. - Use when: "What is the average response time per service?" → group_by='service.keyword', metric='avg', metric_field='response_time_ms'. - Use when: "Top 10 HTTP status codes today." → group_by='http.response.status_code', size=10. - Don't use when: You need raw log content/messages — use kibana_search_logs which returns full _source objects. - Don't use when: You need time-series (histogram per interval) — that requires a date_histogram aggregation not supported here.

Returns: dict with total_documents / took_ms / buckets (list).

ParametersJSON Schema
NameRequiredDescriptionDefault
indexYesElasticsearch index name or pattern (e.g. 'logs-*').
group_byYesField name for terms aggregation (e.g. 'level', 'service.keyword', 'http.response.status_code'). For text fields use the '.keyword' sub-field.
queryNoElasticsearch Query String Syntax filter applied before aggregation. Use '*' (default) to aggregate all documents, or narrow with e.g. 'service:api'.*
metricNoAggregation metric: 'count' (default, doc_count per bucket), 'avg', 'sum', 'min', 'max' (require metric_field).count
metric_fieldNoField to apply the metric on. Required when metric is 'avg', 'sum', 'min', or 'max'. Example: 'response_time_ms' for avg latency per service.
time_fieldNoName of the timestamp field.@timestamp
time_fromNoStart of time range. ISO-8601 or epoch-ms.
time_toNoEnd of time range. ISO-8601 or epoch-ms.
sizeNoNumber of terms buckets to return (1-100, default 10).

Output Schema

ParametersJSON Schema
NameRequiredDescription
total_documentsYes
took_msYes
indexYes
group_byYes
metricYes
metric_fieldYes
buckets_countYes
bucketsYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds that the tool wraps a POST request with size:0 (no hits), truncates output beyond 20 buckets with a hint, and returns a structured dict. It also notes efficiency for grouped stats, going beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized into an opening summary, technical detail, examples with when-to-use sections, and return format. It uses bullet points and concise language without redundancy. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's 9 parameters, full schema coverage, explicit annotations, and output schema description ('total_documents, took_ms, buckets'), the description is complete. It covers all necessary context for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% coverage with descriptions for all 9 parameters. The description further clarifies parameter roles through concrete examples (e.g., using time_from, group_by, metric_field), adding value beyond the schema. Baseline 3, plus 1 for enhanced semantics via examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action: 'Aggregate logs using a terms grouping and optional metric.' It clearly identifies the resource (logs) and method (terms aggregation). The description distinguishes this tool from siblings by mentioning kibana_search_logs for raw logs and noting that date_histogram is not supported, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided with multiple 'Use when' and 'Don't use when' examples. It names the alternative tool (kibana_search_logs) for raw logs and explains what aggregation type is not supported (date_histogram). This helps the agent decide correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kibana_get_dashboardA
Read-onlyIdempotent

Fetch a single Kibana dashboard with panel details.

Calls GET {KIBANA_URL}/api/saved_objects/dashboard/{id}. Returns the dashboard metadata and a summary of contained panels (visualisations, controls, maps, etc.).

Examples: - Use when: "What panels does the 'Infrastructure Overview' dashboard have?" → obtain the ID from kibana_list_dashboards, then call with dashboard_id=<id>. - Use when: "Give me the description and panel count of dashboard X." → single call, no search needed if you have the ID. - Use when: Verifying that a dashboard ID from a URL or bookmark is valid. - Don't use when: You don't have the dashboard ID — call kibana_list_dashboards first with a search term. - Don't use when: You need log data shown in the dashboard — dashboards contain visualisation config only. Use kibana_search_logs / kibana_aggregate_logs for actual data.

Returns: dict with id / title / description / panels_count / panels (list) / updated_at.

ParametersJSON Schema
NameRequiredDescriptionDefault
dashboard_idYesKibana dashboard UUID (e.g. 'abcd1234-5678-efgh-ijkl-mnopqrstuvwx'). Use `kibana_list_dashboards` to discover valid IDs.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
titleYes
descriptionYes
panels_countYes
panelsYes
updated_atYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds behavioral context by stating it makes a GET request, returns dashboard metadata and panel summary, and does not return log data. This goes beyond annotations by clarifying the output nature and API call, but could mention potential error cases (e.g., ID not found) for slightly higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-line summary, the API call, return structure, and usage examples. Every sentence adds necessary information without redundancy. It is front-loaded with the key action and includes bullet-point examples for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, output schema present), the description covers all necessary aspects: what it does, when to use it, what it returns (including specific fields like panels_count), and what it does not do (log data). It is complete for an agent to invoke correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides a full description for the single parameter 'dashboard_id', including format and a hint to use 'kibana_list_dashboards' for discovery. The tool description reinforces this hint with examples, adding value by showing how to obtain the ID. Since schema coverage is 100% and the description adds contextual usage, a 4 is appropriate, slightly above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch a single Kibana dashboard with panel details.' and distinguishes itself from siblings like 'kibana_list_dashboards' (which lists dashboards) and 'kibana_search_logs' (which searches logs). It specifies the verb 'fetch' and the resource 'Kibana dashboard', making the purpose explicit and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use when' examples (e.g., to get panels of a specific dashboard) and 'Don't use when' examples (e.g., when missing the ID or needing log data), directing users to alternative tools like 'kibana_list_dashboards' and 'kibana_search_logs'. This clearly differentiates when to use this tool versus its siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kibana_list_dashboardsA
Read-onlyIdempotent

List Kibana saved dashboards.

Calls GET {KIBANA_URL}/api/saved_objects/_find?type=dashboard. The kbn-xsrf: true header is always sent to satisfy Kibana's CSRF guard. Use this to discover dashboard IDs before calling kibana_get_dashboard.

Pagination: if has_more is True, call again with page + 1.

Examples: - Use when: "What Kibana dashboards are available?" → default params. - Use when: "Find the infrastructure dashboard." → search='infrastructure'. - Use when: "List all dashboards — page 2." → page=2. - Don't use when: You already have a dashboard ID — use kibana_get_dashboard directly (one fewer round trip). - Don't use when: You need log content — dashboards contain visualisation config, not raw log data. Use kibana_search_logs.

Returns: dict with total / page / page_size / has_more / dashboards (list of {id, title, description, updated_at}).

ParametersJSON Schema
NameRequiredDescriptionDefault
searchNoOptional text search in dashboard titles (case-insensitive substring match).
pageNoPage number (1-based).
page_sizeNoItems per page (1-100, default 20).

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalYes
pageYes
page_sizeYes
has_moreYes
searchYes
dashboardsYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds valuable context: the kbn-xsrf header requirement, pagination details (has_more, page+1), and return format. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with clear sections (endpoint, header, pagination, examples, return format). Every sentence adds value and it is appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, annotations, and output schema presence, the description covers all necessary aspects: pagination, search filtering, when to use, and return format. Complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% description coverage, so the description adds minimal value beyond schema. It provides example usage for search and page parameters, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'List Kibana saved dashboards' and provides the HTTP endpoint. Examples distinguish this from sibling tools like kibana_get_dashboard and kibana_search_logs, making the purpose extremely clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'Use when' and 'Don't use when' examples, referencing sibling tools by name and explaining exactly when to choose this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kibana_list_indicesA
Read-onlyIdempotent

List available Elasticsearch indices.

Calls GET {ES_URL}/_cat/indices?format=json and returns a structured list of indices with health, status, document count, and storage size. Use this first to discover which index names / patterns exist before calling kibana_search_logs or kibana_aggregate_logs.

Examples: - Use when: "What log indices are available in Elasticsearch?" → default params, pattern='*'. - Use when: The user mentions a service name but not the index. Try pattern='logs-myservice-*' to narrow down. - Use when: "How many documents in the access-log index?" → pattern='access-log*', check docs_count. - Don't use when: You already know the index name — pass it directly to kibana_search_logs (saves one round trip). - Don't use when: You need to search log content — that's kibana_search_logs.

Returns: dict with keys indices_count / pattern / include_system / indices (list of {index, health, status, docs_count, store_size_bytes, size_human}).

ParametersJSON Schema
NameRequiredDescriptionDefault
patternNoIndex name or pattern to filter results (e.g. 'logs-*', 'filebeat-*'). Supports Elasticsearch wildcard syntax. Default '*' lists all non-system indices.*
include_systemNoWhether to include system/internal indices. Hidden by default: any prefix in {'.', 'kibana', 'ilm-history', 'shrink-'} — covers Kibana internals, ILM history, and shrunk index leftovers.

Output Schema

ParametersJSON Schema
NameRequiredDescription
indices_countYes
patternYes
include_systemYes
indicesYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant value beyond annotations by detailing the HTTP method (GET), endpoint, and the exact structure of the return value. Annotations already indicate read-only and idempotent, but the description enriches with concrete behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with bullet points and examples, but it is somewhat lengthy and repeats some return format details. It is front-loaded with the main action and every sentence adds value, though could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description appropriately summarizes the return keys. It covers the tool's purpose, parameters, usage context, and behavioral details, making it fully complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% coverage with detailed parameter descriptions. The description adds value through examples and usage context, such as default pattern and how to narrow down, going beyond the schema. Baseline 3 increased to 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists available Elasticsearch indices, specifies the exact API call, and distinguishes it from sibling tools like kibana_search_logs and kibana_aggregate_logs. It uses specific verbs and resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use and when-not-to-use scenarios, including examples of when to use with specific patterns and when to skip and directly use kibana_search_logs. This provides clear guidance on tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kibana_search_logsA
Read-onlyIdempotent

Search logs using Elasticsearch Query String Syntax.

Wraps POST {ES_URL}/{index}/_search with a bool/must query. Returns the top matching log entries with their _source fields.

When more than 20 hits are rendered in the text output, a truncation hint is appended — use the structured hits field for the full list.

Examples: - Use when: "Show me the last 20 ERROR logs from the API service." → index='logs-*', query='level:ERROR AND service:api'. - Use when: "Find 'connection refused' errors in the last hour." → query='message:"connection refused"', time_from='2026-04-18T09:00:00Z', time_to='2026-04-18T10:00:00Z'. - Use when: "Show me 500 errors sorted oldest first for replay." → query='status:500', sort_order='asc'. - Don't use when: You want counts / statistics per field value — use kibana_aggregate_logs instead (size:0 aggregation is much cheaper than retrieving full log documents). - Don't use when: You need more than 500 docs — ES caps size at 500 via this tool; use scroll API directly for bulk export.

Returns: dict with total / returned / took_ms / hits (list).

ParametersJSON Schema
NameRequiredDescriptionDefault
indexYesElasticsearch index name or pattern (e.g. 'logs-*', 'filebeat-2026.04.18'). Use `kibana_list_indices` to discover available indices.
queryYesElasticsearch Query String Syntax. Examples: 'level:ERROR', 'level:ERROR AND service:api', 'message:"connection refused" AND host:db*', 'status:[500 TO 599]'. Use '*' to match all documents.
time_fieldNoName of the timestamp field. Default '@timestamp' (Logstash/Filebeat convention).@timestamp
time_fromNoStart of the time range. ISO-8601 (e.g. '2026-04-18T00:00:00Z') or epoch-ms (e.g. '1713398400000'). Omit for unbounded start.
time_toNoEnd of the time range. ISO-8601 or epoch-ms. Omit for unbounded end (searches up to now).
sizeNoMaximum number of log hits to return (1-500, default 20).
sort_orderNoSort order for results: 'desc' (newest first, default) or 'asc' (oldest first).desc

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalYes
returnedYes
took_msYes
indexYes
queryYes
time_fromYes
time_toYes
sort_orderYes
hitsYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and idempotentHint. The description adds specific behavioral details: the bool/must query structure, truncation hint for >20 hits, return format (total/returned/took_ms/hits), and the ES size cap. This is informative but not exhaustive (e.g., no explicit pagination guidance beyond size cap).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with main purpose, technical detail, truncation note, examples, and exclusions. Though a bit lengthy, every section serves a purpose and the information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool complexity (7 parameters, ES integration, truncation, size limits) and the richness of schema/annotations/output schema (return dict described), the description covers all critical aspects: purpose, usage guidelines with examples, behavioral traits, limits, and return structure. No major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 7 parameters have schema descriptions (100% coverage), so baseline is 3. The description adds value by providing real-world examples that illustrate parameter usage (e.g., query syntax, time range formats, sort_order), enhancing understanding beyond the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches logs using ES Query String Syntax, identifies the specific operation (wrapping a POST _search with bool/must), and distinguishes from sibling tools like kibana_aggregate_logs via explicit 'Don't use when' examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Multiple 'Use when' examples with concrete parameter values, plus explicit 'Don't use when' scenarios directing to kibana_aggregate_logs for aggregations or scroll API for >500 docs, providing clear alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.1
    • First observedkibana_aggregate_logs
    • First observedkibana_get_dashboard
    • First observedkibana_list_dashboards
    • First observedkibana_list_indices
    • First observedkibana_search_logs

TDQS

A4.7/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a distinct purpose: log aggregation, dashboard retrieval, dashboard listing, index listing, and log search. Descriptions explicitly clarify when not to use each tool, leaving no ambiguity.

Naming Consistency5/5

All tools follow a consistent 'kibana_verb_noun' pattern (e.g., aggregate_logs, get_dashboard). The naming is uniform and predictable across the entire set.

Tool Count5/5

Five tools is well-suited for the domain of Kibana log analysis and dashboard exploration. Each tool earns its place without being excessive or insufficient.

Completeness4/5

The tool set covers the primary read operations: index discovery, log search, log aggregation, dashboard list, and dashboard details. Missing write/update capabilities, but for a focused read-only MCP, this is reasonable and does not leave critical gaps.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    An MCP server that enables interaction with Elasticsearch and OpenSearch clusters for searching documents and managing indices. It provides tools for cluster health monitoring, index configuration, and general API requests.
    16
    Apache 2.0
  • A
    license
    A
    quality
    D
    maintenance
    Read-only MCP server for exploring and searching OpenSearch clusters, enabling log analysis, index exploration, and query execution.
    8
    MIT
  • A
    license
    B
    quality
    D
    maintenance
    Small production-oriented MCP server for diagnosing incidents from Elasticsearch logs with unknown schema. It provides tools for log discovery, retrieval, and issue diagnosis.
    6
    MIT