mcp-for-kibana
This server exposes Kibana as a set of MCP tools (10 toolboxes, 133 tools) for LLM-driven read, write, and destructive operations against a Kibana 9.4+ deployment.
Dashboards: search/get/create/update dashboards, add/update visualization panels, add ES|QL metric/table/xy panels, and build visualizations from declarative specs.
Visualizations: create reusable library visualizations with charts (line, bar, pie, table, heatmap, map, etc.), aggregations, filters, grouping, and time ranges.
Data management: list/create/describe data views, resolve and create short URLs, and export/import saved objects as NDJSON via handles.
Alerting: manage alerting rules and connectors.
Cases: create cases, add comments, and update status.
Security detections: handle detection rules, exception lists, and value lists.
Fleet: manage agents, agent/package policies, outputs, and enrollment.
Streams: list/summarize streams, ingest configs, and processing (Tech Preview).
Observability: work with SLOs and observability reads.
Platform admin: manage spaces, roles, and upgrade readiness.
Platform health: read cluster and Kibana status/health.
Composable controls: enable toolboxes and cap read/write/destructive tiers via configuration, so the exposed tool surface is deployment-specific.
Allows interaction with a Kibana deployment, providing tools for building Lens visualizations and dashboards from declarative specs, as well as managing data views, alerts, cases, security detections, Fleet, streams, observability, and platform administration/health.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-for-kibanaCreate a dashboard showing average ticket price by carrier for the last 7 days."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-for-kibana
An MCP server for Kibana: composable toolboxes over a hexagonal core, powered by kibana-py.
Disclaimer: This is an independent, community-driven project and is not officially affiliated with, endorsed by, or supported by Elastic N.V. or any of its subsidiaries. "Kibana" and "Elasticsearch" are trademarks of Elastic N.V. This project is provided "as is", without warranty of any kind. See LICENSE. The name "mcp-for-kibana" uses "Kibana" referentially — this is an MCP server for Kibana, per Elastic's trademark guidelines on referential use — and does not imply origin or endorsement.
The distribution is mcp-for-kibana; the Python import package is kibana_mcp.
Technical Preview: the dashboards toolbox is built entirely on Kibana 9.4's new public Dashboards API and Visualizations API, both marked
x-state: Technical Previewby Elastic — their request/response shapes may still change in a later Kibana release without notice, and they carry no support SLA. This server targets Kibana 9.4+ only; earlier versions don't expose these APIs publicly at all.
Status
v0.1.0 — 10 toolboxes, 133 tools, live-tested. The server exposes 133 tools across 10 composable toolboxes (dashboards, data management, alerting, cases, security detections, fleet, streams, observability, platform admin, and platform health), each classified read / write / destructive and contract-tested against a live Kibana 9.4.3. It's packaged as a stdio and container-runnable server. See the Tool reference below.
The flagship path is dashboards from plain English: an LLM goes from a request
("average ticket price by carrier, last 7 days") to a real Kibana dashboard through
the read → validate → translate → write flow. That path passed its end-to-end gate
3/3 on 2026-07-10: a real local LLM in LM Studio (openai/gpt-oss-20b) drove it
autonomously — plain English in, correct live dashboard out, verified against the
stored Lens payload and cleaned up — three consecutive runs (16s/9s/7s wall). See
docs/e2e-setup.md for the one-time LM Studio setup
(permission toggles + API token) and tests/e2e/test_lmstudio.py for the
harness. Model note: gpt-oss-20b's parser-enforced tool grammar made it
3/3 reliable; qwen2.5-coder-14b completes the flow too but corrupts its
tool-call markers about one run in three.
Related MCP server: Kibana Dashboard Builder
What it does
Lets an LLM work with Kibana through a small, reliable, purpose-built tool surface instead of ~610 raw endpoints — 133 tools grouped into 10 composable toolboxes you enable per deployment. The flagship dashboards toolbox lets a user describe the chart they want, and the server translates a simple declarative spec into real Kibana Lens visualizations and dashboards via the modern Dashboards API (Kibana 9.4+). The other toolboxes cover data management, alerting, cases, security detections, fleet, streams, observability, and platform admin/health.
Design pillars:
Composable toolboxes — groups of tools enabled/disabled per deployment via configuration; small local models get a small surface, big models can get more.
Hexagonal core — pure domain logic (spec → Lens translation) isolated from both the MCP adapter and the kibana-py gateway; every layer independently testable.
Two run modes, one codebase — stdio for a local single user, streamable HTTP in a container for multiple users. Stateless: each request carries the caller's own Kibana API key, so Kibana RBAC and audit logging stay per-user. No multi-tenancy. Exception: saved-objects export handles live in one server-side directory shared by all callers — a handle is a bearer token for that export, and the 20-file retention cap is global, so concurrent HTTP callers can expire each other's handles.
Tiered write safety — every tool is classified read / write / destructive; deployment config caps the tier, and tools above the cap are never advertised to the model or callable by it (registered like every other tool, then hidden via FastMCP's visibility API — not just denied at call time).
Requirements
Python 3.12+ (the server itself is pure Python and OS-independent)
For the dev workflow (Makefile, scripts, local stack): a POSIX shell, GNU make, and Docker with ~5 GB free memory for the Elasticsearch + Kibana stack. Windows: use WSL2.
A Kibana 9.4+ deployment (or the bundled disposable local stack).
Quick start
New here? The User Guide walks you from zero to your first talked-into-existence dashboard in ~10 minutes, on a disposable local Kibana with sample data.
export KIBANA_URL=https://your-kibana.example.com
export KIBANA_API_KEY=<your Kibana API key>
uvx mcp-for-kibana
# or from a local checkout:
uv run mcp-for-kibanaRuns stdio by default — one process per user, talking to Kibana as that user's own API key. See Configuration for every setting.
Claude Code
claude mcp add kibana --env KIBANA_API_KEY=<your key> -- uv --directory /path/to/checkout run mcp-for-kibanaLM Studio
Add an entry to ~/.lmstudio/mcp.json — see
docs/examples/mcp.json for a stdio and an HTTP
example. For the full local E2E setup (real model, real Kibana, real
dashboard), see docs/e2e-setup.md.
Any other MCP client (streamable HTTP)
Point the client at http://<host>:8000/mcp with header
Authorization: ApiKey <your Kibana API key> — see Docker below
for running the HTTP server.
Tool reference
133 tools across 10 toolboxes, each tool classified by tier — read / write /
destructive (64 / 40 / 29). Enable toolboxes per deployment with
KIBANA_MCP_TOOLBOXES; cap the tier with KIBANA_MCP_TIER. A tool above the cap
is not merely denied at call time — it never appears in the tool list (registered,
then hidden via FastMCP's visibility API).
Toolbox | Tools | What it does |
| 11 | Build Lens visualizations + dashboards from a declarative spec — the flagship plain-English → dashboard path. |
| 10 | Data views + short URLs (the datasets you visualize). |
| 11 | Alerting rules and connectors. |
| 6 | Kibana Cases: create, comment, update status. |
| 25 | Detection rules, exception lists, value lists. |
| 35 | Fleet agents, agent/package policies, outputs, enrollment. |
| 12 | Streams list / summary / ingest config + processing (Tech Preview). |
| 10 | SLOs, alerts, and observability reads. |
| 10 | Spaces, roles, upgrade readiness. |
| 3 | Cluster and Kibana status / health reads. |
A tier includes everything below it: read registers only read tools, write
(the default) adds write, destructive adds destructive. The default toolbox set
is dashboards,data-management (coupled — building a viz needs a data view).
See the full per-tool reference for every tool's arguments and return shape.
Configuration
All settings are read once, in kibana_mcp.config.Settings, and are set via
env vars (prefix KIBANA_MCP_ for the deployment-shaped ones; KIBANA_URL,
KIBANA_API_KEY, and KIBANA_PUBLIC_URL are recognized both bare and
prefixed, matching how Kibana's own tooling names them):
Var | Default | Meaning |
|
| Kibana base URL the server connects to. |
| (falls back to | URL used to build human-clickable dashboard links, if different from the URL the server itself reaches Kibana on (e.g. behind a proxy). |
| (none) | stdio mode: the API key used for every request. HTTP mode: ignored unless |
|
| Comma-separated list of toolboxes to register (of the 10 available). |
|
| Max tool tier to register: |
| (none — a fresh, unguessable 0700 temp dir per run) | Directory where saved-objects export/import NDJSON files are written. An explicit path is created 0700, a symlink there is refused, and a pre-existing directory is tightened to 0700. |
|
|
|
|
| Bind host (HTTP transport only). |
|
| Bind port (HTTP transport only). |
|
| HTTP mode only: opt in to letting |
| (none) | Path to a |
|
| Export an OpenTelemetry span per tool call. Off by default (spans are non-recording, no SDK imported); needs the |
Docker
The container always runs HTTP transport (KIBANA_MCP_TRANSPORT=http is
baked into the image), stateless, on port 8000. KIBANA_API_KEY is not
needed at the container level: HTTP mode expects each caller to send their
own key per request, and by default ignores KIBANA_API_KEY even if it's
set (set KIBANA_MCP_ALLOW_ENV_KEY_HTTP=true to opt back into it as a
shared fallback):
docker run -p 8000:8000 -e KIBANA_URL=https://your-kibana.example.com \
ghcr.io/pedro-angel/mcp-for-kibana
curl http://localhost:8000/mcp \
-H 'Authorization: ApiKey <your Kibana API key>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'The image runs as a non-root user (mcp-for-kibana, uid 10001).
Development
make setup # uv sync + git hooks (uv-native path)
make help # every dev task, self-documentedNo uv on the machine? ./bootstrap.sh installs just the git hooks
(prek / pre-commit fallback chain).
The engineering conventions this project holds itself to are in CONTRIBUTING.md, and every one of them is enforced by a gate rather than by convention alone — see the Definition-of-Done gate below. Git & CI discipline comes from git-controls-starter.
Test matrix
Six tiers, from fastest/most-isolated to slowest/most-real:
make test # unit — fakes only, no network; the default selection
make test-contract # starts + seeds the docker Kibana stack itself, then -m contract
make test-e2e-replay # replays a RECORDED model turn through a real MCP client
make test-e2e # a REAL local model in LM Studio — see docs/e2e-setup.md
make streams-ephemeral # destructive streams path on its own throwaway stack
make fleet-ephemeral # agent lifecycle on a throwaway 2-agent fleet stackEverything except test-e2e runs in CI. The two ephemeral tiers own their
stack's whole lifecycle (up → test → down) because their paths are destructive:
they delete every wired stream, or mutate real enrolled agents, so they cannot
share the dev stack. They also cannot run beside it — see
scripts/fleet_ephemeral.sh for the measured memory headroom.
On the two e2e tiers. They are not redundant, and one is not a substitute for the other:
|
| |
Who picks the tool calls | a real local LLM | a recorded transcript |
Server, MCP transport, Kibana, ES | real | real |
Runs in CI | no — needs a GPU + loaded model | yes |
Proves a model can reason to the calls | yes | no |
Proves the model-facing surface still works | yes | yes, per-PR |
The replay tier exists because the surface a model actually touches was
otherwise certified only on a maintainer's laptop. It replays a turn recorded
from a live gpt-oss-20b run — including the three failures that run recovered
from — and asserts the tools still exist, that arguments a real model produced
still validate against the live input schemas, and that the error guidance
survives. That guidance is load-bearing: a model has no other way to learn
your data's field names, and degrading "field 'price' does not exist … did you mean 'Carrier'?" to a bare 400 breaks self-correction for every LLM using this
server. Four mutation tests confirm the tier fails when each guard is broken.
(Raw commands underneath: uv run pytest [-m contract|-m e2e|-m e2e_replay] —
the suites load elastic-start-local/.env.seed + .env.local in-process; the
Makefile is a thin facade.)
The docs site is a CI gate too: uv sync --group docs once, then
uv run mkdocs build --strict must pass with zero warnings
(uv run mkdocs serve to preview locally).
Before claiming a change "done" — and always before a release — run the
Definition-of-Done gate, which certifies completion from dod.config
instead of letting the author self-certify:
make dod # GO/NO-GO over all declared criteria (definition-of-done.sh)Every tier needing infrastructure is excluded from the default selection
(addopts in pyproject.toml), so a bare pytest never silently depends on a
stack. CI splits accordingly: checks.yml runs the content gates (lint, types,
audit, SAST, unit across Python 3.12–3.14, docs, image build+smoke), and
integration.yml provisions real stacks for the live tiers and certifies them
through this same gate script with per-tier configs in .github/dod/ — so CI
verdicts and make dod cannot drift.
make dod needs the dev stack up for contract/e2e/e2e_replay and down for
the ephemeral tiers, so a plain run cannot satisfy both halves. To get a
one-shot GO, let the gate cycle the stack for you (default-off, so it never
touches infrastructure unasked):
scripts/stack.sh up && scripts/stack.sh seed
KIBANA_MCP_DOD_CYCLE_STACK=1 make dode2e_green is the one criterion CI cannot certify — it needs a real model. It
stays required in dod.config and n/a in every .github/dod tier, so the
local gate remains a strict superset of CI rather than CI quietly becoming the
definition of done.
License
Available Tools
16 toolsadd_esql_metric_panelA
Add an ES|QL metric panel to an existing dashboard: run an ES|QL
query and show one of its output columns as a single-number metric.
esql is the query (e.g. 'FROM logs | STATS total = COUNT(*)') and
column names the output column to display (e.g. 'total'). For
field-based charts use add_panel with a VizSpec instead. The query is
NOT validated server-side — a wrong query or column yields an empty
panel, so write both carefully.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| column | Yes | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important non-obvious behavior beyond the annotations: the query is not validated server-side, a wrong query or column produces an empty panel, and the space parameter targets a Kibana space by id with a default. This gives the agent essential expectations about failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, with the main purpose stated first, followed by useful examples, a sibling-tool pointer, a warning, and a space parameter note. Every sentence adds value without unnecessary padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and annotations are all false, the description sufficiently covers the tool's behavior, parameter semantics, failure modes, and relationship to add_panel. It is complete enough for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates well by explaining `esql` and `column` with concrete examples and clarifying `space`'s default behavior. `dashboard_id` and `title` are not explicitly described, but their meaning is strongly implied by 'existing dashboard' and 'panel title' context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: 'Add an ES|QL metric panel to an existing dashboard', and clearly describes the core behavior (run query, show one output column as a single-number metric). It also distinguishes itself from the sibling add_panel by saying field-based charts should use add_panel with a VizSpec instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly gives an alternative: 'For field-based charts use add_panel with a VizSpec instead.' It also provides practical usage guidance by warning that the query is not validated server-side and that wrong input yields an empty panel.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_esql_table_panelA
Add an ES|QL table panel to an existing dashboard: show a query's
output columns as a table. columns are the grouping/dimension
columns — one table row per distinct value (e.g. ["status"]);
metric_columns are the numeric value columns shown per row (e.g.
["count"]). esql is the query. It is NOT validated server-side — a
wrong query or column name yields an empty panel, so write them
carefully. For field-based charts use add_panel with a VizSpec.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| columns | Yes | ||
| dashboard_id | Yes | ||
| metric_columns | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds critical behavioral context beyond annotations: 'It is NOT validated server-side — a wrong query or column name yields an empty panel.' This is a valuable warning about failure modes. It also explains the effect of the `space` parameter. Annotations only cover read-only/destructive hints, which are false, so no contradiction. The description does not mention idempotency or side effects, but the provided annotations already handle those, and the description adds useful details about error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact but information-dense. It packs the core purpose, parameter roles, failure mode, an alternative, and the space parameter into two short paragraphs. Every sentence adds value, and the structure is logical: purpose → parameter details → caveat → alternative → namespace. No fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (ES|QL query, multiple column types) and the presence of an output schema, the description covers the essential aspects: what it does, parameter semantics, failure mode, and when to use alternatives. It does not explicitly mention prerequisites like 'the dashboard must exist', but that is implied by 'existing dashboard'. It also doesn't describe the return value, but the output schema handles that. Overall, it is sufficiently complete for an agent to understand usage and limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain parameters. It does this effectively: `columns` are grouped as 'grouping/dimension columns — one table row per distinct value' with an example; `metric_columns` are defined as 'numeric value columns shown per row' with an example; `esql` is described as the query; `space` is explained with a default. `dashboard_id` and `title` are self-explanatory given their names and the tool's purpose. This compensates well for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Add an ES|QL table panel to an existing dashboard: show a query's output columns as a table.' It distinguishes from siblings by explicitly mentioning the table panel type and naming add_panel for field-based charts. The verb 'add' and resource 'table panel' are specific and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage guidance: 'For field-based charts use add_panel with a VizSpec.' This directly points to an alternative tool for a different use case. It also clarifies the role of columns vs metric_columns, which helps the agent decide when to use this tool. The note about server-side validation also sets expectations for when to use it cautiously.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_esql_xy_panelA
Add an ES|QL bar/line/area panel to an existing dashboard:
x_column on the x axis, each of y_columns a plotted series, and an
optional breakdown_column to split each series. esql is the query.
It is NOT validated server-side — a wrong query or column name yields
an empty panel. For field-based charts use add_panel with a VizSpec.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| x_column | Yes | ||
| y_columns | Yes | ||
| chart_type | No | bar | |
| dashboard_id | Yes | ||
| breakdown_column | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds important behavioral context: it states that the query is not validated server-side and that a wrong query can yield an empty panel. This is critical for the agent to understand. It also mentions the space targeting behavior手动 with a default. Annotations are all false, so the description carries the burden and handles it well, though it could mention that the operation is not idempotent or destructive but that's less relevant.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two clear paragraphs: the first explains the tool's purpose and key parameters, and the second covers the 'space' parameter. It avoids redundancy and is front-loaded with the main action. The only minor issue is that the space explanation is placed after the main content, but it's not off-topic.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 params, 5 required, output schema exists), the description is well-rounded. It explains the core behavior, the parameter relationships, the lack of validation, and the alternative tool. The output schema covers return values, so the description doesn't need to. It could mention the types of panels it creates (bar/line/area) more explicitly, but the chart_type parameter handles that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the schema having 0% description coverage, the description itself explains the roles of x_column, y_columns, breakdown_column, esql, and space, which goes beyond the schema's raw definitions. It does not detail chart_type (though its enum values are self-explanatory) or dashboard_id and title, which are obvious from names, so the coverage is good but not exhaustive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates ES|QL bar/line/area panels on dashboards, mentions the key parameters (x_column, y_columns, breakdown_column), and distinguishes it from the alternative add_panel for field-based charts. It also indicates the panel type and the optional breakdown column, which is specific and helpful.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use this tool (for ES|QL-based charts) and explicitly contrasts with add_panel for field-based charts, giving a clear alternative. However, it doesn't explicitly mention when NOT to use it, such as for metric or table panels, which could be inferred from sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_panelA
Add a visualization panel to an existing dashboard.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| panel | Yes | ||
| space | No | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is not read-only, not idempotent, and not destructive. The description adds meaningful context about spaces and existing dashboards, but does not describe what happens on repeated calls, whether multiple panels can be added, or how failures affect the dashboard. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences, front-loaded with the action, and contains no fluff. It communicates the main behavior and one key parameter nuance without repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a complex nested panel object, the description covers the basics but omits workflow guidance such as needing `data_view` to exist, how this relates to the ES|QL panel tools, or whether a dashboard must be fetched first. The schema and annotations carry much of the load, so it is viable, but it has clear contextual gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds real value for the `space` parameter by explaining it targets a Kibana space by id and defaults to the default space. The nested panel definition is rich and well-described in the schema, so the limited description is less harmful, but `dashboard_id` receives no added semantic detail beyond the tool description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Add a visualization panel to an existing dashboard.' This is a specific verb + resource and communicates the core purpose well. It does not explicitly differentiate from sibling tools like `add_esql_metric_panel` or `add_esql_table_panel`, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'to an existing dashboard' implies the dashboard must already exist, and the space note gives targeting context. However, it does not explicitly say when to prefer this tool over alternatives such as `create_dashboard`, `create_visualization`, or the `add_esql_*` tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_dashboardAIdempotent
Create a dashboard from one or more visualization specs. Idempotent:
creating with the same title (case-insensitive,
whitespace/punctuation-normalized) updates that dashboard instead of
duplicating it, replacing its panels (filters, query, tags and display
options are preserved); the return's status is
created or replaced. Call describe_data_view first to learn real
field names.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| title | Yes | ||
| panels | Yes | ||
| time_range | No | ||
| description | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (idempotentHint=true), the description explains the normalized title matching, that existing panels are replaced while filters/query/tags/display options are preserved, and that the return status is `created` or `replaced`. This is exactly the kind of behavioral nuance the structured fields cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: a clear one-line definition, a compact idempotency/replacement contract with return status, and a prerequisite plus `space` default. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The high-complexity tool has rich nested schema, output schema, and annotations, and the description covers the important behavioral contract and prerequisite. It is not a 5 only because top-level parameter documentation is sparse (e.g., `time_range` and `description` are not explained in prose).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% top-level description coverage, so the prose description must compensate, but it only covers `space` explicitly. `title`, `panels`, `time_range`, and `description` are left to schema inference; nested panel properties are explained in the schema, but the top-level parameter semantics are under-specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence names the exact operation ('Create a dashboard') and object ('from one or more visualization specs'), clearly distinguishing it from sibling tools like create_visualization or add_panel. The idempotent-update behavior further clarifies that this is the tool for creating/replacing whole dashboards by title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear prerequisite ('Call describe_data_view first to learn real field names') and explains the title-matching update behavior, so an agent knows when reuse with same title occurs. It does not name sibling alternatives or state explicit when-not-to-use, but the context is sufficient for selection among dashboard/visualization/panel tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_data_viewA
Create a Kibana data view over an index pattern (e.g. 'logs-*'). Optionally set a display name and a time field (for time-series data).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| space | No | ||
| time_field | No | ||
| index_pattern | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide no safety hints (readOnlyHint=false, destructiveHint=false), so the description must disclose behavioral traits. It explains the `space` parameter but does not mention permissions, what happens if the data view already exists, whether it is idempotent, or any side effects. This leaves significant ambiguity for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (three short sentences) and front-loads the core purpose. Every sentence adds value: the first explains the primary action, the second lists optional parameters, and the third clarifies the `space` argument. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with one required parameter and three optional ones, the description covers the essential context: what it does, the index pattern example, and the optional fields. It does not mention error handling or prerequisites, but the output schema likely covers return values. Overall, it is complete enough for a competent agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining each parameter's role: index_pattern (with example 'logs-*'), name (display name), time_field (for time-series data), and space (targets a Kibana space by id). This adds meaning beyond the schema's bare field definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Create a Kibana data view over an index pattern' with a concrete example. This is specific and distinguishes it from sibling tools like list_data_views or describe_data_view, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case—creating a data view for an index pattern—and mentions optional settings for time-series data. However, it does not explicitly state when to use this tool over alternatives, nor does it provide exclusions or prerequisites (e.g., that the index pattern must exist).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_short_urlA
Create a Kibana short URL. Supports
locator_id='LEGACY_SHORT_URL_LOCATOR' with params={'url': '/app/...'}
(a Kibana app path). (Technical-Preview API.) A slug created in a space
resolves under /s/<space>/goto/<slug> and via
resolve_short_url(slug, space=…). When space is set, pass the app path
WITHOUT a /s/<space> prefix — the space parameter chooses the space,
not the path. A /s/<id>-prefixed path passed without space creates
the slug in the default space.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| params | Yes | ||
| locator_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, etc., but the description adds valuable context: how URLs resolve under /s/<space>/goto/<slug>, the difference in behavior when space is set, and the prefix rules. However, it doesn't mention potential side effects (e.g., slug collisions, idempotency) or any output details beyond what's known. The description enhances transparency but doesn't exhaustively cover behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear definition, a parenthetical usage note, and a separate paragraph for the space parameter. Every sentence adds value, though the second paragraph is slightly repetitive. Overall, it is concise and front-loaded with the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 3 parameters and the nested params object, the description provides complete guidance on how to construct valid inputs, including the exact locator_id, the param format, and space-handling rules. It also references output behavior via resolve_short_url. The lack of detailed output schema explanation is acceptable since an output schema exists, and the description covers the complex space-scoping behavior thoroughly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully compensate for parameter semantics. It explains the meaning of three parameters: locator_id (with exact value 'LEGACY_SHORT_URL_LOCATOR'), params (with url field), and space (targets Kibana space, with default behavior). This adds substantial meaning beyond the raw schema, which only provides types and patterns.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Create a Kibana short URL.' It specifies the required locator_id and params format, and distinguishes from the sibling tool resolve_short_url. The mention of 'Technical-Preview API' and supported locator variants adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: indicates when to use it (creating a slug), how it interacts with spaces, and obvious distinctions from resolve_short_url (which resolves slugs). It also includes specific guidance on the `space` parameter and path prefixes, which helps agents choose this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_visualizationA
Create a reusable visualization in the library (not on a dashboard).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| spec | Yes | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is not read-only, not open-world, not idempotent, and not destructive, which is minimal. The description adds context that the visualization is reusable and placed in the library, but it doesn't disclose what happens to existing visualizations, permissions needed, or that creating is a write action. With annotations already covering the basic traits, the description adds some value but lacks detailed behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, zero waste. It front-loads the core purpose and adds a necessary detail about the space parameter. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity with nested objects and an output schema, the description is adequate but could be more complete. It doesn't describe return values, but the output schema likely covers that. It focuses on the creation location and the space parameter, which are key differentiators. However, it lacks guidance on required spec fields or common usage patterns, leaving some gaps for an agent to fill.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has rich descriptions for all parameters, covering 0% schema coverage in the description itself means the schema provides all the meaning. However, the description adds minimal parameter-level information beyond the schema. It only mentions that 'space' targets a Kibana space by id, which is useful context not in the schema. Given the schema is comprehensive, the description's contribution is marginal but positive for the space parameter; still, it doesn't compensate for the overall lack of parameter guidance beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states "Create a reusable visualization in the library (not on a dashboard)" with a specific verb and resource, and explicitly distinguishes it from dashboard-based creation. It clearly contrasts with sibling tools like create_dashboard and add_panel, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by noting the visualization is placed in the library rather than a dashboard, which helps differentiate from sibling tools. However, it does not explicitly state when to use this tool versus alternatives like create_dashboard or add_panel, nor does it mention when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_data_viewARead-only
Get a data view's fields and types. Call this before creating a visualization so you use real field names.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| data_view | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already communicate the read-only safety profile, and the description adds useful behavioral context: `space` targets a Kibana space by id and defaults to the default space. The output schema also covers return shape, so the transparency burden is reasonably met.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: one clear purpose sentence, one practical usage sentence, and one terse parameter note. There is no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity, read-only metadata tool with an output schema and annotations, the description covers the trigger situation and the space default well. It is slightly incomplete only because the format of the `data_view` parameter is not explicitly specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains `space` well, but it does not clarify whether `data_view` expects an ID, name, or title. The tool name and first sentence imply it identifies a data view, but this is only partial parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and object: 'Get a data view's fields and types.' It also gives a concrete use case ('Call this before creating a visualization so you use real field names'), which clearly distinguishes it from siblings like list_data_views and create_data_view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction 'Call this before creating a visualization' provides an explicit context for when to use the tool. It does not enumerate exclusions or alternative tools, but the guidance is clear enough for an agent to select this tool appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_saved_objectsARead-only
Export saved objects (dashboards, data views, …) as an NDJSON file
on the server, and return a summary + an opaque handle — NOT the
content — that you pass to import_saved_objects. Select EITHER types
(e.g. ["dashboard"], or ["*"] for the whole space) OR objects
(a list of {"type":…, "id":…}), not both. This is a sensitive export
surface; what can actually be read is bounded by the API key's
privileges, not by this tool.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| types | No | ||
| objects | No | ||
| include_references_deep | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint, it reveals that the action creates an NDJSON file on the server, that only a summary and opaque handle are returned, and that readable content is bounded by API key privileges. These are behavioral facts not present in annotations, and no contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description fits four sentences with the primary behavior and handle semantics first, followed by constraints, security caveat, and space. No sentence is redundant or tangential.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex export tool with an output schema, the description covers the workflow, selection constraints, security boundary, and relationship to import_saved_objects. Only include_references_deep is not explicitly discussed, so it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema description coverage is 0%, the description explains the main parameters: types/objects exclusivity, wildcard use, and space default. It leaves include_references_deep unmentioned, which is a minor gap given the schema provides no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Export saved objects ... as an NDJSON file on the server.' It also clarifies the return value is a summary plus an opaque handle rather than content, which clearly differentiates this from import_saved_objects and read-only dashboard/data-view tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit usage constraints: 'Select EITHER types ... OR objects ... not both,' and explains the space parameter's default. It doesn't enumerate when-not cases against sibling tools, but the workflow context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboardARead-only
Get a dashboard summary: title, description, and its panels.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description is consistent with that. The description adds the output fields and the space targeting behavior, but does not disclose potential errors, permissions, or limitations of what 'summary' includes. Given annotations cover the safety profile, the description adds modest but not rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence states purpose and output, the second explains a parameter; both are necessary and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get-by-id tool with output schema and annotations, the description covers the essential purpose and parameter semantics. It doesn't address usage relative to siblings or potential edge cases, but those are not critical given the low complexity and available schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has no descriptions (0% coverage). The description explains the non-obvious `space` parameter by stating it targets a Kibana space by id and defaults to the default space. `dashboard_id` is not described but its meaning is self-evident from the parameter name and tool name; still, a brief mention would be better. This partially compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Get' and names the resource 'dashboard', and specifies the returned contents: 'title, description, and its panels'. This clearly distinguishes it from sibling search_dashboards and create_dashboard by being a targeted read operation on a single dashboard.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or comparison with alternatives is provided. The description implies the tool is for retrieving dashboard details, but it does not say when to prefer get_dashboard over search_dashboards or how the space parameter interacts with search. Thus usage guidance is only implied, not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
import_saved_objectsA
Import a previously-exported set of saved objects, identified by the
handle returned from export_saved_objects, as NEW copies (regenerated
ids — a clone into the current space, not an in-place restore). Existing
objects are never touched. Returns which objects were created (source id
-> new destination id). A missing/expired handle errors. To restore in
place instead, use overwrite_saved_objects (destructive). A handle
carries no space — importing it with space="b" clones its content into
b (new ids), regardless of which space it was exported from.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| handle | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide minimal detail (all false), so the description carries the disclosure burden. It states existing objects are never touched, creates new copies, returns a source-to-destination mapping, and errors on missing/expired handles. However, it does not explicitly mention idempotency (implied by new copies) or other potential side effects, so a 4 is fitting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured in three sentences, each delivering key information: purpose, alternative, and parameter semantics. It is front-loaded with the main purpose and critical distinction. Slightly verbose but all content is purposeful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool description covers all essential aspects: purpose, usage guidance, behavior, parameter semantics, return value, and error conditions. The output schema exists and is not needed for explanation. No significant gaps are evident, making it contextually complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are semantically enriched: `handle` is tied to `export_saved_objects` and its error case, while `space` is explained with default behavior and interaction with the handle. This adds significant meaning beyond the minimal schema definitions, compensating for the low schema coverage signal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: import saved objects as new copies with regenerated IDs, and explicitly distinguishes this from an in-place restore by naming the alternative `overwrite_saved_objects`. It also identifies the resource (exported saved objects) and scope (current space), making it highly distinguishable from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: for cloning into a space, and when-not-to-use: for restoring in place, suggesting `overwrite_saved_objects` as the destructive alternative. It also clarifies the space-agnostic nature of handles, giving clear context for cross-space imports.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_data_viewsARead-only
List Kibana data views (the datasets you can visualize).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safe read nature is covered. The description adds the space-scoping behavior, which is useful, but does not disclose other behavioral traits such as pagination, ordering, or whether all views are returned across the entire stack.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loads the main action, and every word adds value. There is no redundant restatement of the tool name or schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with one optional parameter, an output schema, and read-only annotations, the description covers the essential semantics: what is listed, what the parameter means, and the default behavior. No significant information gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema has no descriptions and reported coverage is 0%, the description compensates by explaining the single 'space' parameter: it targets a Kibana space by id and defaults to the default space. This adds semantic meaning beyond the raw schema type and default value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'List Kibana data views' and clarifies them as 'the datasets you can visualize.' This clearly distinguishes it from sibling tools like describe_data_view and create_data_view, which operate on a single view or create one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the phrase 'the datasets you can visualize' and the space-targeting comment, but there is no explicit mention of when to choose this over alternatives such as describe_data_view or search_dashboards. No exclusions or conditional guidance are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_short_urlARead-only
Resolve a Kibana short-URL slug to its locator and target app path. (Short URLs are a Technical-Preview API.)
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, and the description adds context by flagging Short URLs as a Technical-Preview API and specifying the resolve outcome (locator and target app path). This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose, and no filler. Every sentence adds relevant information, including the technical-preview caveat and the 'space' parameter clarification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has an output schema, read-only annotations, and the description conveys enough to select and invoke it correctly. The technical-preview warning and space behavior round out the context without needing further detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate. It explains 'space' (targets a Kibana space by id, defaults to the default space), which adds meaning beyond the schema. 'slug' is implied but not explicitly detailed, leaving some semantic gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Resolve') and resource ('Kibana short-URL slug') and states the output ('locator and target app path'). This distinguishes it from the sibling 'create_short_url' tool, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a short-URL slug needs resolving, and it clarifies the optional 'space' parameter's default. However, it does not explicitly state when to use this tool over alternatives or provide any exclusions/prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_dashboardsARead-only
Search dashboards by title/description. Empty query lists all.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the description adds value by explaining the effect of an empty query (lists all dashboards) and the default space behavior. These are behavioral details not present in the schema or annotations. However, it does not describe pagination, result limits, or other side effects, which keeps it at a moderate level.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of three short, front-loaded sentences. The first sentence states the core purpose, the second clarifies a key behavior, and the third explains a parameter. No unnecessary words or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with an output schema and read-only annotation, the description covers the essential aspects: what it searches, how to list all, and the space-scoping parameter. It omits potential details like sorting or result limits, but given the output schema and the tool's simplicity, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no descriptions (coverage 0%), so the description fully compensates by explaining both parameters: 'query' searches by title/description, and 'space' targets a Kibana space by id with a default. It also clarifies the default values and behavior, adding meaning far beyond the plain type definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search dashboards by title/description.' It uses a specific verb and resource, and distinguishes this from sibling tools like get_dashboard (which retrieves a specific dashboard) and create_dashboard (which creates one). The mention of empty query behavior further clarifies its scope as a listing/search operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when searching by text) and provides clear context about the query and space parameters. It does not explicitly mention alternatives or exclusions, but the context is sufficient for an agent to decide to use this over other singular dashboard tools. The note about empty query listing all is a usage hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_panelCIdempotent
Replace the visualization at panel_index (see get_dashboard for indexes).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| panel | Yes | ||
| space | No | ||
| panel_index | Yes | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description must carry the behavioral load. 'Replace the visualization' implies mutation (consistent with readOnlyHint=false) and hints the prior visualization is gone, but it never states whether the operation is destructive to the old content, whether it's idempotent (destructiveHint=false), or whether it requires the panel to already exist. The agent must infer all of this.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact, readable sentences that front-load the main purpose and then add a useful parameter note. There is no fluff, but the brevity causes it to under-deliver on behavioral and usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that overwrites a visualization on a dashboard Affecting whether an existing panel is silently destroyed, how indexes are obtained, and whether the operation is idempotent, the description provides only the index source and space semantics. There is no note on outcome, error conditions, or interaction with the existing panel, so an agent lacks a full picture of what calling this does.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description clarifies two parameters: panel_index (which indexes come from get_dashboard) and space (id, defaults to default space). The nested panel fields (chart_type, metrics, group_by, etc.) already carry rich descriptions in the schema. However, dashboard_id receives no extra meaning and the interplay (e.g., does space apply to all params?) is left vague. Description partially supplements the schema, so a 3 is fair.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'Replace' is specific and 'visualization at panel_index' clearly identifies the target resource, with a useful pointer to get_dashboard for the index. However, the description does not name or distinguish from sibling tools like add_panel or update_panel variants, so an agent could confuse scope. Minor ambiguity: does 'visualization' mean the chart, its config, or the whole panel?
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only guidance is a cross-reference to get_dashboard for indexes. There's no statement about when this tool should be used versus the many create/add siblings, no prerequisites, and no exclusion of alternatives. Nothing tells the agent what should be fetched first (though indexing is implied) or what happens if the panel doesn't exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
16 tool updates
v0.1.0- First observed
add_esql_metric_panel - First observed
add_esql_table_panel - First observed
add_esql_xy_panel - First observed
add_panel - First observed
create_dashboard - First observed
create_data_view - First observed
create_short_url - First observed
create_visualization - First observed
describe_data_view - First observed
export_saved_objects - First observed
get_dashboard - First observed
import_saved_objects - First observed
list_data_views - First observed
resolve_short_url - First observed
search_dashboards - First observed
update_panel
TDQS
Scored across 16 tools
Each tool targets a distinct resource and action: dashboards, panels, data views, saved objects, and short URLs are cleanly separated, and the ES|QL panel variants are distinguished by panel type. Where overlap could exist (add_panel vs the ES|QL-specific panel tools), the descriptions explicitly clarify when to use which.
All tool names follow a consistent snake_case verb_noun pattern: search_dashboards, create_dashboard, add_panel, list_data_views, resolve_short_url, etc. The verb prefixes are uniform and predictable, making the tool set easy to navigate.
16 tools is slightly above the ideal 3-15 range, but the breadth is justified by the multiple Kibana subsystems covered: dashboards, visualizations, data views, saved objects, and short URLs. Each tool has a clear role, so the count feels reasonable rather than bloated.
The core dashboard-building workflow is well covered, including create/read/update, panel management, data-view discovery, and saved-object transfer. However, there are notable gaps: no delete operations for dashboards, data views, visualizations, or short URLs, and no way to remove a panel from a dashboard.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Gateway between LLM agents and world data through eight tools and a bundled endpoint catalog.
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables AI assistants to interact with Kibana dashboards, visualizations, and Elasticsearch data through read-only resources and executable tools for searching logs, exporting dashboards, and querying data.7173MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI agents to create and manage Kibana dashboards, Lens visualizations, and data views via the Kibana Saved Objects API. It allows for programmatically listing existing resources and assembling new visualizations into dashboards through natural language commands.-
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to manage Kibana security alerts, rules, and exception lists via the Model Context Protocol.13MIT
- AlicenseBqualityDmaintenanceEnables interaction with Elasticsearch clusters for health checks, index management, document CRUD operations, and search via natural language.1020MIT