mcp-for-kibana
An MCP server that lets an LLM talk to Kibana — read what's there, and build real dashboards, visualizations, and data views from a declarative spec.
Search/read dashboards — list by title/description, fetch a dashboard's title, description, and panels.
Create dashboards from plain specs — one or more panel specs in, real Kibana Lens dashboard out; idempotent by normalized title (returns
createdorreplaced).Add panels — field-based charts (line, bar, pie, metric, gauge, table, heatmap, tag cloud, region map, treemap, mosaic, waffle), or ES|QL metric / table / XY panels.
Update panels — replace a visualization at a given panel index.
Create reusable visualizations — save a chart to the library without putting it on a dashboard.
Manage data views — list them, describe fields and types (call before writing a viz to get real field names), and create one over an index pattern.
Work with short URLs — create a slug (e.g. legacy locator to a Kibana app path) and resolve a slug back to its locator/target.
Export/import saved objects — export to a server-side NDJSON file and get an opaque handle; import that handle as new copies (regenerated ids) rather than an in-place restore.
Target any space — every tool takes an optional
spaceid.Tiered safety — tools are classified read/write; a deployment can cap the tier so higher-tier tools are never even advertised to the model.
Much more beyond this schema — the full server ships 10 toolboxes / 143 tools (also alerting, cases, security detections, fleet, streams, observability, platform admin and health), enabled per deployment.
Allows interaction with a Kibana deployment, providing tools for building Lens visualizations and dashboards from declarative specs, as well as managing data views, alerts, cases, security detections, Fleet, streams, observability, and platform administration/health.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-for-kibanaCreate a dashboard showing average ticket price by carrier for the last 7 days."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-for-kibana
An MCP server for Kibana: composable toolboxes over a hexagonal core, powered by kibana-py.
Disclaimer: This is an independent, community-driven project and is not officially affiliated with, endorsed by, or supported by Elastic N.V. or any of its subsidiaries. "Kibana" and "Elasticsearch" are trademarks of Elastic N.V. This project is provided "as is", without warranty of any kind. See LICENSE. The name "mcp-for-kibana" uses "Kibana" referentially — this is an MCP server for Kibana, per Elastic's trademark guidelines on referential use — and does not imply origin or endorsement.
The distribution is mcp-for-kibana; the Python import package is kibana_mcp.
Technical Preview: the dashboards toolbox is built entirely on Kibana 9.4's new public Dashboards API and Visualizations API, both marked
x-state: Technical Previewby Elastic — their request/response shapes may still change in a later Kibana release without notice, and they carry no support SLA. This server supports Kibana 9.4 and 9.5; earlier versions don't expose these APIs publicly at all.
Licensing and scope
Every tool this server registers works on a Basic (free) Kibana license, and that is the boundary: functionality that needs a paid Elastic subscription is out of scope and stays out. Kibana's own per-type gates still apply to the values you pass — a Gold+ connector type stays Gold+.
The corollary is deliberate. Kibana ships its own MCP server as part of Agent Builder, whose APIs require an Enterprise subscription. A deployment on that tier already has an official one, so the Enterprise-gated surfaces are not worth duplicating here.
Related MCP server: Kibana Dashboard Builder
Status
v0.4.0 — 10 toolboxes, 143 tools, live-tested. The server exposes 143 tools across 10 composable toolboxes (dashboards, data management, alerting, cases, security detections, fleet, streams, observability, platform admin, and platform health), each classified read / write / destructive and contract-tested against live Kibana 9.4.7 and 9.5.4. It's packaged as a stdio and container-runnable server. See the Tool reference below.
The flagship path is dashboards from plain English: an LLM goes from a request
("average ticket price by carrier, last 7 days") to a real Kibana dashboard through
the read → validate → translate → write flow. That path passed its end-to-end gate
3/3 on 2026-07-10: a real local LLM in LM Studio (openai/gpt-oss-20b) drove it
autonomously — plain English in, correct live dashboard out, verified against the
stored Lens payload and cleaned up — three consecutive runs (16s/9s/7s wall). See
docs/e2e-setup.md for the one-time LM Studio setup
(permission toggles + API token) and tests/e2e/test_lmstudio.py for the
harness. Model note: gpt-oss-20b's parser-enforced tool grammar made it
3/3 reliable; qwen2.5-coder-14b completes the flow too but corrupts its
tool-call markers about one run in three.
What it does
Lets an LLM work with Kibana through a small, reliable, purpose-built tool surface instead of ~610 raw endpoints — 143 tools grouped into 10 composable toolboxes you enable per deployment. The flagship dashboards toolbox lets a user describe the chart they want, and the server translates a simple declarative spec into real Kibana Lens visualizations and dashboards via the modern Dashboards API (Kibana 9.4+). The other toolboxes cover data management, alerting, cases, security detections, fleet, streams, observability, and platform admin/health.
Design pillars:
Composable toolboxes — groups of tools enabled/disabled per deployment via configuration; small local models get a small surface, big models can get more.
Hexagonal core — pure domain logic (spec → Lens translation) isolated from both the MCP adapter and the kibana-py gateway; every layer independently testable.
Two run modes, one codebase — stdio for a local single user, streamable HTTP in a container for multiple users. Stateless: each request carries the caller's own Kibana API key, so Kibana RBAC and audit logging stay per-user. No multi-tenancy. Exception: saved-objects export handles live in one server-side directory shared by all callers — a handle is a bearer token for that export, and the 20-file retention cap is global, so concurrent HTTP callers can expire each other's handles.
Tiered write safety — every tool is classified read / write / destructive; deployment config caps the tier, and tools above the cap are never advertised to the model or callable by it (registered like every other tool, then hidden via FastMCP's visibility API — not just denied at call time).
Requirements
Python 3.12+ (the server itself is pure Python and OS-independent)
For the dev workflow (Makefile, scripts, local stack): a POSIX shell, GNU make, and Docker with ~5 GB free memory for the Elasticsearch + Kibana stack. Windows: use WSL2.
A Kibana 9.4 or 9.5 deployment (or the bundled disposable local stack).
Quick start
New here? The User Guide walks you from zero to your first talked-into-existence dashboard in ~10 minutes, on a disposable local Kibana with sample data.
export KIBANA_URL=https://your-kibana.example.com
export KIBANA_API_KEY=<your Kibana API key>
uvx mcp-for-kibana
# or from a local checkout:
uv run mcp-for-kibanaRuns stdio by default — one process per user, talking to Kibana as that user's own API key. See Configuration for every setting.
Claude Code
claude mcp add kibana --env KIBANA_API_KEY=<your key> -- uv --directory /path/to/checkout run mcp-for-kibanaLM Studio
Add an entry to ~/.lmstudio/mcp.json — see
docs/examples/mcp.json for a stdio and an HTTP
example. For the full local E2E setup (real model, real Kibana, real
dashboard), see docs/e2e-setup.md.
Any other MCP client (streamable HTTP)
Point the client at http://<host>:8000/mcp with header
Authorization: ApiKey <your Kibana API key> — see Docker below
for running the HTTP server.
Tool reference
143 tools across 10 toolboxes, each tool classified by tier — read / write /
destructive (68 / 45 / 30). Enable toolboxes per deployment with
KIBANA_MCP_TOOLBOXES; cap the tier with KIBANA_MCP_TIER. A tool above the cap
is not merely denied at call time — it never appears in the tool list (registered,
then hidden via FastMCP's visibility API).
Toolbox | Tools | What it does |
| 16 | Build Lens visualizations + dashboards from a declarative spec — the flagship plain-English → dashboard path. |
| 11 | Data views + short URLs (the datasets you visualize). |
| 15 | Alerting rules and connectors. |
| 6 | Kibana Cases: create, comment, update status. |
| 25 | Detection rules, exception lists, value lists. |
| 35 | Fleet agents, agent/package policies, outputs, enrollment. |
| 12 | Streams list / summary / ingest config + processing (Tech Preview). |
| 10 | Synthetics monitors, Uptime settings, APM agent config (no SLOs — Platinum-gated, out of scope). |
| 10 | Spaces, roles, upgrade readiness. |
| 3 | Cluster and Kibana status / health reads. |
A tier includes everything below it: read registers only read tools, write
(the default) adds write, destructive adds destructive. The default toolbox set
is dashboards,data-management (coupled — building a viz needs a data view).
See the full per-tool reference for every tool's arguments and return shape.
Configuration
All settings are read once, in kibana_mcp.config.Settings, and are set via
env vars (prefix KIBANA_MCP_ for the deployment-shaped ones; KIBANA_URL,
KIBANA_API_KEY, and KIBANA_PUBLIC_URL are recognized both bare and
prefixed, matching how Kibana's own tooling names them):
Var | Default | Meaning |
|
| Kibana base URL the server connects to. |
| (falls back to | URL used to build human-clickable dashboard links, if different from the URL the server itself reaches Kibana on (e.g. behind a proxy). |
| (none) | stdio mode: the API key used for every request. HTTP mode: ignored unless |
|
| Comma-separated list of toolboxes to register (of the 10 available). |
|
| Max tool tier to register: |
| (none — off) | Comma-separated allow list of tool names. When set, the server publishes exactly the listed tools the tier allows and nothing else, and |
| (none — off) | Path to a TOML file of your own named tool lists, used as |
| (none — a fresh, unguessable 0700 temp dir per run) | Directory where saved-objects export/import NDJSON files are written. An explicit path is created 0700, a symlink there is refused, and a pre-existing directory is tightened to 0700. |
|
|
|
|
| Bind host (HTTP transport only). |
|
| Bind port (HTTP transport only). |
|
| HTTP mode only: opt in to letting |
| (none) | Path to a |
|
| Export an OpenTelemetry span per tool call. Off by default (spans are non-recording, no SDK imported); needs the |
Docker
The container always runs HTTP transport (KIBANA_MCP_TRANSPORT=http is
baked into the image), stateless, on port 8000. KIBANA_API_KEY is not
needed at the container level: HTTP mode expects each caller to send their
own key per request, and by default ignores KIBANA_API_KEY even if it's
set (set KIBANA_MCP_ALLOW_ENV_KEY_HTTP=true to opt back into it as a
shared fallback):
docker run -p 8000:8000 -e KIBANA_URL=https://your-kibana.example.com \
ghcr.io/pedro-angel/mcp-for-kibana
curl http://localhost:8000/mcp \
-H 'Authorization: ApiKey <your Kibana API key>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'The image runs as a non-root user (mcp-for-kibana, uid 10001).
Development
make setup # uv sync + git hooks (uv-native path)
make help # every dev task, self-documentedNo uv on the machine? ./bootstrap.sh installs just the git hooks
(prek / pre-commit fallback chain).
The engineering conventions this project holds itself to are in CONTRIBUTING.md, and every one of them is enforced by a gate rather than by convention alone — see the Definition-of-Done gate below. Git & CI discipline comes from git-controls-starter.
Test matrix
Seven tiers, from fastest/most-isolated to slowest/most-real:
make test # unit — fakes only, no network; the default selection
make test-contract # starts + seeds the docker Kibana stack itself, then -m contract
make test-e2e-replay # replays a RECORDED model turn through a real MCP client
make test-e2e # REAL Claude (claude -p, default haiku) with only this server's tools
make test-e2e-local # a REAL local model in LM Studio — see docs/e2e-setup.md
make streams-ephemeral # destructive streams path on its own throwaway stack
make fleet-ephemeral # agent lifecycle on a throwaway 2-agent fleet stackEverything except the two live-model tiers (test-e2e, test-e2e-local)
runs in CI. The two ephemeral tiers own their
stack's whole lifecycle (up → test → down) because their paths are destructive:
they delete every wired stream, or mutate real enrolled agents, so they cannot
share the dev stack. They also cannot run beside it — see
scripts/fleet_ephemeral.sh for the measured memory headroom.
On the two e2e tiers. They are not redundant, and one is not a substitute for the other:
|
| |
Who picks the tool calls | a real LLM (Claude / a local model) | a recorded transcript |
Server, MCP transport, Kibana, ES | real | real |
Runs in CI | no — needs a Claude sign-in / a GPU + loaded model | yes |
Proves a model can reason to the calls | yes | no |
Proves the model-facing surface still works | yes | yes, per-PR |
The replay tier exists because the surface a model actually touches was
otherwise certified only on a maintainer's laptop. It replays a turn recorded
from a live gpt-oss-20b run — including the three failures that run recovered
from — and asserts the tools still exist, that arguments a real model produced
still validate against the live input schemas, and that the error guidance
survives. That guidance is load-bearing: a model has no other way to learn
your data's field names, and degrading "field 'price' does not exist … did you mean 'Carrier'?" to a bare 400 breaks self-correction for every LLM using this
server. Four mutation tests confirm the tier fails when each guard is broken.
(Raw commands underneath: uv run pytest [-m contract|-m e2e_claude|-m e2e|-m e2e_replay] —
the suites load elastic-start-local/.env.seed + .env.local in-process; the
Makefile is a thin facade.)
The docs site is a CI gate too: uv sync --group docs once, then
uv run mkdocs build --strict must pass with zero warnings
(uv run mkdocs serve to preview locally).
Before claiming a change "done" — and always before a release — run the
Definition-of-Done gate, which certifies completion from dod.config
instead of letting the author self-certify:
make dod # GO/NO-GO over all declared criteria (definition-of-done.sh)Every tier needing infrastructure is excluded from the default selection
(addopts in pyproject.toml), so a bare pytest never silently depends on a
stack. CI splits accordingly: checks.yml runs the content gates (lint, types,
audit, SAST, unit across Python 3.12–3.14, docs, image build+smoke), and
integration.yml provisions real stacks for the live tiers and certifies them
through this same gate script with per-tier configs in .github/dod/ — so CI
verdicts and make dod cannot drift.
make dod needs the dev stack up for contract/e2e_replay/wheel_replay/e2e_green and down for
the ephemeral tiers, so a plain run cannot satisfy both halves. To get a
one-shot GO, let the gate cycle the stack for you (default-off, so it never
touches infrastructure unasked):
scripts/stack.sh up && scripts/stack.sh seed
KIBANA_MCP_DOD_CYCLE_STACK=1 make dode2e_green — a real model choosing the calls — is required in dod.config
(D42): the gate runs the Claude tier (make test-e2e's tasks via claude -p,
model CLAUDE_E2E_MODEL, default haiku, D38), which needs a signed-in
claude CLI and takes about 5–6 minutes; a missing CLI or sign-in is NO-GO
and names the fix. It stays n/a in every .github/dod tier, since CI has no
Claude sign-in, and a pass certifies only the model that ran. Run
make test-e2e on its own when a change touches tool names, descriptions or
schemas; make test-e2e-local runs three of those four tasks (all but
fix_rule_threshold) as LM Studio tests on a small local model, outside every
gate.
License
Available Tools
21 toolsadd_esql_metric_panelAdd Esql Metric PanelA
Add an ES|QL metric panel to an existing dashboard: run an ES|QL
query and show one of its output columns as a single-number metric.
esql is the query (e.g. 'FROM logs | STATS total = COUNT(*)') and
column names the output column to display (e.g. 'total'). For
field-based charts use add_panel with a VizSpec instead. The query is
NOT validated server-side — a wrong query or column yields an empty
panel, so write both carefully.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| column | Yes | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations supply the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=false), so the description doesn't need to restate mutation semantics. It does add valuable non-structured behavior: the query is NOT validated server-side and a bad query/column silently yields an empty panel, plus the space default. This warns the agent about a silent-failure mode the annotations never express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and result, then parameters with examples, then the alternative tool, then the critical caveat. Every sentence carries information the agent needs; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. Given that, the description covers purpose, the routing alternative, per-parameter meaning for the tricky fields, and the silent-failure caveat — everything needed to invoke this 5-parameter mutation tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry parameter meaning, and it does for the non-obvious ones: 'esql' is the query (with a worked example) and 'column' names the output column to display (with example), and 'space' targets a Kibana space by id. The obvious 'title' and 'dashboard_id' are left to inference, which is a minor gap but not misleading.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a precise verb+resource ('Add an ES|QL metric panel to an existing dashboard') and narrows the outcome to 'show one of its output columns as a single-number metric'. It distinguishes itself from siblings by explicitly routing field-based charts to add_panel with a VizSpec, so the agent can tell it apart from add_esql_table_panel and add_esql_xy_panel.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states a clear alternative for the field-based case ('use add_panel with a VizSpec instead'), which is genuine when-to-use guidance. It stops short of naming the other ES|QL panel siblings (table/xy) as alternatives, so the routing is helpful but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_esql_table_panelAdd Esql Table PanelA
Add an ES|QL table panel to an existing dashboard: show a query's
output columns as a table. columns are the grouping/dimension
columns — one table row per distinct value (e.g. ["status"]);
metric_columns are the numeric value columns shown per row (e.g.
["count"]). esql is the query. It is NOT validated server-side — a
wrong query or column name yields an empty panel, so write them
carefully. For field-based charts use add_panel with a VizSpec.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| columns | Yes | ||
| dashboard_id | Yes | ||
| metric_columns | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare a non-destructive write (readOnlyHint=false, destructiveHint=false). The description adds genuinely useful context beyond them: no server-side validation, and a wrong query or column name silently produces an empty panel. It stops short of describing the response or idempotency behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then the two column parameters with concrete examples, then the critical validation caveat, then the alternative tool and the space default. Dense but every clause earns its place; the parameter definitions could be tightened slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values needn't be explained, and annotations cover the safety profile. The description supplies the mutation caveat, all non-obvious parameter meanings, and the space default, leaving little an agent would need before invoking it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden and mostly delivers: columns are defined as grouping/dimension columns (one row per distinct value, with example), metric_columns as numeric value columns (example given), esql as the query, and space as the target Kibana space with its default. Only title and dashboard_id are left implicit, which are self-evident.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (add) and resource (ES|QL table panel to an existing dashboard) and clarifies the panel's role: 'show a query's output columns as a table.' It explicitly distinguishes itself from the sibling add_panel for field-based charts, so an agent can tell it apart from the ES|QL metric/xy siblings by the table semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes field-based charts to add_panel with a VizSpec, and warns that esql is not validated server-side so wrong input yields an empty panel. It doesn't directly contrast with the closest siblings add_esql_metric_panel and add_esql_xy_panel, leaving that distinction to inference from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_esql_xy_panelAdd Esql Xy PanelA
Add an ES|QL bar/line/area panel to an existing dashboard:
x_column on the x axis, each of y_columns a plotted series, and an
optional breakdown_column to split each series. esql is the query.
It is NOT validated server-side — a wrong query or column name yields
an empty panel. For field-based charts use add_panel with a VizSpec.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| esql | Yes | ||
| space | No | ||
| title | Yes | ||
| x_column | Yes | ||
| y_columns | Yes | ||
| chart_type | No | bar | |
| dashboard_id | Yes | ||
| breakdown_column | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare the write/non-idempotent profile (readOnlyHint=false, idempotentHint=false), and the description adds a genuinely useful trait beyond them: 'esql is NOT validated server-side — a wrong query or column name yields an empty panel.' That failure mode is important and not encoded anywhere in the schema. It does not cover permissions, panel placement within the dashboard, or return behavior, but the output schema covers the last of those.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action followed by the parameter mapping, then the caveat. The backtick-heavy line wrapping makes it slightly choppy to parse, but every sentence (scope, param roles, validation warning, sibling routing, space scoping) carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter mutation tool with a rich output schema already documenting returns, the description covers the query semantics, the column mapping, the validation caveat, and space scoping. It omits panel positioning within the dashboard and the chart_type default, which are minor given the schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load, and it does for the non-obvious parameters: x_column (x axis), y_columns (each a plotted series), breakdown_column (splits each series), esql (the query), and space (Kibana space id, default space). Only title and dashboard_id are unmentioned, and those are self-evident; chart_type's default of 'bar' is never stated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Add an ES|QL bar/line/area panel to an existing dashboard') and then enumerates the exact semantic role of x_column, y_columns, breakdown_column, and esql. It explicitly distinguishes itself from the field-based sibling add_panel, so an agent can select it without reading either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit routing rule: 'For field-based charts use add_panel with a VizSpec,' which tells the agent when NOT to use this tool. However, it never distinguishes itself from the nearest siblings add_esql_metric_panel and add_esql_table_panel, which the agent must infer from the 'bar/line/area' phrasing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_library_panelAdd Library PanelA
Show a library visualization on an existing dashboard. The panel is linked, not copied: update_visualization changes it on every dashboard.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| dashboard_id | Yes | ||
| visualization_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the safety profile (not read-only, not destructive, not idempotent), so the bar is lower, yet the description adds genuinely useful behavior: the panel is linked rather than copied, so update_visualization mutates it across every dashboard. It does not say what happens when the visualization is already present on the dashboard, which matters given idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler, with the key distinguishing behavior (linked, not copied) front-loaded immediately after the purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, and annotations cover the safety profile; the description covers the linking semantics and the space parameter. The one gap is duplicate/already-present behavior, which is relevant for a non-idempotent add operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load; it explains that `space` targets a Kibana space by id and defaults to the default space, adding meaning the bare pattern/default in the schema does not convey. The remaining two required params are self-documenting by name and required status.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Show a library visualization on an existing dashboard') and immediately distinguishes itself from generic panel tools via 'linked, not copied'. An agent can tell this apart from add_panel and the add_esql_* siblings from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes the context (existing dashboard, linked library visualization) but never says when to choose this over add_panel or the esql panel variants, nor what the prerequisites are. Usage is implied by the resource type rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_panelAdd PanelB
Add a visualization panel to an existing dashboard.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| panel | Yes | ||
| space | No | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, idempotent=false, destructive=false and openWorld=false, so the agent knows this is a non-destructive, non-idempotent mutation. The description adds the additive/'existing dashboard' constraint and the space-targeting semantics, but says nothing about failure behavior, duplicate handling, or what happens when a panel reference is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, purpose front-loaded, followed by the one non-obvious parameter note. No filler or restatement of the name, and nothing that could be trimmed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the nested panel schema is rich, so return values and parameter structure need not be re-explained. What is missing is the routing context: for a tool with three near-identical ES|QL panel siblings and an update_panel sibling, the description should say when this generic panel builder is the right choice. Adequate but with a clear gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Top-level schema coverage is 0% (dashboard_id and panel carry no top-level description), but the nested `panel` object is documented in exhaustive detail in the schema, and dashboard_id is self-evident. The description compensates for exactly one parameter, `space`, by explaining its meaning and default, which is useful but partial given the low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Add a visualization panel to an existing dashboard'), which is unambiguous on its own. However, it does not differentiate this tool from close siblings like add_esql_metric_panel, add_esql_table_panel, add_esql_xy_panel, or create_visualization, so an agent cannot tell which add-panel variant applies without opening the schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage context given is the `space` default behavior. There is no guidance on when to choose this tool over the ES|QL panel variants or over create_visualization, nor any prerequisite (e.g. the dashboard must already exist, which is only implied). The 'existing dashboard' phrasing hints at a precondition but never states it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_dashboardCreate DashboardAIdempotent
Create a dashboard from one or more visualization specs. Idempotent:
creating with the same title (case-insensitive,
whitespace/punctuation-normalized) updates that dashboard instead of
duplicating it, replacing its panels (filters, query, tags and display
options are preserved); the return's status is
created or replaced. Call describe_data_view first to learn real
field names.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| title | Yes | ||
| panels | Yes | ||
| time_range | No | ||
| description | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-readOnly and idempotentHint=true, but the description goes well beyond them: it specifies the normalization rules (case-insensitive, whitespace/punctuation-normalized), the exact side effect (panels replaced, but filters/query/tags/display options preserved), and the return `status` values `created`/`replaced`. This is high-value behavioral context for a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose, then layers idempotency, prerequisite, and space semantics. Each sentence is substantive, though the idempotency clause is dense with parenthetical detail that could be tightened marginally.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be documented (the description still usefully names the `status` values). The description covers the mutation semantics, idempotency, prerequisite, and space scoping; only the undocumented top-level params (time_range, description) leave a small gap for a 5-param tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Top-level schema description coverage is 0%, so the description must carry the load, and it only clarifies `space` (targets a Kibana space by id, defaulting to the default space). It says nothing about `time_range` defaults/semantics or the `description` parameter, leaving those to inference despite the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Create a dashboard') and scopes it to input from 'one or more visualization specs', which distinguishes it from siblings like create_visualization (single viz) and add_panel (mutating an existing dashboard). An agent can tell what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit prerequisite ('Call describe_data_view first to learn real field names') and explains the idempotent routing behavior (same title updates rather than duplicates), which steers correct invocation. It does not, however, explicitly contrast against sibling tools such as add_panel or create_visualization for building up dashboards incrementally.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_data_viewCreate Data ViewA
Create a Kibana data view over an index pattern (e.g. 'logs-*'). Optionally set a display name and a time field (for time-series data). The time field must be a date field of the indices the pattern matches: a field they do not have, or one that is not a date, is refused with the pattern's date fields listed, and no data view is created. A pattern that matches no index yet is accepted, but its time field cannot be checked. The name (it defaults to the index pattern) must be unused; to change an existing view, call update_data_view.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| space | No | ||
| time_field | No | ||
| index_pattern | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=false, destructiveHint=false, openWorldHint=false, idempotentHint=false), and the description goes well beyond them: it discloses the time_field validation failure mode (refused with the pattern's date fields listed, no data view created), the edge case of a pattern matching no index (accepted but time field unchecked), and the unused-name constraint. This is exactly the failure/auth-adjacent context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core action is front-loaded in the first sentence, and the following sentences each add a distinct constraint rather than padding. It is dense but every clause (validation, name uniqueness, space) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the description covers all four parameters, the create/update boundary, validation failure behavior, and space scoping. Nothing needed to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden and does: name (defaults to the index pattern, must be unused), time_field (must be a date field of the matched indices), space (targets a Kibana space by id, default is the default space), and index_pattern (example given). All four parameters gain meaning beyond the bare types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a Kibana data view over an index pattern') and gives a concrete example ('logs-*'). It also distinguishes itself from the sibling update_data_view, which handles modifying existing views.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes modification of an existing view to update_data_view, which is the key alternative an agent might confuse this with. It does not spell out general when-not-to-create conditions, but the create-vs-update boundary is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_short_urlCreate Short UrlA
Create a Kibana short URL. Supports
locator_id='LEGACY_SHORT_URL_LOCATOR' with params={'url': '/app/...'}
(a Kibana app path). (Technical-Preview API.) A slug created in a space
resolves under /s/<space>/goto/<slug> and via
resolve_short_url(slug, space=…). When space is set, pass the app path
WITHOUT a /s/<space> prefix — the space parameter chooses the space,
not the path. A /s/<id>-prefixed path passed without space creates
the slug in the default space.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| params | Yes | ||
| locator_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the write/non-idempotent/closed-world profile, so the bar is lower. The description adds real context beyond that: the Technical-Preview API status, where the created slug resolves (/s/<space>/goto/<slug>), and the space-routing consequences of path prefixes. It does not call out that repeated calls produce distinct slugs (relevant given idempotentHint=false), which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded and each subsequent sentence carries a distinct, non-redundant rule about space/prefix handling. The middle section is dense and reads as an undifferentiated block of edge cases rather than being broken into clean, scannable statements.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. For a preview mutation tool with a free-form params object, the description supplies the space semantics, locator pattern, and resolution behavior an agent needs to call it correctly; only the non-idempotency implication is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage the description must carry the load, and it does: it documents locator_id (LEGACY_SHORT_URL_LOCATOR), the expected params shape ({'url': '/app/...'}), and the space parameter's prefix interaction rules. It is not exhaustive, though, since params is an open object (additionalProperties: true) and no keys beyond url are described.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Create a Kibana short URL') and immediately distinguishes itself from the sibling resolver by naming resolve_short_url as the consumption side. An agent can tell what this does and how it relates to sibling tools without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides substantial conditional guidance on correct invocation (when space is set, drop the /s/<space> prefix; a /s/<id> path without space lands in the default space), which is genuinely useful. However, it never states when to prefer this tool over alternatives or any exclusion, so tool-selection guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_visualizationCreate VisualizationB
Create a reusable visualization in the library (not on a dashboard).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| spec | Yes | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, destructive=false, and idempotent=false, so the mutation profile is largely covered. The description usefully adds that the artifact is created in the library (reusable, not dashboard-scoped) and that `space` defaults to the default space, but it says nothing about permissions, duplicate-title behavior, or where the created object can be found afterward.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the core action and its dashboard exclusion come first, then the parameter note. Every element earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, and the nested spec schema is richly documented. However, for a non-idempotent creation tool with a complex required nested object, the description omits any note about permissions, failure modes, or what to do with the created object — leaving gaps the schema cannot cover.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Top-level schema coverage is 0%: the required `spec` object has no description in either the schema or the description, so the description only compensates for the `space` parameter (id targeting, default space). The shape of `spec` is discoverable from its extensive nested field descriptions, but the description itself adds no meaning for the primary required parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ("Create a reusable visualization in the library") and explicitly scopes it away from dashboard placement with "(not on a dashboard)", which meaningfully separates it from add_panel and create_dashboard siblings. It stops short of naming the alternative tools outright.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical "(not on a dashboard)" implies when-not to use this in favor of panel tools, but no explicit when-to-use, prerequisites, or named alternatives are given. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_data_viewDescribe Data ViewARead-only
Get a data view's fields and types. Call this before creating a visualization so you use real field names.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| data_view | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds workflow context (a read-only pre-flight check before visualization creation), but says nothing about auth requirements, failure behavior for unknown data views, or result size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, with the core purpose front-loaded and the workflow hint and parameter note following economically.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be described, and annotations cover the read-only nature. The remaining gap is the undocumented `data_view` parameter; otherwise adequate for a simple two-param read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning. It explains `space` well (Kibana space by id, default space), but never explains `data_view` beyond the tool's overall purpose, leaving one of two parameters implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'Get a data view's fields and types.' An agent can immediately tell this apart from list_data_views and create_data_view without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to call it: 'Call this before creating a visualization so you use real field names.' This ties it to the create_visualization sibling workflow. No exclusions or alternative-name routing (e.g., vs list_data_views), so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_saved_objectsExport Saved ObjectsARead-only
Export saved objects (dashboards, data views, …) as an NDJSON file
on the server, and return a summary + an opaque handle — NOT the
content — that you pass to import_saved_objects. Select EITHER types
(e.g. ["dashboard"], or ["*"] for the whole space) OR objects
(a list of {"type":…, "id":…}), not both. This is a sensitive export
surface; what can actually be read is bounded by the API key's
privileges, not by this tool.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| types | No | ||
| objects | No | ||
| include_references_deep | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=true, openWorldHint=false), and the description adds valuable behavior beyond them: the result is a server-side NDJSON file with an opaque handle rather than inline content, and the readable scope is bounded by the API key's privileges rather than this tool. It does not, however, describe file lifetime, size limits, or pagination of the underlying export.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the key distinction (returns a handle, not content), followed by the parameter-selection constraint and the space note. Dense but nearly every sentence carries load; the terse backtick fragments are slightly abrupt but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter export tool with an output schema present, the description supplies the workflow (handle to import), the space context, and the parameter-selection rule, so an agent can call it correctly. The only material gap is the unexplained include_references_deep parameter, plus non-essential export mechanics that the output schema can cover.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for three of four params: space (targets a Kibana space by id, defaults to default space), types (with concrete examples and the ["*"] wildcard), and objects (list of {"type":…, "id":…}), plus the exclusivity rule between types and objects. include_references_deep is never explained, leaving one undocumented parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (export) and resource (saved objects: dashboards, data views) and, crucially, clarifies the output shape: an NDJSON file on the server plus a summary and opaque handle, not the content itself. It explicitly names the sibling it feeds (import_saved_objects), so an agent can distinguish export from import and from search/get tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditional guidance: select EITHER types (e.g. ["dashboard"] or ["*"] for the whole space) OR objects, not both, and explains that the returned handle is passed to import_saved_objects. It also notes the space-default behavior. It stops short of stating when NOT to use this tool versus read-only siblings like search_dashboards or get_dashboard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboardGet DashboardARead-only
Get a dashboard summary: title, description, and its panels.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is fully covered by structured data. The description adds the shape of the result (title, description, panels) and the space targeting/default, which is modest extra context, but nothing on failure modes or scoping limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose and the result contents, then the one parameter note that needs explanation. No filler, no redundancy with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only single-resource getter with an output schema present, the definition covers purpose, result content, and the space-scoping default. The only real gap is that dashboard_id semantics rest entirely on its name, which is low risk here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden. It fully explains `space` (a Kibana space id, defaulting to the default space), which is the non-obvious parameter, but says nothing about `dashboard_id` beyond implying it identifies the dashboard. Partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb (Get) with a specific resource (dashboard) and even enumerates the return content (title, description, panels). It is clearly distinguished in kind from create_dashboard/search_dashboards by name and phrasing, though it never explicitly names a sibling to contrast with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: fetching a single dashboard by id is evident from the name and the summary language, but there is no explicit 'use this instead of search_dashboards when…' routing or any precondition. Adequate but leaves the agent to infer when this tool is preferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_visualizationGet VisualizationBRead-only
Get a library visualization: title, chart type, data view, metrics, group_by and filter query.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| visualization_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful context by listing which attributes a visualization carries, but says nothing about not-found behavior, cross-space lookup, or other operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the returned fields and the space-scoping note. Every clause earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be detailed, and annotations cover the read-only safety profile. The space default is documented; the only real gap is the undocumented visualization_id parameter and any error/not-found behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load, and it does explain that `space` targets a Kibana space by id with the default space as fallback. However, visualization_id is left entirely undocumented in both description and schema, leaving one of two parameters unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Get) and resource (a library visualization) and enumerates the fields returned (title, chart type, data view, metrics, group_by, filter query), so an agent can tell it retrieves a single saved visualization rather than searching. It does not name the sibling search_visualizations or otherwise differentiate explicitly, which keeps it below a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given. The 'Get' verb implies single-item retrieval, but nothing tells the agent to use search_visualizations to locate an id first or how this differs from get_dashboard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
import_saved_objectsImport Saved ObjectsA
Import a previously-exported set of saved objects, identified by the
handle returned from export_saved_objects, as NEW copies (regenerated
ids — a clone into the current space, not an in-place restore). Existing
objects are never touched. Returns which objects were created (source id
-> new destination id). A missing/expired handle errors. To restore in
place instead, use overwrite_saved_objects (destructive). A handle
carries no space — importing it with space="b" clones its content into
b (new ids), regardless of which space it was exported from.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No | ||
| handle | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (destructiveHint=false, idempotentHint=false), and the description goes further: existing objects are never touched, ids are regenerated, the return maps source id -> new destination id, and a stale handle errors. The space-independence of a handle is non-obvious behavioral context that could not be inferred from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well front-loaded with the semantics of the operation before the alternatives, and every sentence carries information. It is dense and slightly repetitive in restating 'clone' versus 'existing objects never touched', but it stays well within a useful length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still briefly notes the return shape (source id -> new id), and it covers handles, error cases, space targeting, and the destructive alternative. Nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the full burden and does: `handle` is defined as the value returned by export_saved_objects, with its error behavior and space-independence spelled out; `space` is defined as a Kibana space id with the default space as fallback. Both parameters are documented beyond their bare types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (import saved objects) and immediately qualifies the mode: creates NEW copies with regenerated ids rather than an in-place restore. It explicitly distinguishes itself from the sibling overwrite_saved_objects, so an agent can choose without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative ('To restore in place instead, use overwrite_saved_objects (destructive)') and the condition that selects it. It also defines when the handle is valid and what happens when it is not (missing/expired handle errors).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_data_viewsList Data ViewsARead-only
List Kibana data views (the datasets you can visualize).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds one behavioral detail beyond that: the `space` parameter defaults to the default space, which is useful scoping context but not rich disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, purpose first, parameter detail second, with no filler. Everything earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations cover the safety profile. For a single-optional-parameter list tool the description is nearly complete; only explicit sibling routing is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameter burden, and it does: it explains that `space` targets a Kibana space by id and states the default behavior. That meaningfully compensates for the undocumented schema, though it doesn't note the id pattern constraint present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ("List Kibana data views") and even defines the concept parenthetically ("the datasets you can visualize"), which helps an agent unfamiliar with Kibana. It does not explicitly contrast with sibling tools like describe_data_view or create_data_view, though the verb 'list' implies the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the verb: use this to enumerate all data views, versus describe_data_view for one. However, the description never states when to prefer this over siblings or any preconditions, so the guidance remains inferential.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_short_urlResolve Short UrlARead-only
Resolve a Kibana short-URL slug to its locator and target app path. (Short URLs are a Technical-Preview API.)
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful context beyond them: the API is Technical Preview, and the `space` parameter defaults to the default space, which is behavioral detail the annotations do not supply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences plus a parenthetical caveat, with the core action front-loaded. Nearly every phrase earns its place; the parenthetical preview note is short and material.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the read-only profile. The description covers purpose, the preview caveat, and the space default, though it omits error behavior for an unresolvable slug.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden. It explains `space` well (targets a Kibana space by id, defaults to the default space), but says nothing about `slug` beyond its self-evident meaning from the purpose sentence. Partial compensation for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("resolve") and resource ("Kibana short-URL slug") and names the output ("its locator and target app path"), which is far more than a restatement of the name. It does not explicitly reference the obvious sibling create_short_url, but the verb alone distinguishes it from that counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never says when to use this tool versus alternatives (e.g. create_short_url) or when not to. It implies usage by describing the operation, but provides no context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_dashboardsSearch DashboardsARead-only
Search dashboards by title/description. Empty query lists all.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this is a read-only, closed-world operation. The description adds useful scope context ('Empty query lists all') and the default space behavior, but does not disclose pagination, result limits, or authentication/permission needs beyond what annotations cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly structured sentences with the core purpose front-loaded and the space default clearly called out. No filler or redundant restatement of the name or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a low-complexity, read-only search tool with an output schema and annotations, the description covers purpose, empty-query behavior, and the space default. It is nearly complete, but omits routing guidance versus get_dashboard and details about query matching.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining both parameters: query searches title/description and lists all when empty, and space targets a Kibana space by id with the default space as fallback. It leaves query matching semantics (substring vs. exact) and null handling implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search dashboards') plus the search scope ('by title/description') and the empty-query behavior. However, it does not explicitly distinguish itself from the sibling get_dashboard, which likely retrieves a single dashboard by id.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through 'Search dashboards by title/description' and 'Empty query lists all,' but gives no explicit when-to-use guidance, no when-not conditions, and no named alternative such as get_dashboard for direct retrieval.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_visualizationsSearch VisualizationsARead-only
Search library visualizations (from create_visualization) by title. Empty query lists all.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| space | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds real behavioral context beyond that by defining the empty/null-query fallback ('lists all') and the space-scoping default. It doesn't mention result limits or pagination, but that is plausibly handled by the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, all front-loaded and all load-bearing: what is searched, the empty-query behavior, and the space scope. No filler or restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and both parameters plus the null-query case are covered. The only gap is routing guidance among the 21 siblings, which would make selection faster but isn't required to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the burden and does compensate: it explains that `query` matches on title and that null means list everything, and that `space` targets a Kibana space by id with the default space as fallback. Neither parameter's accepted format is elaborated further, but the meaning of both defaults is unambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search library visualizations ... by title') and anchors the object type by referencing create_visualization, which separates it from the dashboard and data-view siblings. It also specifies the search key (title), so the agent knows this is a lookup, not a fetch-by-id like get_visualization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Empty query lists all' tells the agent that omitting the query is a valid enumeration path, which is genuine usage guidance. However, it never contrasts this tool with get_visualization or the other search_* siblings, so the when-to-use-vs-alternative decision is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_data_viewUpdate Data ViewA
Edit an existing data view in place, by id (from list_data_views):
its display name, its index_pattern (e.g. 'logs-*') and/or its
default time_field. Only the fields you pass change. The time field
must be a date field of the view: when you change the index pattern,
the time field (the one you pass, or the current one) is checked
against the NEW pattern's fields, and on a mismatch nothing changes.
A pattern that matches no index yet is accepted, but its time field
cannot be checked (field_count is then 0). A name that defaulted to
the old pattern stays as it is; pass name to change it too. The
time field cannot be removed. Dashboard panels built by this server
keep the pattern and time field they were built with; rebuild one
with update_panel to use the new ones. Returns id, name,
index_pattern, time_field and field_count.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| space | No | ||
| view_id | Yes | ||
| time_field | No | ||
| index_pattern | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing non-obvious behavior: a time_field/index_pattern mismatch results in a no-op ('nothing changes'), a pattern matching no index is accepted with field_count 0, the time field cannot be removed, a defaulted name stays put, and existing dashboard panels retain the old pattern until rebuilt. This is exactly the kind of mutation consequence an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose and the id source, then proceeds through edge cases in a logical order. It is dense and slightly long, but nearly every clause communicates a distinct constraint, so little is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-param mutation with 0% schema coverage, the description covers mutability semantics, validation, no-op conditions, and side effects on dependent panels. Output schema exists, yet the description's brief return-value listing (id, name, index_pattern, time_field, field_count) reinforces the post-update state without being redundant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load, and it does: it identifies view_id's origin, illustrates index_pattern ('logs-*'), constrains time_field to a date field of the view, explains name's default-retention behavior, and defines space as a Kibana space id defaulting to the default space. All five parameters gain meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Edit an existing data view in place, by id') and immediately disambiguates from siblings by pointing to list_data_views as the id source and update_panel for dashboard rebuilds. An agent can distinguish this from create_data_view and describe_data_view without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context: partial-update semantics ('Only the fields you pass change'), where the id comes from, and routes to update_panel when panels need rebuilding. It stops short of an explicit when-not-to-use or a prerequisite/permission statement, so it is strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_panelUpdate PanelAIdempotent
Replace the visualization at panel_index (see get_dashboard for indexes).
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| panel | Yes | ||
| space | No | ||
| panel_index | Yes | ||
| dashboard_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the mutation profile (readOnlyHint=false, idempotentHint=true, destructiveHint=false, openWorldHint=false). The description adds that the operation replaces rather than merges a panel and that space defaults to the default Kibana space. It does not say what happens to unspecified panel fields, whether an out-of-range index errors, or how existing panel ordering is affected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, the core replace semantics front-loaded, followed by the one non-obvious parameter clarification. No filler, no restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the nested panel schema is richly annotated. Still missing is any signal about failure modes (invalid panel_index, unknown dashboard_id) and the relationship to add_panel, which matters given the number of panel-creation siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Top-level schema coverage is 0%, so the description must compensate: it explains panel_index (an index obtained via get_dashboard) and space (Kibana space id, default space). It says nothing about dashboard_id, and the deeply nested `panel` structure is documented only in the schema. This is partial compensation for a real coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and target: 'Replace the visualization at panel_index'. The word 'Replace' implicitly distinguishes it from the sibling add_panel, and the pointer to get_dashboard clarifies what panel_index refers to. It does not explicitly name add_panel as the alternative, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells the agent where to find valid panel indexes (get_dashboard) and explains the default behavior of `space`, which is genuine usage context. However, it gives no explicit when-to-use/when-not guidance relative to add_panel or the esql panel tools, so the agent must infer that this is for modifying an existing panel rather than adding one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_visualizationUpdate VisualizationAIdempotent
Replace a library visualization with a new spec; its id stays the same. Dashboards that show it through add_library_panel change too; panels added with add_panel or create_dashboard are separate copies and do not.
space targets a Kibana space by id (default: the default space).
| Name | Required | Description | Default |
|---|---|---|---|
| spec | Yes | ||
| space | No | ||
| visualization_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (idempotentHint=true, destructiveHint=false, readOnlyHint=false), the description discloses non-obvious behavior: the id is preserved, dashboards referencing the viz via add_library_panel update in place, while panels added via add_panel/create_dashboard are independent copies that do not. It also documents the space-targeting behavior and default, which the agent cannot guess.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with the core action front-loaded, followed by the consequence, then the space note. No filler and nothing redundant with schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values needn't be explained, and annotations cover the safety profile, so the description is nearly sufficient. It could still note the prerequisite that the visualization must already exist (and what happens if it doesn't), but overall an agent has what it needs to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Top-level schema coverage is reported at 0%, so the description should compensate, yet it only adds meaning for `space` ('targets a Kibana space by id, default: the default space'). `spec` and `visualization_id` get no explicit description-level clarification, though the nested spec schema is richly self-documenting and 'Replace ... with a new spec' gives some framing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Replace a library visualization') and pins down scope with 'its id stays the same', which separates it from create_visualization (new object) and from panel-level edits. The propagation sentence further clarifies that this acts on the library object, not on separate dashboard copies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the replacement semantics and the propagation note, which helps an agent anticipate consequences. However, no explicit when-to-use/when-not guidance is given against close siblings like update_panel (dashboard-embedded panels) or create_visualization, so the agent must infer when this tool is the right one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.4.0- Added
add_library_panel - Added
get_visualization - Added
search_visualizations - Added
update_data_view - Added
update_visualization
16 tool updates
v0.1.0- First observed
add_esql_metric_panel - First observed
add_esql_table_panel - First observed
add_esql_xy_panel - First observed
add_panel - First observed
create_dashboard - First observed
create_data_view - First observed
create_short_url - First observed
create_visualization - First observed
describe_data_view - First observed
export_saved_objects - First observed
get_dashboard - First observed
import_saved_objects - First observed
list_data_views - First observed
resolve_short_url - First observed
search_dashboards - First observed
update_panel
TDQS
Scored across 21 tools
Most tools have clearly distinct purposes, but add_panel and add_library_panel overlap (both add a visualization to a dashboard), and the three add_esql_*_panel tools could be seen as variants of one operation. Their descriptions do help clarify the intended use cases.
All tools use snake_case with a predictable verb_noun pattern (add_*, create_*, update_*, get_*, search_*, list_*, describe_*, export_*, import_*, resolve_*). There are no mixed conventions or inconsistent verb styles.
21 tools is heavy for this surface; the three ES|QL panel tools and separate export/import saved-object tools add niche operations that could be consolidated. While each tool has a purpose, the set is over-segmented relative to typical scoped MCP servers.
Core create/read/update workflows exist for dashboards, visualizations, data views, and panels, but deletion is entirely absent (no delete_dashboard, delete_visualization, delete_data_view, delete_panel, delete_saved_objects). There is also no explicit update_dashboard by id, leaving lifecycle gaps.
Maintenance
Related MCP Connectors
Gateway between LLM agents and world data through eight tools and a bundled endpoint catalog.
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
Access Pollinations models and API capabilities through agent tools.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables AI assistants to interact with Kibana dashboards, visualizations, and Elasticsearch data through read-only resources and executable tools for searching logs, exporting dashboards, and querying data.710 npm3MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI agents to create and manage Kibana dashboards, Lens visualizations, and data views via the Kibana Saved Objects API. It allows for programmatically listing existing resources and assembling new visualizations into dashboards through natural language commands.-
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to manage Kibana security alerts, rules, and exception lists via the Model Context Protocol.13MIT
- AlicenseBqualityDmaintenanceEnables interaction with Elasticsearch clusters for health checks, index management, document CRUD operations, and search via natural language.105 npmMIT