Skip to main content
Glama

mcp-for-kibana

An MCP server for Kibana: composable toolboxes over a hexagonal core, powered by kibana-py.

Documentation Status

Disclaimer: This is an independent, community-driven project and is not officially affiliated with, endorsed by, or supported by Elastic N.V. or any of its subsidiaries. "Kibana" and "Elasticsearch" are trademarks of Elastic N.V. This project is provided "as is", without warranty of any kind. See LICENSE. The name "mcp-for-kibana" uses "Kibana" referentially — this is an MCP server for Kibana, per Elastic's trademark guidelines on referential use — and does not imply origin or endorsement.

The distribution is mcp-for-kibana; the Python import package is kibana_mcp.

Technical Preview: the dashboards toolbox is built entirely on Kibana 9.4's new public Dashboards API and Visualizations API, both marked x-state: Technical Preview by Elastic — their request/response shapes may still change in a later Kibana release without notice, and they carry no support SLA. This server targets Kibana 9.4+ only; earlier versions don't expose these APIs publicly at all.

Status

v0.1.0 — 10 toolboxes, 133 tools, live-tested. The server exposes 133 tools across 10 composable toolboxes (dashboards, data management, alerting, cases, security detections, fleet, streams, observability, platform admin, and platform health), each classified read / write / destructive and contract-tested against a live Kibana 9.4.3. It's packaged as a stdio and container-runnable server. See the Tool reference below.

The flagship path is dashboards from plain English: an LLM goes from a request ("average ticket price by carrier, last 7 days") to a real Kibana dashboard through the read → validate → translate → write flow. That path passed its end-to-end gate 3/3 on 2026-07-10: a real local LLM in LM Studio (openai/gpt-oss-20b) drove it autonomously — plain English in, correct live dashboard out, verified against the stored Lens payload and cleaned up — three consecutive runs (16s/9s/7s wall). See docs/e2e-setup.md for the one-time LM Studio setup (permission toggles + API token) and tests/e2e/test_lmstudio.py for the harness. Model note: gpt-oss-20b's parser-enforced tool grammar made it 3/3 reliable; qwen2.5-coder-14b completes the flow too but corrupts its tool-call markers about one run in three.

Related MCP server: Kibana Dashboard Builder

What it does

Lets an LLM work with Kibana through a small, reliable, purpose-built tool surface instead of ~610 raw endpoints — 133 tools grouped into 10 composable toolboxes you enable per deployment. The flagship dashboards toolbox lets a user describe the chart they want, and the server translates a simple declarative spec into real Kibana Lens visualizations and dashboards via the modern Dashboards API (Kibana 9.4+). The other toolboxes cover data management, alerting, cases, security detections, fleet, streams, observability, and platform admin/health.

Design pillars:

  • Composable toolboxes — groups of tools enabled/disabled per deployment via configuration; small local models get a small surface, big models can get more.

  • Hexagonal core — pure domain logic (spec → Lens translation) isolated from both the MCP adapter and the kibana-py gateway; every layer independently testable.

  • Two run modes, one codebase — stdio for a local single user, streamable HTTP in a container for multiple users. Stateless: each request carries the caller's own Kibana API key, so Kibana RBAC and audit logging stay per-user. No multi-tenancy. Exception: saved-objects export handles live in one server-side directory shared by all callers — a handle is a bearer token for that export, and the 20-file retention cap is global, so concurrent HTTP callers can expire each other's handles.

  • Tiered write safety — every tool is classified read / write / destructive; deployment config caps the tier, and tools above the cap are never advertised to the model or callable by it (registered like every other tool, then hidden via FastMCP's visibility API — not just denied at call time).

Requirements

  • Python 3.12+ (the server itself is pure Python and OS-independent)

  • For the dev workflow (Makefile, scripts, local stack): a POSIX shell, GNU make, and Docker with ~5 GB free memory for the Elasticsearch + Kibana stack. Windows: use WSL2.

  • A Kibana 9.4+ deployment (or the bundled disposable local stack).

Quick start

New here? The User Guide walks you from zero to your first talked-into-existence dashboard in ~10 minutes, on a disposable local Kibana with sample data.

export KIBANA_URL=https://your-kibana.example.com
export KIBANA_API_KEY=<your Kibana API key>
uvx mcp-for-kibana
# or from a local checkout:
uv run mcp-for-kibana

Runs stdio by default — one process per user, talking to Kibana as that user's own API key. See Configuration for every setting.

Claude Code

claude mcp add kibana --env KIBANA_API_KEY=<your key> -- uv --directory /path/to/checkout run mcp-for-kibana

LM Studio

Add an entry to ~/.lmstudio/mcp.json — see docs/examples/mcp.json for a stdio and an HTTP example. For the full local E2E setup (real model, real Kibana, real dashboard), see docs/e2e-setup.md.

Any other MCP client (streamable HTTP)

Point the client at http://<host>:8000/mcp with header Authorization: ApiKey <your Kibana API key> — see Docker below for running the HTTP server.

Tool reference

133 tools across 10 toolboxes, each tool classified by tier — read / write / destructive (64 / 40 / 29). Enable toolboxes per deployment with KIBANA_MCP_TOOLBOXES; cap the tier with KIBANA_MCP_TIER. A tool above the cap is not merely denied at call time — it never appears in the tool list (registered, then hidden via FastMCP's visibility API).

Toolbox

Tools

What it does

dashboards

11

Build Lens visualizations + dashboards from a declarative spec — the flagship plain-English → dashboard path.

data-management

10

Data views + short URLs (the datasets you visualize).

alerting

11

Alerting rules and connectors.

cases

6

Kibana Cases: create, comment, update status.

security-detections

25

Detection rules, exception lists, value lists.

fleet

35

Fleet agents, agent/package policies, outputs, enrollment.

streams

12

Streams list / summary / ingest config + processing (Tech Preview).

observability

10

SLOs, alerts, and observability reads.

platform-admin

10

Spaces, roles, upgrade readiness.

platform-health

3

Cluster and Kibana status / health reads.

A tier includes everything below it: read registers only read tools, write (the default) adds write, destructive adds destructive. The default toolbox set is dashboards,data-management (coupled — building a viz needs a data view).

See the full per-tool reference for every tool's arguments and return shape.

Configuration

All settings are read once, in kibana_mcp.config.Settings, and are set via env vars (prefix KIBANA_MCP_ for the deployment-shaped ones; KIBANA_URL, KIBANA_API_KEY, and KIBANA_PUBLIC_URL are recognized both bare and prefixed, matching how Kibana's own tooling names them):

Var

Default

Meaning

KIBANA_URL

http://localhost:5601

Kibana base URL the server connects to.

KIBANA_PUBLIC_URL

(falls back to KIBANA_URL)

URL used to build human-clickable dashboard links, if different from the URL the server itself reaches Kibana on (e.g. behind a proxy).

KIBANA_API_KEY

(none)

stdio mode: the API key used for every request. HTTP mode: ignored unless KIBANA_MCP_ALLOW_ENV_KEY_HTTP=true — each caller sends their own key.

KIBANA_MCP_TOOLBOXES

dashboards,data-management

Comma-separated list of toolboxes to register (of the 10 available).

KIBANA_MCP_TIER

write

Max tool tier to register: read, write, or destructive.

KIBANA_MCP_EXPORT_DIR

(none — a fresh, unguessable 0700 temp dir per run)

Directory where saved-objects export/import NDJSON files are written. An explicit path is created 0700, a symlink there is refused, and a pre-existing directory is tightened to 0700.

KIBANA_MCP_TRANSPORT

stdio

stdio or http.

KIBANA_MCP_HOST

127.0.0.1

Bind host (HTTP transport only).

KIBANA_MCP_PORT

8000

Bind port (HTTP transport only).

KIBANA_MCP_ALLOW_ENV_KEY_HTTP

false

HTTP mode only: opt in to letting KIBANA_API_KEY act as a shared fallback credential when a request has no Authorization header. A per-request Authorization header always takes precedence even when this is on — the env key is only a fallback for requests that omit one, never an override. Off by default so a single env key can't silently become a shared credential across callers.

KIBANA_MCP_ENV_FILE

(none)

Path to a KEY=value file loaded at startup (setdefault — explicit process env wins) so a launcher can point at the machine-written elastic-start-local/.env.seed instead of hard-copying the ephemeral dev key. Additive and off by default; see configuration docs.

KIBANA_MCP_OTEL_ENABLED

false

Export an OpenTelemetry span per tool call. Off by default (spans are non-recording, no SDK imported); needs the otel extra. KIBANA_MCP_OTEL_ENDPOINT / KIBANA_MCP_OTEL_SECRET_TOKEN / KIBANA_MCP_OTEL_SERVICE_NAME tune the OTLP export — see configuration docs.

Docker

The container always runs HTTP transport (KIBANA_MCP_TRANSPORT=http is baked into the image), stateless, on port 8000. KIBANA_API_KEY is not needed at the container level: HTTP mode expects each caller to send their own key per request, and by default ignores KIBANA_API_KEY even if it's set (set KIBANA_MCP_ALLOW_ENV_KEY_HTTP=true to opt back into it as a shared fallback):

docker run -p 8000:8000 -e KIBANA_URL=https://your-kibana.example.com \
  ghcr.io/pedro-angel/mcp-for-kibana

curl http://localhost:8000/mcp \
  -H 'Authorization: ApiKey <your Kibana API key>' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The image runs as a non-root user (mcp-for-kibana, uid 10001).

Development

make setup       # uv sync + git hooks (uv-native path)
make help        # every dev task, self-documented

No uv on the machine? ./bootstrap.sh installs just the git hooks (prek / pre-commit fallback chain).

The engineering conventions this project holds itself to are in CONTRIBUTING.md, and every one of them is enforced by a gate rather than by convention alone — see the Definition-of-Done gate below. Git & CI discipline comes from git-controls-starter.

Test matrix

Six tiers, from fastest/most-isolated to slowest/most-real:

make test              # unit — fakes only, no network; the default selection
make test-contract     # starts + seeds the docker Kibana stack itself, then -m contract
make test-e2e-replay   # replays a RECORDED model turn through a real MCP client
make test-e2e          # a REAL local model in LM Studio — see docs/e2e-setup.md
make streams-ephemeral # destructive streams path on its own throwaway stack
make fleet-ephemeral   # agent lifecycle on a throwaway 2-agent fleet stack

Everything except test-e2e runs in CI. The two ephemeral tiers own their stack's whole lifecycle (up → test → down) because their paths are destructive: they delete every wired stream, or mutate real enrolled agents, so they cannot share the dev stack. They also cannot run beside it — see scripts/fleet_ephemeral.sh for the measured memory headroom.

On the two e2e tiers. They are not redundant, and one is not a substitute for the other:

test-e2e

test-e2e-replay

Who picks the tool calls

a real local LLM

a recorded transcript

Server, MCP transport, Kibana, ES

real

real

Runs in CI

no — needs a GPU + loaded model

yes

Proves a model can reason to the calls

yes

no

Proves the model-facing surface still works

yes

yes, per-PR

The replay tier exists because the surface a model actually touches was otherwise certified only on a maintainer's laptop. It replays a turn recorded from a live gpt-oss-20b run — including the three failures that run recovered from — and asserts the tools still exist, that arguments a real model produced still validate against the live input schemas, and that the error guidance survives. That guidance is load-bearing: a model has no other way to learn your data's field names, and degrading "field 'price' does not exist … did you mean 'Carrier'?" to a bare 400 breaks self-correction for every LLM using this server. Four mutation tests confirm the tier fails when each guard is broken.

(Raw commands underneath: uv run pytest [-m contract|-m e2e|-m e2e_replay] — the suites load elastic-start-local/.env.seed + .env.local in-process; the Makefile is a thin facade.)

The docs site is a CI gate too: uv sync --group docs once, then uv run mkdocs build --strict must pass with zero warnings (uv run mkdocs serve to preview locally).

Before claiming a change "done" — and always before a release — run the Definition-of-Done gate, which certifies completion from dod.config instead of letting the author self-certify:

make dod         # GO/NO-GO over all declared criteria (definition-of-done.sh)

Every tier needing infrastructure is excluded from the default selection (addopts in pyproject.toml), so a bare pytest never silently depends on a stack. CI splits accordingly: checks.yml runs the content gates (lint, types, audit, SAST, unit across Python 3.12–3.14, docs, image build+smoke), and integration.yml provisions real stacks for the live tiers and certifies them through this same gate script with per-tier configs in .github/dod/ — so CI verdicts and make dod cannot drift.

make dod needs the dev stack up for contract/e2e/e2e_replay and down for the ephemeral tiers, so a plain run cannot satisfy both halves. To get a one-shot GO, let the gate cycle the stack for you (default-off, so it never touches infrastructure unasked):

scripts/stack.sh up && scripts/stack.sh seed
KIBANA_MCP_DOD_CYCLE_STACK=1 make dod

e2e_green is the one criterion CI cannot certify — it needs a real model. It stays required in dod.config and n/a in every .github/dod tier, so the local gate remains a strict superset of CI rather than CI quietly becoming the definition of done.

License

Apache 2.0

Available Tools

16 tools
add_esql_metric_panelA

Add an ES|QL metric panel to an existing dashboard: run an ES|QL query and show one of its output columns as a single-number metric. esql is the query (e.g. 'FROM logs | STATS total = COUNT(*)') and column names the output column to display (e.g. 'total'). For field-based charts use add_panel with a VizSpec instead. The query is NOT validated server-side — a wrong query or column yields an empty panel, so write both carefully.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
esqlYes
spaceNo
titleYes
columnYes
dashboard_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important non-obvious behavior beyond the annotations: the query is not validated server-side, a wrong query or column produces an empty panel, and the space parameter targets a Kibana space by id with a default. This gives the agent essential expectations about failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the main purpose stated first, followed by useful examples, a sibling-tool pointer, a warning, and a space parameter note. Every sentence adds value without unnecessary padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations are all false, the description sufficiently covers the tool's behavior, parameter semantics, failure modes, and relationship to add_panel. It is complete enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well by explaining `esql` and `column` with concrete examples and clarifying `space`'s default behavior. `dashboard_id` and `title` are not explicitly described, but their meaning is strongly implied by 'existing dashboard' and 'panel title' context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: 'Add an ES|QL metric panel to an existing dashboard', and clearly describes the core behavior (run query, show one output column as a single-number metric). It also distinguishes itself from the sibling add_panel by saying field-based charts should use add_panel with a VizSpec instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly gives an alternative: 'For field-based charts use add_panel with a VizSpec instead.' It also provides practical usage guidance by warning that the query is not validated server-side and that wrong input yields an empty panel.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

add_esql_table_panelA

Add an ES|QL table panel to an existing dashboard: show a query's output columns as a table. columns are the grouping/dimension columns — one table row per distinct value (e.g. ["status"]); metric_columns are the numeric value columns shown per row (e.g. ["count"]). esql is the query. It is NOT validated server-side — a wrong query or column name yields an empty panel, so write them carefully. For field-based charts use add_panel with a VizSpec.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
esqlYes
spaceNo
titleYes
columnsYes
dashboard_idYes
metric_columnsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds critical behavioral context beyond annotations: 'It is NOT validated server-side — a wrong query or column name yields an empty panel.' This is a valuable warning about failure modes. It also explains the effect of the `space` parameter. Annotations only cover read-only/destructive hints, which are false, so no contradiction. The description does not mention idempotency or side effects, but the provided annotations already handle those, and the description adds useful details about error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact but information-dense. It packs the core purpose, parameter roles, failure mode, an alternative, and the space parameter into two short paragraphs. Every sentence adds value, and the structure is logical: purpose → parameter details → caveat → alternative → namespace. No fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (ES|QL query, multiple column types) and the presence of an output schema, the description covers the essential aspects: what it does, parameter semantics, failure mode, and when to use alternatives. It does not explicitly mention prerequisites like 'the dashboard must exist', but that is implied by 'existing dashboard'. It also doesn't describe the return value, but the output schema handles that. Overall, it is sufficiently complete for an agent to understand usage and limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain parameters. It does this effectively: `columns` are grouped as 'grouping/dimension columns — one table row per distinct value' with an example; `metric_columns` are defined as 'numeric value columns shown per row' with an example; `esql` is described as the query; `space` is explained with a default. `dashboard_id` and `title` are self-explanatory given their names and the tool's purpose. This compensates well for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Add an ES|QL table panel to an existing dashboard: show a query's output columns as a table.' It distinguishes from siblings by explicitly mentioning the table panel type and naming add_panel for field-based charts. The verb 'add' and resource 'table panel' are specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage guidance: 'For field-based charts use add_panel with a VizSpec.' This directly points to an alternative tool for a different use case. It also clarifies the role of columns vs metric_columns, which helps the agent decide when to use this tool. The note about server-side validation also sets expectations for when to use it cautiously.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

add_esql_xy_panelA

Add an ES|QL bar/line/area panel to an existing dashboard: x_column on the x axis, each of y_columns a plotted series, and an optional breakdown_column to split each series. esql is the query. It is NOT validated server-side — a wrong query or column name yields an empty panel. For field-based charts use add_panel with a VizSpec.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
esqlYes
spaceNo
titleYes
x_columnYes
y_columnsYes
chart_typeNobar
dashboard_idYes
breakdown_columnNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds important behavioral context: it states that the query is not validated server-side and that a wrong query can yield an empty panel. This is critical for the agent to understand. It also mentions the space targeting behavior手动 with a default. Annotations are all false, so the description carries the burden and handles it well, though it could mention that the operation is not idempotent or destructive but that's less relevant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two clear paragraphs: the first explains the tool's purpose and key parameters, and the second covers the 'space' parameter. It avoids redundancy and is front-loaded with the main action. The only minor issue is that the space explanation is placed after the main content, but it's not off-topic.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 params, 5 required, output schema exists), the description is well-rounded. It explains the core behavior, the parameter relationships, the lack of validation, and the alternative tool. The output schema covers return values, so the description doesn't need to. It could mention the types of panels it creates (bar/line/area) more explicitly, but the chart_type parameter handles that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite the schema having 0% description coverage, the description itself explains the roles of x_column, y_columns, breakdown_column, esql, and space, which goes beyond the schema's raw definitions. It does not detail chart_type (though its enum values are self-explanatory) or dashboard_id and title, which are obvious from names, so the coverage is good but not exhaustive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates ES|QL bar/line/area panels on dashboards, mentions the key parameters (x_column, y_columns, breakdown_column), and distinguishes it from the alternative add_panel for field-based charts. It also indicates the panel type and the optional breakdown column, which is specific and helpful.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use this tool (for ES|QL-based charts) and explicitly contrasts with add_panel for field-based charts, giving a clear alternative. However, it doesn't explicitly mention when NOT to use it, such as for metric or table panels, which could be inferred from sibling tool names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

add_panelA

Add a visualization panel to an existing dashboard.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
panelYes
spaceNo
dashboard_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only, not idempotent, and not destructive. The description adds meaningful context about spaces and existing dashboards, but does not describe what happens on repeated calls, whether multiple panels can be added, or how failures affect the dashboard. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, front-loaded with the action, and contains no fluff. It communicates the main behavior and one key parameter nuance without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a complex nested panel object, the description covers the basics but omits workflow guidance such as needing `data_view` to exist, how this relates to the ES|QL panel tools, or whether a dashboard must be fetched first. The schema and annotations carry much of the load, so it is viable, but it has clear contextual gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds real value for the `space` parameter by explaining it targets a Kibana space by id and defaults to the default space. The nested panel definition is rich and well-described in the schema, so the limited description is less harmful, but `dashboard_id` receives no added semantic detail beyond the tool description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Add a visualization panel to an existing dashboard.' This is a specific verb + resource and communicates the core purpose well. It does not explicitly differentiate from sibling tools like `add_esql_metric_panel` or `add_esql_table_panel`, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'to an existing dashboard' implies the dashboard must already exist, and the space note gives targeting context. However, it does not explicitly say when to prefer this tool over alternatives such as `create_dashboard`, `create_visualization`, or the `add_esql_*` tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_dashboardA
Idempotent

Create a dashboard from one or more visualization specs. Idempotent: creating with the same title (case-insensitive, whitespace/punctuation-normalized) updates that dashboard instead of duplicating it, replacing its panels (filters, query, tags and display options are preserved); the return's status is created or replaced. Call describe_data_view first to learn real field names.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
titleYes
panelsYes
time_rangeNo
descriptionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (idempotentHint=true), the description explains the normalized title matching, that existing panels are replaced while filters/query/tags/display options are preserved, and that the return status is `created` or `replaced`. This is exactly the kind of behavioral nuance the structured fields cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: a clear one-line definition, a compact idempotency/replacement contract with return status, and a prerequisite plus `space` default. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The high-complexity tool has rich nested schema, output schema, and annotations, and the description covers the important behavioral contract and prerequisite. It is not a 5 only because top-level parameter documentation is sparse (e.g., `time_range` and `description` are not explained in prose).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% top-level description coverage, so the prose description must compensate, but it only covers `space` explicitly. `title`, `panels`, `time_range`, and `description` are left to schema inference; nested panel properties are explained in the schema, but the top-level parameter semantics are under-specified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names the exact operation ('Create a dashboard') and object ('from one or more visualization specs'), clearly distinguishing it from sibling tools like create_visualization or add_panel. The idempotent-update behavior further clarifies that this is the tool for creating/replacing whole dashboards by title.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear prerequisite ('Call describe_data_view first to learn real field names') and explains the title-matching update behavior, so an agent knows when reuse with same title occurs. It does not name sibling alternatives or state explicit when-not-to-use, but the context is sufficient for selection among dashboard/visualization/panel tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_data_viewA

Create a Kibana data view over an index pattern (e.g. 'logs-*'). Optionally set a display name and a time field (for time-series data).

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
spaceNo
time_fieldNo
index_patternYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide no safety hints (readOnlyHint=false, destructiveHint=false), so the description must disclose behavioral traits. It explains the `space` parameter but does not mention permissions, what happens if the data view already exists, whether it is idempotent, or any side effects. This leaves significant ambiguity for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact (three short sentences) and front-loads the core purpose. Every sentence adds value: the first explains the primary action, the second lists optional parameters, and the third clarifies the `space` argument. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool with one required parameter and three optional ones, the description covers the essential context: what it does, the index pattern example, and the optional fields. It does not mention error handling or prerequisites, but the output schema likely covers return values. Overall, it is complete enough for a competent agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining each parameter's role: index_pattern (with example 'logs-*'), name (display name), time_field (for time-series data), and space (targets a Kibana space by id). This adds meaning beyond the schema's bare field definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Create a Kibana data view over an index pattern' with a concrete example. This is specific and distinguishes it from sibling tools like list_data_views or describe_data_view, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case—creating a data view for an index pattern—and mentions optional settings for time-series data. However, it does not explicitly state when to use this tool over alternatives, nor does it provide exclusions or prerequisites (e.g., that the index pattern must exist).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_short_urlA

Create a Kibana short URL. Supports locator_id='LEGACY_SHORT_URL_LOCATOR' with params={'url': '/app/...'} (a Kibana app path). (Technical-Preview API.) A slug created in a space resolves under /s/<space>/goto/<slug> and via resolve_short_url(slug, space=…). When space is set, pass the app path WITHOUT a /s/<space> prefix — the space parameter chooses the space, not the path. A /s/<id>-prefixed path passed without space creates the slug in the default space.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
paramsYes
locator_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=false, etc., but the description adds valuable context: how URLs resolve under /s/<space>/goto/<slug>, the difference in behavior when space is set, and the prefix rules. However, it doesn't mention potential side effects (e.g., slug collisions, idempotency) or any output details beyond what's known. The description enhances transparency but doesn't exhaustively cover behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear definition, a parenthetical usage note, and a separate paragraph for the space parameter. Every sentence adds value, though the second paragraph is slightly repetitive. Overall, it is concise and front-loaded with the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 3 parameters and the nested params object, the description provides complete guidance on how to construct valid inputs, including the exact locator_id, the param format, and space-handling rules. It also references output behavior via resolve_short_url. The lack of detailed output schema explanation is acceptable since an output schema exists, and the description covers the complex space-scoping behavior thoroughly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate for parameter semantics. It explains the meaning of three parameters: locator_id (with exact value 'LEGACY_SHORT_URL_LOCATOR'), params (with url field), and space (targets Kibana space, with default behavior). This adds substantial meaning beyond the raw schema, which only provides types and patterns.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Create a Kibana short URL.' It specifies the required locator_id and params format, and distinguishes from the sibling tool resolve_short_url. The mention of 'Technical-Preview API' and supported locator variants adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context: indicates when to use it (creating a slug), how it interacts with spaces, and obvious distinctions from resolve_short_url (which resolves slugs). It also includes specific guidance on the `space` parameter and path prefixes, which helps agents choose this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_visualizationA

Create a reusable visualization in the library (not on a dashboard).

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
specYes
spaceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate the tool is not read-only, not open-world, not idempotent, and not destructive, which is minimal. The description adds context that the visualization is reusable and placed in the library, but it doesn't disclose what happens to existing visualizations, permissions needed, or that creating is a write action. With annotations already covering the basic traits, the description adds some value but lacks detailed behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences, zero waste. It front-loads the core purpose and adds a necessary detail about the space parameter. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity with nested objects and an output schema, the description is adequate but could be more complete. It doesn't describe return values, but the output schema likely covers that. It focuses on the creation location and the space parameter, which are key differentiators. However, it lacks guidance on required spec fields or common usage patterns, leaving some gaps for an agent to fill.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has rich descriptions for all parameters, covering 0% schema coverage in the description itself means the schema provides all the meaning. However, the description adds minimal parameter-level information beyond the schema. It only mentions that 'space' targets a Kibana space by id, which is useful context not in the schema. Given the schema is comprehensive, the description's contribution is marginal but positive for the space parameter; still, it doesn't compensate for the overall lack of parameter guidance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states "Create a reusable visualization in the library (not on a dashboard)" with a specific verb and resource, and explicitly distinguishes it from dashboard-based creation. It clearly contrasts with sibling tools like create_dashboard and add_panel, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by noting the visualization is placed in the library rather than a dashboard, which helps differentiate from sibling tools. However, it does not explicitly state when to use this tool versus alternatives like create_dashboard or add_panel, nor does it mention when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_data_viewA
Read-only

Get a data view's fields and types. Call this before creating a visualization so you use real field names.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
data_viewYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already communicate the read-only safety profile, and the description adds useful behavioral context: `space` targets a Kibana space by id and defaults to the default space. The output schema also covers return shape, so the transparency burden is reasonably met.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: one clear purpose sentence, one practical usage sentence, and one terse parameter note. There is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, read-only metadata tool with an output schema and annotations, the description covers the trigger situation and the space default well. It is slightly incomplete only because the format of the `data_view` parameter is not explicitly specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains `space` well, but it does not clarify whether `data_view` expects an ID, name, or title. The tool name and first sentence imply it identifies a data view, but this is only partial parameter guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and object: 'Get a data view's fields and types.' It also gives a concrete use case ('Call this before creating a visualization so you use real field names'), which clearly distinguishes it from siblings like list_data_views and create_data_view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The instruction 'Call this before creating a visualization' provides an explicit context for when to use the tool. It does not enumerate exclusions or alternative tools, but the guidance is clear enough for an agent to select this tool appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_saved_objectsA
Read-only

Export saved objects (dashboards, data views, …) as an NDJSON file on the server, and return a summary + an opaque handle — NOT the content — that you pass to import_saved_objects. Select EITHER types (e.g. ["dashboard"], or ["*"] for the whole space) OR objects (a list of {"type":…, "id":…}), not both. This is a sensitive export surface; what can actually be read is bounded by the API key's privileges, not by this tool.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
typesNo
objectsNo
include_references_deepNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint, it reveals that the action creates an NDJSON file on the server, that only a summary and opaque handle are returned, and that readable content is bounded by API key privileges. These are behavioral facts not present in annotations, and no contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description fits four sentences with the primary behavior and handle semantics first, followed by constraints, security caveat, and space. No sentence is redundant or tangential.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderately complex export tool with an output schema, the description covers the workflow, selection constraints, security boundary, and relationship to import_saved_objects. Only include_references_deep is not explicitly discussed, so it is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema description coverage is 0%, the description explains the main parameters: types/objects exclusivity, wildcard use, and space default. It leaves include_references_deep unmentioned, which is a minor gap given the schema provides no description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: 'Export saved objects ... as an NDJSON file on the server.' It also clarifies the return value is a summary plus an opaque handle rather than content, which clearly differentiates this from import_saved_objects and read-only dashboard/data-view tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit usage constraints: 'Select EITHER types ... OR objects ... not both,' and explains the space parameter's default. It doesn't enumerate when-not cases against sibling tools, but the workflow context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboardA
Read-only

Get a dashboard summary: title, description, and its panels.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
dashboard_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description is consistent with that. The description adds the output fields and the space targeting behavior, but does not disclose potential errors, permissions, or limitations of what 'summary' includes. Given annotations cover the safety profile, the description adds modest but not rich behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The first sentence states purpose and output, the second explains a parameter; both are necessary and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-by-id tool with output schema and annotations, the description covers the essential purpose and parameter semantics. It doesn't address usage relative to siblings or potential edge cases, but those are not critical given the low complexity and available schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no descriptions (0% coverage). The description explains the non-obvious `space` parameter by stating it targets a Kibana space by id and defaults to the default space. `dashboard_id` is not described but its meaning is self-evident from the parameter name and tool name; still, a brief mention would be better. This partially compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Get' and names the resource 'dashboard', and specifies the returned contents: 'title, description, and its panels'. This clearly distinguishes it from sibling search_dashboards and create_dashboard by being a targeted read operation on a single dashboard.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or comparison with alternatives is provided. The description implies the tool is for retrieving dashboard details, but it does not say when to prefer get_dashboard over search_dashboards or how the space parameter interacts with search. Thus usage guidance is only implied, not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

import_saved_objectsA

Import a previously-exported set of saved objects, identified by the handle returned from export_saved_objects, as NEW copies (regenerated ids — a clone into the current space, not an in-place restore). Existing objects are never touched. Returns which objects were created (source id -> new destination id). A missing/expired handle errors. To restore in place instead, use overwrite_saved_objects (destructive). A handle carries no space — importing it with space="b" clones its content into b (new ids), regardless of which space it was exported from.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo
handleYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide minimal detail (all false), so the description carries the disclosure burden. It states existing objects are never touched, creates new copies, returns a source-to-destination mapping, and errors on missing/expired handles. However, it does not explicitly mention idempotency (implied by new copies) or other potential side effects, so a 4 is fitting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured in three sentences, each delivering key information: purpose, alternative, and parameter semantics. It is front-loaded with the main purpose and critical distinction. Slightly verbose but all content is purposeful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool description covers all essential aspects: purpose, usage guidance, behavior, parameter semantics, return value, and error conditions. The output schema exists and is not needed for explanation. No significant gaps are evident, making it contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are semantically enriched: `handle` is tied to `export_saved_objects` and its error case, while `space` is explained with default behavior and interaction with the handle. This adds significant meaning beyond the minimal schema definitions, compensating for the low schema coverage signal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: import saved objects as new copies with regenerated IDs, and explicitly distinguishes this from an in-place restore by naming the alternative `overwrite_saved_objects`. It also identifies the resource (exported saved objects) and scope (current space), making it highly distinguishable from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: for cloning into a space, and when-not-to-use: for restoring in place, suggesting `overwrite_saved_objects` as the destructive alternative. It also clarifies the space-agnostic nature of handles, giving clear context for cross-space imports.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_data_viewsA
Read-only

List Kibana data views (the datasets you can visualize).

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
spaceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safe read nature is covered. The description adds the space-scoping behavior, which is useful, but does not disclose other behavioral traits such as pagination, ordering, or whether all views are returned across the entire stack.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loads the main action, and every word adds value. There is no redundant restatement of the tool name or schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with one optional parameter, an output schema, and read-only annotations, the description covers the essential semantics: what is listed, what the parameter means, and the default behavior. No significant information gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema has no descriptions and reported coverage is 0%, the description compensates by explaining the single 'space' parameter: it targets a Kibana space by id and defaults to the default space. This adds semantic meaning beyond the raw schema type and default value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'List Kibana data views' and clarifies them as 'the datasets you can visualize.' This clearly distinguishes it from sibling tools like describe_data_view and create_data_view, which operate on a single view or create one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the phrase 'the datasets you can visualize' and the space-targeting comment, but there is no explicit mention of when to choose this over alternatives such as describe_data_view or search_dashboards. No exclusions or conditional guidance are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resolve_short_urlA
Read-only

Resolve a Kibana short-URL slug to its locator and target app path. (Short URLs are a Technical-Preview API.)

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYes
spaceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description adds context by flagging Short URLs as a Technical-Preview API and specifying the resolve outcome (locator and target app path). This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core purpose, and no filler. Every sentence adds relevant information, including the technical-preview caveat and the 'space' parameter clarification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, has an output schema, read-only annotations, and the description conveys enough to select and invoke it correctly. The technical-preview warning and space behavior round out the context without needing further detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It explains 'space' (targets a Kibana space by id, defaults to the default space), which adds meaning beyond the schema. 'slug' is implied but not explicitly detailed, leaving some semantic gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Resolve') and resource ('Kibana short-URL slug') and states the output ('locator and target app path'). This distinguishes it from the sibling 'create_short_url' tool, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when a short-URL slug needs resolving, and it clarifies the optional 'space' parameter's default. However, it does not explicitly state when to use this tool over alternatives or provide any exclusions/prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_dashboardsA
Read-only

Search dashboards by title/description. Empty query lists all.

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo
spaceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description adds value by explaining the effect of an empty query (lists all dashboards) and the default space behavior. These are behavioral details not present in the schema or annotations. However, it does not describe pagination, result limits, or other side effects, which keeps it at a moderate level.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of three short, front-loaded sentences. The first sentence states the core purpose, the second clarifies a key behavior, and the third explains a parameter. No unnecessary words or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with an output schema and read-only annotation, the description covers the essential aspects: what it searches, how to list all, and the space-scoping parameter. It omits potential details like sorting or result limits, but given the output schema and the tool's simplicity, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no descriptions (coverage 0%), so the description fully compensates by explaining both parameters: 'query' searches by title/description, and 'space' targets a Kibana space by id with a default. It also clarifies the default values and behavior, adding meaning far beyond the plain type definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Search dashboards by title/description.' It uses a specific verb and resource, and distinguishes this from sibling tools like get_dashboard (which retrieves a specific dashboard) and create_dashboard (which creates one). The mention of empty query behavior further clarifies its scope as a listing/search operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (when searching by text) and provides clear context about the query and space parameters. It does not explicitly mention alternatives or exclusions, but the context is sufficient for an agent to decide to use this over other singular dashboard tools. The note about empty query listing all is a usage hint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_panelC
Idempotent

Replace the visualization at panel_index (see get_dashboard for indexes).

space targets a Kibana space by id (default: the default space).

ParametersJSON Schema
NameRequiredDescriptionDefault
panelYes
spaceNo
panel_indexYes
dashboard_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description must carry the behavioral load. 'Replace the visualization' implies mutation (consistent with readOnlyHint=false) and hints the prior visualization is gone, but it never states whether the operation is destructive to the old content, whether it's idempotent (destructiveHint=false), or whether it requires the panel to already exist. The agent must infer all of this.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact, readable sentences that front-load the main purpose and then add a useful parameter note. There is no fluff, but the brevity causes it to under-deliver on behavioral and usage context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that overwrites a visualization on a dashboard Affecting whether an existing panel is silently destroyed, how indexes are obtained, and whether the operation is idempotent, the description provides only the index source and space semantics. There is no note on outcome, error conditions, or interaction with the existing panel, so an agent lacks a full picture of what calling this does.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description clarifies two parameters: panel_index (which indexes come from get_dashboard) and space (id, defaults to default space). The nested panel fields (chart_type, metrics, group_by, etc.) already carry rich descriptions in the schema. However, dashboard_id receives no extra meaning and the interplay (e.g., does space apply to all params?) is left vague. Description partially supplements the schema, so a 3 is fair.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb 'Replace' is specific and 'visualization at panel_index' clearly identifies the target resource, with a useful pointer to get_dashboard for the index. However, the description does not name or distinguish from sibling tools like add_panel or update_panel variants, so an agent could confuse scope. Minor ambiguity: does 'visualization' mean the chart, its config, or the whole panel?

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only guidance is a cross-reference to get_dashboard for indexes. There's no statement about when this tool should be used versus the many create/add siblings, no prerequisites, and no exclusion of alternatives. Nothing tells the agent what should be fetched first (though indexing is implied) or what happens if the panel doesn't exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 16 tool updatesv0.1.0
    • First observedadd_esql_metric_panel
    • First observedadd_esql_table_panel
    • First observedadd_esql_xy_panel
    • First observedadd_panel
    • First observedcreate_dashboard
    • First observedcreate_data_view
    • First observedcreate_short_url
    • First observedcreate_visualization
    • First observeddescribe_data_view
    • First observedexport_saved_objects
    • First observedget_dashboard
    • First observedimport_saved_objects
    • First observedlist_data_views
    • First observedresolve_short_url
    • First observedsearch_dashboards
    • First observedupdate_panel

TDQS

A3.9/5.0

Scored across 16 tools

Disambiguation5/5

Each tool targets a distinct resource and action: dashboards, panels, data views, saved objects, and short URLs are cleanly separated, and the ES|QL panel variants are distinguished by panel type. Where overlap could exist (add_panel vs the ES|QL-specific panel tools), the descriptions explicitly clarify when to use which.

Naming Consistency5/5

All tool names follow a consistent snake_case verb_noun pattern: search_dashboards, create_dashboard, add_panel, list_data_views, resolve_short_url, etc. The verb prefixes are uniform and predictable, making the tool set easy to navigate.

Tool Count4/5

16 tools is slightly above the ideal 3-15 range, but the breadth is justified by the multiple Kibana subsystems covered: dashboards, visualizations, data views, saved objects, and short URLs. Each tool has a clear role, so the count feels reasonable rather than bloated.

Completeness3/5

The core dashboard-building workflow is well covered, including create/read/update, panel management, data-view discovery, and saved-object transfer. However, there are notable gaps: no delete operations for dashboards, data views, visualizations, or short URLs, and no way to remove a panel from a dashboard.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Enables AI assistants to interact with Kibana dashboards, visualizations, and Elasticsearch data through read-only resources and executable tools for searching logs, exporting dashboards, and querying data.
    7
    17
    3
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to create and manage Kibana dashboards, Lens visualizations, and data views via the Kibana Saved Objects API. It allows for programmatically listing existing resources and assembling new visualizations into dashboards through natural language commands.
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to manage Kibana security alerts, rules, and exception lists via the Model Context Protocol.
    13
    MIT
  • A
    license
    B
    quality
    D
    maintenance
    Enables interaction with Elasticsearch clusters for health checks, index management, document CRUD operations, and search via natural language.
    10
    20
    MIT