# Kibana Log Analysis & API Dashboard MCP Server

An MCP (Model Context Protocol) server designed for enterprise developers to connect local AI assistants directly to Elasticsearch, Kibana, and local codebases.

## ⚠️ For New Developers & Forkers

If you have just cloned this repository to use within your organization, search the codebase for `TODO:` comments. There are several places where data or settings should be manually updated to fit your company's architecture.

**The most crucial manual updates inside `src/index.ts` include:**
1. **Log Schema Customization:** Update the `.level` or `http.response.status_code` fields to match your company's logging convention.
2. **Self-Signed Certificates:** Add your internal CA cert path if your Elasticsearch instance does not use public SSL certificates.
3. **Regex Parsers for `.NET` or `Go`:** If your team uses languages other than Java/Typescript, update the `scan_code_for_apis` tool regex.

## Features
- **`search_logs`**: Search Elasticsearch indices using keywords and Lucene queries.
- **`get_log_details`**: Retrieve the full un-truncated JSON of specific log events.
- **`analyze_service_health`**: Aggregate error rates, success rates, and HTTP status codes for a given service.
- **`scan_code_for_apis`**: Scans your local Spring Boot (Java) or Express (Node.js) project to dynamically discover REST endpoints.
- **`create_api_dashboard`**: Programmatically generates a Kibana dashboard visualizing the dynamically discovered endpoints using the Kibana Saved Objects API.

## Installation & Production Setup
1. Ensure you have Node.js (v18+) installed.
2. Run `npm install`
3. Run `npm run build`
4. Copy `.env.example` to `.env` and configure your environment variables (or set them directly in your LLM Client setup).

## Configuration Map
| Variable | Description |
|---|---|
| `ELASTIC_URL` | URL to your Elasticsearch cluster (e.g., `https://es.internal:9200`) |
| `ELASTIC_API_KEY` | Auth Token with specific read scopes. |
| `KIBANA_URL` | URL to your Kibana instance. |

## Usage with Claude Desktop / Cursor
Add the following configuration to your `claude_desktop_config.json` or Cursor MCP settings:

```json
{
  "mcpServers": {
    "kibana-logs": {
      "command": "node",
      "args": ["/Users/sidhu/.gemini/antigravity/scratch/kibana-mcp-server/build/index.js"],
      "env": {
        "ELASTIC_URL": "https://your-bank-cluster:9200",
        "ELASTIC_API_KEY": "your_secure_api_key",
        "KIBANA_URL": "https://your-bank-kibana:5601"
      }
    }
  }
}
```

## Security Best Practices for Enterprise
- **Least Privilege:** Do not grant your `ELASTIC_API_KEY` delete, put, or cluster-admin privileges. It only needs `read` on application indices, and `all` access to the Kibana Saved Objects API (to create dashboards).
- **Data Masking:** If your logs contain PII (Personally Identifiable Information), you should implement a regex mask in `src/index.ts` right before returning the logs to the AI payload.