MCP server for Kibana / Elasticsearch — log search, aggregations, index discovery, and dashboard browsing. Hits Elasticsearch REST API directly for log queries; falls back to Kibana
Console proxy when no direct ES URL is configured. Supports ApiKey auth (best for agents), Basic auth, and anonymous access. All 5 tools are read-only (readOnlyHint: true). Returns
structured JSON (outputSchema).
Enables AI agents to create and manage Kibana dashboards, Lens visualizations, and data views via the Kibana Saved Objects API. It allows for programmatically listing existing resources and assembling new visualizations into dashboards through natural language commands.
Provides seamless access to Kibana and Periscope logs through a unified API with KQL and SQL querying, AI-powered log analysis, and support for searching across 1.3+ billion logs in 9 indexes.
Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.
Enables querying and searching logs from Kibana (ELK stack) via MCP, with support for project-based data views, trace ID correlation, and log expansion.