PlugWiki
mcp-server-elasticsearch logo

Elasticsearch MCP Server (Deprecated): Setup for Claude, Cursor and Other Apps

OfficialLocal
Getelastic/mcp-server-elasticsearch
Tools
5
5 read · 0 change
Stars
728
on GitHub
Works in
12
apps
Risk
Low
read only

Lets Claude, Cursor and other assistants search and analyze the data in your Elasticsearch indices in plain language.

This is Elastic's original MCP server, now deprecated. It only gets critical security fixes, and Elastic points to the Agent Builder MCP endpoint for Elastic 9.2.0 and newer and Elasticsearch Serverless projects. If you still run it, it works as a Docker container with your cluster address and an API key or a username and password. It supports Elasticsearch 8.x and 9.x.

Good for

  • Teams on an older Elasticsearch setup who already use this server
  • Analysts who want to ask questions of log or search data
  • Developers testing queries against an index

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install mcp-server-elasticsearch

Claude Code

  1. 1

    Copy this prompt.

    Add the mcp-server-elasticsearch server to Claude Code. Run this command:

claude mcp add elasticsearch-mcp-server -e ES_URL=<elasticsearch-cluster-url> -e ES_API_KEY=<elasticsearch-API-key> -- docker run -i --rm -e ES_URL -e ES_API_KEY docker.elastic.co/mcp/elasticsearch stdio

Ask me for ES_URL, ES_API_KEY and only put the values in that config, nowhere else.

Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Docker, An Elasticsearch cluster.

Read-only mode: The tools only read. Use an API key with read-only access to the indices you want.

Replace the two values with your cluster address and an API key. For a username and password, set ES_USERNAME and ES_PASSWORD instead of ES_API_KEY. The README has an HTTP mode as well, and it uses mcp-proxy for Claude Desktop on the free plan.

From the project README. Source.

Tools

  • Lists your indices

    Shows all the Elasticsearch indices available on the cluster.

    Try: “What indices do I have in Elasticsearch?”

    Network · list_indices

  • Shows the fields of an index

    Returns the field mappings for one index, so the assistant knows what it can search.

    Try: “What fields does the orders index have?”

    Network · get_mappings

  • Searches an index

    Runs an Elasticsearch search using query DSL.

    Try: “Find the 10 most recent error logs in the app-logs index.”

    Network · search

  • Runs an ES|QL query

    Runs an ES|QL query and returns the result.

    Try: “Count orders per country for the last 7 days.”

    Network · esql

  • Shows shard information

    Returns shard information for all indices or specific ones.

    Try: “Show the shards for the orders index.”

    Network · get_shards

Read from the source code

Permissions

low risk · 2 things to watch

Low risk

The five tools only read data and settings, but they reach every index your credentials can see. Use an API key limited to read access on the indices you want to expose.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • The server is deprecated

    Elastic says it only receives critical security updates. Move to the Elastic Agent Builder MCP endpoint if your Elastic version supports it. raw.githubusercontent.com

  • The SSL skip option weakens security

    ES_SSL_SKIP_VERIFY turns off certificate checks. The README says to use it only for development or testing. raw.githubusercontent.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Turning on read-onlyThe tools are read-only. Limit access with a read-only API key.
Talks toYour Elasticsearch cluster (ES_URL)
Sign-in and keysES_API_KEY, or ES_USERNAME and ES_PASSWORD, in environment variables passed to the container. The README says they are not persisted to disk or logged.
Scopes

  • The permissions of the Elasticsearch API key or user you provide

Questions

Is the Elasticsearch MCP server official?

Yes. It is published by Elastic, but the README marks it deprecated.

Why is it deprecated and what replaces it?

Elastic says it only receives critical security updates and has been superseded by the Elastic Agent Builder MCP endpoint. That endpoint is available in Elastic 9.2.0 and newer and in Elasticsearch Serverless projects.

What credentials does it need?

Your cluster address (ES_URL) and either an API key or a username and password. The README advises an API key with read-only access to specific indices.

Can it change or delete my data?

The five tools only list, read and search. Use a key with read-only access to keep it that way.

Does it run locally or hosted?

You run it yourself as a Docker container, with a stdio or an HTTP mode. The README writes its steps for AWS, but any machine with Docker works.

Which Elasticsearch versions does it support?

The README lists Elasticsearch 8.x and 9.x, and says the instructions apply to server version 0.4.0 and later.

Information

updated Nov 2, 2026

Publisher
Official
Transport
stdio, Streamable HTTP
License
Apache-2.0
Last commit
Oct 28, 2026
Open issues
10

WebsiteGitHubChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 1
  1. raw.githubusercontent.com · raw.githubusercontent.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.