Kibana MCP servers: which one to use
Use the MCP server built into Kibana if you can. Pick a community server for read-only log search or to manage saved objects from your own machine.
- Servers
- 6
- active
- Official
- 1
- by Kibana
- Hosted
- 1
- nothing to install
- Local
- 3
- runs on your machine
Elastic builds an MCP server into Kibana through Agent Builder. Your assistant connects to your own Kibana address, and it can run Agent Builder tools such as an ES|QL query against your data. Sign in with an API key, or with OAuth if you use an Elastic Serverless project. The community servers connect to a Kibana you already run. Three of them are read-only, and TocharianOU can also create, update and delete saved objects.
Good for
- Engineers who want an assistant to search logs and explain errors from Kibana data
- Elastic and Serverless users who want to query their data from Claude, ChatGPT or Cursor
- Teams that need a strictly read-only log reader
- Admins who manage dashboards and saved objects
Which Kibana MCP server to use
Use Elastic's built-in server unless you only want a local, read-only log reader. Pick Havesomecode or mshegolev for that, and TocharianOU to manage saved objects.
| Server | Runs | Sign-in | Can change things | Tools | GitHub stars |
|---|---|---|---|---|---|
| Elastic Agent BuilderThis page | In Kibana | API key or OAuth | – | – | – |
| TocharianOU Kibana | Local | API key | Yes | – | 85 |
| Havesomecode Kibana | Local | Username, password | No | 5 | 3 |
| mshegolev Kibana | Local | API key | No | 5 | 1 |
| adarshba Kibana | Local | API key | No | – | 1 |
| ggilligan12 Kibana Security | Local | API key or password | Yes | 8 | 13 |
All Kibana MCP servers
6 active · 1 official · official first, then by GitHub stars
- Elastic Agent Builder MCP ServerOfficialHostedAPI key
MCP endpoint built into Kibana (Elastic 9.2+ and Serverless): exposes Agent Builder tools to search and analyze your Elasticsearch data from AI clients.
mcp-server-kibanaLocalMCP server for Kibana, Access search and manage Kibana in MCP Client.
85 GitHub stars- kibana-mcp
MCP Server for Kibana SecOps
13 GitHub stars - kibana-mcp-server
Give kibana logs access to your agent
3 GitHub stars - kibana-mcpLocal
MCP server exposing Kibana capabilities over stdio
1 GitHub stars - kibana-mcpLocal
Kibana/Elasticsearch MCP — log search, aggregations, index discovery, dashboards.
1 GitHub stars
Questions
Is there an official Kibana MCP server?
Yes. Elastic builds one into Kibana as part of Agent Builder. It works on Elastic Stack deployments and on Serverless projects, and it lets an outside assistant run your Agent Builder tools, for example an ES|QL query against your data.
What is the Kibana MCP server URL?
It is your own Kibana address followed by /api/agent_builder/mcp. For a custom Kibana space, put /s/ and the space ID before /api. With OAuth, copy the URL that Kibana shows for your OAuth client instead of building it.
Does it work in Claude, ChatGPT and Cursor?
Yes, on Serverless projects with OAuth. Elastic documents setup for the Claude Code CLI, the Claude desktop app, claude.ai, ChatGPT and Cursor, and the client must support a pre-registered client ID. Claude's connector directory also lists an Elastic Cloud Serverless connector.
Do I need an API key or OAuth?
Either. An API key works on both Elastic Stack and Serverless, but every caller shares one identity. OAuth works on Serverless only, and each person signs in and acts with their own permissions.
Which Kibana MCP server is read-only?
Havesomecode says it makes no Elasticsearch or Kibana writes, and the mshegolev and adarshba READMEs say all their tools are read-only. Check TocharianOU before you use it, because it can create, update and delete saved objects.
Can it delete dashboards or saved objects?
TocharianOU can. Its tools include creating, updating and bulk-deleting saved objects such as dashboards and visualizations, plus a tool that runs custom Kibana API requests. Use a Kibana user with limited privileges.
Which one works with AWS OpenSearch Dashboards?
adarshba's kibana-mcp lists support for Kibana 7.10 or later, Kibana 8.x and AWS OpenSearch Dashboards. It signs in with an API key, a username and password, or a browser session cookie.
Elastic's built-in server or TocharianOU?
Elastic's is made by Elastic and exposes Agent Builder tools. TocharianOU is a community project that says it is not an official Elastic product, and it exposes the Kibana API itself, including spaces, saved objects and dashboard health checks.