Elasticsearch MCP by rajwardhanshinde: Setup for Claude, Cursor and More

• Lists your Elasticsearch indices

  Returns the indices in the cluster, filtered by a pattern such as logs-*. System indices that start with a dot are left out unless you ask for them, and you can sort by name, size or document count.

  Try: “List the indices that start with logs- and sort them by size.”

  Network · fetch_indices

• Searches an index

  Runs a query in Elasticsearch query language against one index. It accepts paging, sorting, aggregations, highlighting and a list of fields to return.

  Try: “Search sales-data for 2024 orders and total the revenue by month.”

  Network · search_elasticsearch

• Creates an index

  Creates a new index with the mappings, settings and aliases you give it.

  Try: “Create an index called products with a text field for the name and a number field for the price.”

  Write · create_index

• Adds one document to an index

  Stores a single document in an index, with an optional ID and a choice of refresh behaviour.

  Try: “Add this customer record to the customers index.”

  Write · insert_data

• Changes an existing document

  Updates a document by ID, either by merging in new field values or by running a script. Script text is checked against a list of blocked patterns before it is sent.

  Try: “Set the status field to shipped on order 1042.”

  Write · update_document

• Deletes documents

  Deletes one document by ID, or every document that matches a query. The delete-by-query form can remove many documents in one call.

  Try: “Delete all documents in test-events where status is draft.”

  Delete · delete_document

• Saves search results as a CSV file

  Runs a query and writes the matching rows to a CSV file in the folder where the server was started, with optional gzip compression and a row limit. The file name is cleaned to letters, digits, dots, dashes and underscores.

  Try: “Export active users from user-analytics to a CSV with email and country.”

  Write · export_to_csv

Watch out for

• It can delete many documents with one query

  delete_document accepts a query and removes every match. Use an API key without delete rights on indices you cannot rebuild. github.com

• It can change and add data

  insert_data, update_document and create_index write to your cluster, and update_document can run a script. Our advice: scope the API key to read-only unless you want edits. github.com

• Export writes a file on your computer

  export_to_csv saves a CSV (or gzip) file in the folder the server starts in. Check that folder before you export private data. github.com

Security advisories