Connect Elasticsearch to Claude

Since version 9.2 Elastic ships its own MCP server in Kibana (Agent Builder). On self-managed clusters, however, it is part of the Enterprise licence. If you run Elasticsearch on the free Basic licence, there is no ready MCP server, and Elastic’s earlier open server is deprecated.

For these cases XenMCP plans a server built on the Elasticsearch REST API: you add the address and a read-only API key, XenMCP starts the server in an isolated sandbox and gives you an address with OAuth – everyone signs in as themselves.

Your cluster does not have to be open to the whole internet: XenMCP connects from a fixed IP address.

What you can ask Claude

• Which errors did the checkout service log in the last hour, grouped by message?
• Show me the logs around the crash today at 03:12.
• Which indices are there, how large are they, and which fields does logs-app have?
• How many requests with a 5xx status were there per hour since yesterday?
• Write an ES|QL query for the slowest endpoints and run it.

Typical tools

search

Search documents with Query DSL (hit count capped)

esql

Run ES|QL queries

list_indices

Show indices, size and document count

get_mappings

Show the fields and types of an index

Write, delete, manage indices

Not provided

What you need to connect

• The address of your cluster (https://es.your-company.com:9200)
• An API key with read-only privileges (read, view_index_metadata) on the indices you choose
• XenMCP’s fixed IP address allowed in your firewall or reverse proxy

Security

• Read-only: the server has no write tools and the API key can only read – a mistake on one side still allows no changes.
• The API key’s privileges decide which indices Claude can see.
• No open cluster needed: allow only XenMCP’s fixed IP.
• Everyone signs in as themselves via OAuth; whoever leaves the team loses access without you rotating the key.
• Logs can contain personal data. Results go to your AI client – only allow the indices that are needed.
• The call log keeps only tool, status and duration – no queries and no results.

Built on

There is no open server for this system yet that meets our criteria. We are building one on the official API.

Frequently asked questions