Elasticsearch MCP Server

Enhanced Elasticsearch MCP Server Solution - Security & Threat Analysis Focused

This is a professional security-focused solution maintained by TocharianOU. It enables comprehensive interaction with all Elasticsearch APIs, specifically optimized for security analysis, threat detection, and incident investigation. Features include advanced security monitoring, anomaly detection, threat hunting, root cause analysis, and comprehensive audit capabilities.

Key Security Features:

• Real-time threat detection and security monitoring
• Advanced machine learning for anomaly detection
• Root cause analysis and attack chain tracking
• Security incident investigation and forensics
• Compliance monitoring and audit reporting

Note: This solution is designed for security professionals, SOC teams, and threat analysts.

Connect to your Elasticsearch data directly from any MCP Client (such as Claude Desktop) using the Model Context Protocol (MCP). Interact with your Elasticsearch security data through natural language queries for advanced threat analysis and incident response.

Prerequisites

• An Elasticsearch instance
• Elasticsearch authentication credentials (API key or username/password)
• MCP Client (e.g. Claude Desktop) or HTTP client for remote access

Multi-Version Elasticsearch Support

Automatically supports Elasticsearch 5.x - 9.x with intelligent version detection:

Key Features:

• Automatic version detection - No manual configuration needed
• Smart client selection - Loads the right client for your ES version
• Adaptive features - Disables unsupported tools (e.g., Data Streams on ES < 7.9, ES|QL on ES < 8.11)
• Version-specific optimizations - Handles API differences transparently

What happens:

Connect → Detect ES version → Load matching client → Register compatible tools

The Query Harness (v0.9.0)

Since v0.9.0 the server ships a query harness: a deterministic layer between the AI model and your cluster. The design philosophy is simple:

The model steers; the harness knows. Intent ("find failed logins by user") belongs to the model. Correctness (real field names, aggregatability, version quirks) belongs to the harness.

What this means in practice — at the level of principles, not internals:

• Live truth beats bundled knowledge beats model memory. Every query is checked against the cluster's actual field capabilities before it runs. A bundled ECS (Elastic Common Schema) vocabulary provides meaning; the live cluster provides existence. The model's own recollection is never trusted.
• Unambiguous mistakes are fixed silently; ambiguous ones become guidance. The classic example: a spurious .keyword suffix on modern ECS mappings is auto-corrected (and the correction is reported); an unknown field blocks the doomed query and returns the nearest real fields instead of a provider error.
• Field knowledge stays out of the context window. The full ECS dictionary (thousands of fields) lives in process memory. The model retrieves only the handful it needs, on demand, via lookup_fields.
• Every failure must be actionable. Raw Elasticsearch errors are rewritten with liv

... View full README on GitHub