kibana-mcp-server

MCP server for accessing logs in Kibana/Elasticsearch.

Standalone binary that exposes log search tools over MCP (Model Context Protocol) via stdio or HTTP transport using JSON-RPC 2.0. Supports both Elasticsearch and Kibana backends with automatic detection.

Features

• Tool search_logs — search logs using Elasticsearch query string syntax with time range filtering and pagination
• Tool get_indices — list available indices (ES) or index patterns (Kibana)
• Tool get_log_context — get surrounding log entries for a specific document
• Auto-detection — automatically detects Kibana vs Elasticsearch backend
• Authentication — supports Basic auth, API key, and no-auth modes; per-client credentials in HTTP mode
• ECS-aware formatting — formats log entries using Elastic Common Schema fields
• HTTP transport — MCP Streamable HTTP with Bearer token authentication and session management
• Dual transport — stdio (default) or HTTP mode via --http flag

Architecture

Single crate, six source modules:

| Module | Responsibility | |---|---| | src/main.rs | Entry point, transport selection | | src/cli.rs | CLI argument parsing | | src/config.rs | Configuration from environment variables | | src/mcp.rs | JSON-RPC 2.0 dispatch, MCP tool definitions, async stdio read/write loop | | src/http.rs | HTTP transport: axum server, Bearer auth, session management | | src/kibana.rs | HTTP client for Elasticsearch/Kibana REST API | | src/tools.rs | MCP tool implementations, log entry formatting |

CLI Commands

kibana-mcp-server [COMMAND]

Commands:
  --stdio      Run in stdio mode (default)
  --http       Run in HTTP mode
  --version    Print version and exit
  --help       Print this help and exit

Environment Variables

| Variable | Description | Mode | Required | |---|---|---|---| | KIBANA_URL | Kibana or Elasticsearch base URL | Both | Yes | | KIBANA_INSECURE | Skip TLS verification ("true" or "1") | Both | No | | KIBANA_USERNAME | Username for basic authentication | Stdio only | No | | KIBANA_PASSWORD | Password for basic authentication | Stdio only | No | | KIBANA_API_KEY | API key for Elasticsearch authentication | Stdio only | No | | MCP_HOST | Host to bind HTTP server [default: 127.0.0.1] | HTTP only | No | | MCP_PORT | Port for HTTP server [default: 8080] | HTTP only | No | | MCP_AUTH_TOKEN | Bearer token for HTTP authentication | HTTP only | No |

Per-client credentials (HTTP mode)

In HTTP mode, Kibana credentials are not configured via environment variables. Instead, each client provides its own credentials through HTTP headers on the initialize request:

| Header | Description | |---|---| | X-Kibana-Username + X-Kibana-Password | Basic authentication | | X-Kibana-API-Key | API key authentication |

The two schemes are mutually exclusive. Credentials are stored per-session and used for all subsequent requests within that session.

Build

Prerequisites

• Rust toolchain (stable)

Build

cargo build --release

Rust Dependencies

| Crate | Purpose | |---|---| | reqwest | HTTP client for Elasticsearch/Kibana API | | serde, serde_json | JSON serialization for MCP protocol and ES queries | | tracing, tracing-subscriber | Structured logging to stderr | | axum | HTTP server framework for MCP HTTP transport | | tokio | Async runtime | | uuid | Session ID generation (UUID v4) |

MCP Protocol

The server supports two transport mod

... View full README on GitHub