kibana-mcp-server

MCP server for accessing logs in Kibana/Elasticsearch.

Standalone binary that exposes log search tools over MCP (Model Context Protocol) via stdio or HTTP transport using JSON-RPC 2.0. Supports both Elasticsearch and Kibana backends with automatic detection.

Features

• Tool search_logs — search logs using Elasticsearch query string syntax with time range filtering and pagination
• Tool get_indices — list available indices (ES) or index patterns (Kibana)
• Tool get_log_context — get surrounding log entries for a specific document
• Auto-detection — automatically detects Kibana vs Elasticsearch backend
• Authentication — supports Basic auth, API key, and no-auth modes; per-client credentials in HTTP mode
• ECS-aware formatting — formats log entries using Elastic Common Schema fields
• HTTP transport — MCP Streamable HTTP with Bearer token authentication and session management
• Dual transport — stdio (default) or HTTP mode via --http flag

Architecture

Single crate, six source modules:

Module	Responsibility
src/main.rs	Entry point, transport selection
src/cli.rs	CLI argument parsing
src/config.rs	Configuration from environment variables
src/mcp.rs	JSON-RPC 2.0 dispatch, MCP tool definitions, async stdio read/write loop
src/http.rs	HTTP transport: axum server, Bearer auth, session management
src/kibana.rs	HTTP client for Elasticsearch/Kibana REST API
src/tools.rs	MCP tool implementations, log entry formatting

CLI Commands

kibana-mcp-server [COMMAND]

Commands:
  --stdio      Run in stdio mode (default)
  --http       Run in HTTP mode
  --version    Print version and exit
  --help       Print this help and exit

Environment Variables

Variable	Description	Mode	Required
KIBANA_URL	Kibana or Elasticsearch base URL	Both	Yes
KIBANA_INSECURE	Skip TLS verification ("true" or "1")	Both	No
KIBANA_USERNAME	Username for basic authentication	Stdio only	No
KIBANA_PASSWORD	Password for basic authentication	Stdio only	No
KIBANA_API_KEY	API key for Elasticsearch authentication	Stdio only	No
MCP_HOST	Host to bind HTTP server [default: 127.0.0.1]	HTTP only	No
MCP_PORT	Port for HTTP server [default: 8080]	HTTP only	No
MCP_AUTH_TOKEN	Bearer token for HTTP authentication	HTTP only	No

Per-client credentials (HTTP mode)

In HTTP mode, Kibana credentials are not configured via environment variables. Instead, each client provides its own credentials through HTTP headers on the initialize request:

Header	Description
X-Kibana-Username + X-Kibana-Password	Basic authentication
X-Kibana-API-Key	API key authentication

The two schemes are mutually exclusive. Credentials are stored per-session and used for all subsequent requests within that session.

Build

Prerequisites

• Rust toolchain (stable)

Build

cargo build --release

Rust Dependencies

Crate	Purpose
reqwest	HTTP client for Elasticsearch/Kibana API
serde, serde_json	JSON serialization for MCP protocol and ES queries
tracing, tracing-subscriber	Structured logging to stderr
axum	HTTP server framework for MCP HTTP transport
tokio	Async runtime
uuid	Session ID generation (UUID v4)

MCP Protocol

The server supports two transport mod

... View full README on GitHub