Elastic documents the recommended Agent Builder Model Context Protocol endpoint at `{KIBANA_URL}/api/agent_builder/mcp` (or `{KIBANA_URL}/s/{SPACE_NAME}/api/agent_builder/mcp` for custom Kibana spaces) per elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server. The MCP server exposes built-in and custom Agent Builder tools to Claude Desktop, Cursor, VS Code, and other MCP clients via `npx mcp-remote` with an `Authorization: ApiKey` header. API keys must include the Kibana application privilege `feature_agentBuilder.read` or clients receive HTTP 403. Elastic notes the legacy `elastic/mcp-server-elasticsearch` project is deprecated in favor of this endpoint on Elastic 9.2+ and Elasticsearch Serverless; docs recommend least-privilege index scopes and API key expiration.
Use cases
- Let Cursor query observability or security indices through governed Agent Builder tools
- Expose only `logs-*` and `metrics-*` indices via scoped API keys in production
- Connect MCP clients without maintaining the deprecated mcp-server-elasticsearch container
- Use custom Kibana space URLs when tools are space-scoped
- Pair MCP access with Elastic AI features documented for 9.2+ deployments
Key features
- Cursor
- Claude Desktop
- VS Code
- Codex
Frequently Asked Questions
- What happened to elastic/mcp-server-elasticsearch?
- Elastic docs deprecate that GitHub project in favor of the Agent Builder MCP endpoint on 9.2+ and Serverless.
- Why am I getting HTTP 403?
- Docs state the API key must include Kibana application privilege feature_agentBuilder.read.
- Can I restrict which indices agents see?
- Yes—Elastic best-practice examples limit API key index privileges to required patterns such as logs-* and metrics-*.
Related
Related
3 Indexed items
dbt MCP Server
dbt Labs documents an official Model Context Protocol server at docs.getdbt.com/docs/dbt-ai/about-mcp (repository dbt-labs/dbt-mcp) that exposes governed access to dbt project metadata, lineage, CLI actions, and dbt Platform APIs for Claude, Cursor, and custom MCP clients. Local mode runs via `uvx dbt-mcp` with environment variables such as DBT_PROJECT_DIR, DBT_HOST, DBT_TOKEN, DBT_PROD_ENV_ID, and DBT_USER_ID; remote mode connects over HTTP/SSE to a managed dbt Platform MCP endpoint with OAuth. Documented tool groups include product-doc search (`search_product_docs`, `get_product_doc_pages`) and server metadata helpers, with additional development and deployment tools synced from the GitHub README per release.
Mem0 MCP Server
Mem0 documents a hosted Model Context Protocol server at https://mcp.mem0.ai/mcp that exposes Platform memory tools (`add_memory`, `search_memories`, `get_memories`, `update_memory`, `delete_memory`, `delete_all_memories`, `delete_entities`, `list_entities`, `list_events`, `get_event_status`) to Claude, Claude Code, Codex, Cursor, Windsurf, VS Code, and OpenCode. Setup uses `npx mcp-add` with HTTP transport or manual JSON/TOML client configs; Codex requires `MEM0_API_KEY` as bearer token per docs.mem0.ai/platform/mem0-mcp. The cloud server needs a Mem0 Platform API key from the dashboard and Node.js for the installer—no local vector database required for the hosted path.
MotherDuck MCP Server
MotherDuck documents a remote Model Context Protocol server at `https://api.motherduck.com/mcp` (fully managed, read-write) that lets Claude, ChatGPT, Cursor, Claude Code, Codex, and other MCP clients query MotherDuck cloud databases via OAuth or Bearer tokens with zero local install per motherduck.com/docs/sql-reference/mcp. Remote tools include read-only `query` and read-write `query_rw` plus schema exploration helpers documented in the MCP workflows guide. For local DuckDB files, S3 paths, or custom limits, the open-source `mcp-server-motherduck` package (motherduckdb/mcp-server-motherduck on GitHub, PyPI `mcp-server-motherduck`) runs via `uvx` with flags such as `--db-path`, `--motherduck-token`, and `--read-write` for self-hosted stdio or HTTP transports.