MCP server Official

Elasticsearch MCP Server (deprecated)

Elastic's MCP server for querying Elasticsearch indices in natural language; deprecated in favor of Elastic Agent Builder MCP.

Author
Elastic
Works with
Any MCP client
License
Apache-2.0
Last release
Oct 24, 2025
Documented
Oct 2, 2026

What Elasticsearch MCP Server (deprecated) is

Connects AI agents to Elasticsearch data over MCP so they can query, analyze and retrieve data without custom APIs. The README now marks it deprecated, with only critical security updates, superseded by the Elastic Agent Builder MCP endpoint (Elastic 9.2.0+ and Serverless).

What it does

How Elasticsearch MCP Server (deprecated) plugs in: which agents run it and what it addsRUNS INYour agentAny MCP clientone host documentedMCP SERVER · OFFICIALElasticsearch MCP Server (de…Connect the agent to tools, data…5 install steps1 permission notelicense: Apache-2.0WHAT IT ADDSWhat it doesQuery Elasticsearch indices via n…Run over stdio or streamable-HTTPAuthenticate with an API key or u…Serve a health check at /ping in…agent → extension → new capability · from the official repository or docs
Where Elasticsearch MCP Server (deprecated) runs and what it adds, from its documentation
  • Query Elasticsearch indices via natural language through an MCP client
  • Run over stdio or streamable-HTTP
  • Authenticate with an API key or username/password
  • Serve a health check at /ping in HTTP mode

When to use it

Good fit

  • You have an existing setup on Elasticsearch 8.x or 9.x and need this container
  • You want a Docker-based MCP bridge for Claude Desktop, Cursor or VS Code

Not for

  • New projects: the README says it is deprecated in favor of the Elastic Agent Builder MCP endpoint

How to install Elasticsearch MCP Server (deprecated)

You need: Elasticsearch 8.x or 9.x cluster; Docker; API key or username/password

  1. Ensure an Elasticsearch 8.x/9.x cluster and API key or username/password
  2. Have Docker running
  3. Set ES_URL and ES_API_KEY (or ES_USERNAME/ES_PASSWORD)
  4. Run docker run -i --rm -e ES_URL -e ES_API_KEY docker.elastic.co/mcp/elasticsearch stdio
  5. Add the same command to your MCP client config
Configuration example (from the official docs)
{
  "mcpServers": {
    "elasticsearch-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "ES_URL",
        "-e", "ES_API_KEY",
        "docker.elastic.co/mcp/elasticsearch",
        "stdio"
      ],
      "env": {
        "ES_URL": "<elasticsearch-cluster-url>",
        "ES_API_KEY": "<elasticsearch-API-key>"
      }
    }
  }
}

Permissions and security

What it can access

  • Queries the Elasticsearch cluster with the supplied credentials

Security notes from the maintainers

  • ES_SSL_SKIP_VERIFY disables TLS verification; README says only for development or testing

Review the source before granting an agent access to credentials or production systems. We document what the maintainers state; we do not audit code.

Limitations

  • Deprecated; only critical security updates
  • Server-Sent Events transport is deprecated

Tools it extends

Frequently asked questions

Is the Elasticsearch MCP Server still maintained?

It is deprecated and receives only critical security updates; Elastic points to the Agent Builder MCP endpoint. source

What replaces the Elasticsearch MCP Server?

The Elastic Agent Builder MCP endpoint, available in Elastic 9.2.0+ and Elasticsearch Serverless projects. source

How does the Elasticsearch MCP Server authenticate?

With ES_API_KEY, or ES_USERNAME and ES_PASSWORD, plus ES_URL. source

Which transports does the Elasticsearch MCP Server support?

stdio and streamable-HTTP (endpoint /mcp); SSE is deprecated. source

Related guides

Sources and gaps

Not stated by the maintainers: Exact tool list not captured from README.

More extensions to look at