Elasticsearch MCP Server

What it does

• Official Elastic MCP server — list indices, inspect mappings, run search and ES|QL queries
• Runs as a Docker image `docker.elastic.co/mcp/elasticsearch` over stdio
• Can be exposed remotely (Streamable HTTP) behind `mcp-proxy` with ApiKey auth

When to use it

Ground Claude in your actual cluster: debug a failing query, explore an unfamiliar index's mapping, or run ES|QL analytics in natural language.

Getting started

Docker over stdio:

{
  "elasticsearch-mcp-server": {
    "command": "docker",
    "args": [
      "run", "-i", "--rm",
      "-e", "ES_URL",
      "-e", "ES_API_KEY",
      "docker.elastic.co/mcp/elasticsearch",
      "stdio"
    ],
    "env": {
      "ES_URL": "<elasticsearch-cluster-url>",
      "ES_API_KEY": "<elasticsearch-API-key>"
    }
  }
}

Things to know

The API key inherits its privileges — mint a read-only key if Claude shouldn't write to indices. Remote mode requires hosting the HTTP endpoint yourself plus mcp-proxy on the client side.