Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Kibana Log Analysis & API Dashboard MCP Server Search logs for recent errors in payment-service"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP (Model Context Protocol) server designed for enterprise developers to connect local AI assistants directly to Elasticsearch, Kibana, and local codebases.
If you have just cloned this repository to use within your organization, search the codebase for TODO: comments. There are several places where data or settings should be manually updated to fit your company's architecture.
The most crucial manual updates inside src/index.ts include:
Log Schema Customization: Update the .level or http.response.status_code fields to match your company's logging convention.
Self-Signed Certificates: Add your internal CA cert path if your Elasticsearch instance does not use public SSL certificates.
Regex Parsers for .NET or Go: If your team uses languages other than Java/Typescript, update the scan_code_for_apis tool regex.
Related MCP server: elasticsearch-mcp
search_logs: Search Elasticsearch indices using keywords and Lucene queries.
get_log_details: Retrieve the full un-truncated JSON of specific log events.
analyze_service_health: Aggregate error rates, success rates, and HTTP status codes for a given service.
scan_code_for_apis: Scans your local Spring Boot (Java) or Express (Node.js) project to dynamically discover REST endpoints.
create_api_dashboard: Programmatically generates a Kibana dashboard visualizing the dynamically discovered endpoints using the Kibana Saved Objects API.
Ensure you have Node.js (v18+) installed.
Run npm install
Run npm run build
Copy .env.example to .env and configure your environment variables (or set them directly in your LLM Client setup).
Variable | Description |
| URL to your Elasticsearch cluster (e.g., |
| Auth Token with specific read scopes. |
| URL to your Kibana instance. |
Add the following configuration to your claude_desktop_config.json or Cursor MCP settings:
{
"mcpServers": {
"kibana-logs": {
"command": "node",
"args": ["/Users/sidhu/.gemini/antigravity/scratch/kibana-mcp-server/build/index.js"],
"env": {
"ELASTIC_URL": "https://your-bank-cluster:9200",
"ELASTIC_API_KEY": "your_secure_api_key",
"KIBANA_URL": "https://your-bank-kibana:5601"
}
}
}
}Least Privilege: Do not grant your ELASTIC_API_KEY delete, put, or cluster-admin privileges. It only needs read on application indices, and all access to the Kibana Saved Objects API (to create dashboards).
Data Masking: If your logs contain PII (Personally Identifiable Information), you should implement a regex mask in src/index.ts right before returning the logs to the AI payload.
Aggregate logs to determine error vs. success rates
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Elasticsearch index pattern | |
| hoursBack | Yes | Number of hours to look back | |
| serviceName | Yes | Name of the service to analyze |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states aggregation but does not disclose whether the tool is read-only, requires permissions, or has any side effects. The behavioral context is insufficient for an agent to understand implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words. However, the most critical information (that it determines error vs. success rates) is embedded at the end; front-loading would improve scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema, the description should explain the return format (e.g., a ratio or table) but does not. For a tool with 3 required params and no annotations, the description is too minimal to fully guide an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (all params have descriptions), so baseline is 3. The description adds no extra meaning beyond what is already in the schema, such as clarifying the relationship between parameters or providing usage examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Aggregate') and resource ('logs'), and clearly states the output measure ('error vs. success rates'). It distinguishes itself from sibling tools like 'search_logs' (which searches) and 'get_log_details' (which retrieves details), making its unique purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for health analysis but provides no explicit guidance on when to use this tool over siblings like 'search_logs' or 'scan_code_for_apis'. No when-not-to-use or alternative directions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a Kibana Dashboard tracking specific endpoints
| Name | Required | Description | Default |
|---|---|---|---|
| endpoints | Yes | Array of endpoint strings, e.g. ['GET /api/v1/accounts'] | |
| dashboardName | Yes | Name of the new dashboard |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. It only states 'generate', which implies creation, but lacks details on idempotency, permission requirements, side effects (e.g., overwriting existing dashboards), or return value. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb and object. No unnecessary words. Efficiently communicates the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-parameter tool with no output schema, the description is adequate but lacks contextual info such as whether the dashboard is created in a specific context (e.g., workspace, index pattern), or if there are prerequisites. Could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains endpoints and dashboardName well. The description adds no additional semantic value beyond the schema, earning the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb ('Generate') and resource ('a Kibana Dashboard tracking specific endpoints'). Distinct from sibling tools which focus on searching logs, getting log details, analyzing service health, and scanning code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies use when needing a dashboard for specific endpoints, but no explicit when-to-use or when-not-to-use guidance. No comparison with alternatives provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve the full, raw JSON of a specific log event
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | The index containing the document | |
| documentId | Yes | The _id of the document |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only states a read operation, but fails to mention authentication needs, error behavior (e.g., non-existent document), rate limits, or whether the operation is safe. Minimal information for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundant words. It is concise, but could be slightly expanded to include usage context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and the description only says 'full, raw JSON'. Lacks details on return format, error handling, pagination, or limits. Given the tool's simplicity, more context would be helpful for proper invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters already described in the schema. The tool description does not add any extra meaning beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the full, raw JSON of a specific log event. This verb+resource combination is specific and distinguishes it from sibling tools like search_logs (which searches) and analyze_service_health (which analyzes).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus its siblings, such as search_logs for searching or analyzing tools for broader insights. The description offers no context about prerequisites, alternatives, or scenarios where this tool is appropriate or not.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scans a local project directory to discover REST APIs
| Name | Required | Description | Default |
|---|---|---|---|
| projectPath | Yes | Absolute path to the local source code |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states it 'scans' and 'discovers' but does not disclose what files are scanned, what constitutes discovery, whether it modifies files, or any side effects. This lack of behavioral detail is a gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 9 words with no redundancy. It is efficiently written but could optionally include more context without becoming verbose. No structural issues.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (1 param, no output schema, no annotations), the description is minimally complete. It lacks details on output format, file scope, and behavior. For a scanning tool, more context (e.g., what happens with discovered APIs) is expected.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter projectPath, which already provides a clear description ('Absolute path to the local source code'). The tool description adds no further detail, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'scans' and identifies the resource 'local project directory' with a clear goal 'discover REST APIs'. This distinguishes it from sibling tools like search_logs or analyze_service_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly suggests use when discovering APIs in local code, but provides no explicit when-to-use, when-not-to-use, or alternative recommendations. The purpose alone gives enough context for basic selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search logs matching keywords within a time range
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Elasticsearch index pattern, e.g. 'logs-*' | |
| keyword | Yes | Keyword or lucene query to search for | |
| hoursBack | Yes | Number of hours to look back |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavior. It only states 'Search logs' without mentioning read-only nature, pagination, limits, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is very concise and front-loaded. Could include more context without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter search tool with no output schema or annotations, the description lacks details on return format, pagination, error handling, or operational constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; all parameters have clear descriptions. The tool description adds no additional meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool searches logs with keywords and time range, distinguishing it from siblings like get_log_details (more specific) and analyze_service_health (health analysis).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description implies usage for log searching but provides no explicit guidance on when to use vs alternatives or when not to use. Siblings are not mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0analyze_service_healthcreate_api_dashboardget_log_detailsscan_code_for_apissearch_logsEach tool has a clearly distinct purpose: searching logs, retrieving details, analyzing health, scanning APIs, and creating dashboards. No overlap between them.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., search_logs, get_log_details), making them predictable and easy to distinguish.
With 5 tools, the server is well-scoped for its dual focus on log analysis and API dashboard creation, without being too sparse or overloaded.
Core workflows are covered (search, details, health analysis, API discovery, dashboard creation), but minor gaps exist—e.g., missing tools for listing, updating, or deleting dashboards.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Direct access to Cypress tests results and accessibility reports in your AI workflow.
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/sid-s-s/kibana-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
