Elastic MCP

Elastic MCP puts an Elasticsearch cluster behind a Model Context Protocol interface. Elasticsearch stores and searches documents at scale, whether those documents are application logs, security events, observability traces or the product catalog behind a site search box, and the query language that makes it powerful is also what stops most people from querying it directly. The server closes that gap. An agent can list the indices on a cluster, read the field mappings for any of them to learn which fields exist and how each is analyzed, then run a search using Elasticsearch query DSL including aggregations, or express the same intent as an ES|QL piped query. Individual documents are retrievable by index and id, and cluster or shard level status is available for health checks. Connection is by cluster URL plus an API key, pointed at either a self managed cluster or Elastic Cloud. The working loop is list, inspect the mapping, draft, run, refine, which covers log investigation during an incident, ad hoc analysis over an events index, and sanity checking relevance after a mapping change. Issue a scoped API key limited to the indices in question, since a broad key would let an agent read everything the cluster holds.