mcp-for-kibana
An MCP server for Kibana: an LLM works with Kibana through 143 purpose-built tools in 10 toolboxes you enable per deployment, instead of about 610 raw REST endpoints.
Measured: MCP against Direct API
Claude Code did one long Kibana job 600 times, with three models, either through this server's tools (MCP) or by calling Kibana's REST API itself from the shell with the pinned API reference (Direct API). Every run passed every check. Median per run, MCP ÷ Direct API; below 1, MCP is cheaper or faster.
| Model | Cost ratio | Time ratio |
|---|---|---|
| Haiku 5.5 | 0.3195%: 0.29–0.32 | 0.3595%: 0.33–0.36 |
| Sonnet 5.5 | 0.7695%: 0.73–0.79 | 0.6895%: 0.67–0.69 |
| Opus 5.5 | 0.5695%: 0.55–0.59 | 0.6295%: 0.58–0.66 |
Limits: one job, Kibana 9.5.5, server 0.4.0, list-price cost. 593 of 600 runs started with the prompt already cached, so the ratios describe repeated use; on a cold cache (one run each) MCP cost more for Sonnet 5.5 and Opus 5.5. Medians with 95% bootstrap intervals, from analysis.json.
What it does
- Composable toolboxes. Enable only the toolboxes a deployment needs with
KIBANA_MCP_TOOLBOXES; the default isdashboards,data-management. Small local models get a small surface, big models can get more. - Tiered write safety. Every tool is classified read, write or destructive (68 / 45 / 30).
KIBANA_MCP_TIERcaps the tier (defaultwrite); a tool above the cap is never shown to the model, not merely refused when called. - Dashboards from a declarative spec. The dashboards toolbox turns a simple spec into Kibana Lens visualizations and dashboards through Kibana's Dashboards and Visualizations APIs. Elastic marks those APIs Technical Preview, so their shapes may still change between Kibana releases.
- Your key, your permissions. Stdio for a single local user, or streamable HTTP in a container for several. Each request carries the caller's own Kibana API key, so Kibana's access control and audit log stay per user.
- Basic license. Every tool works on a Basic (free) Kibana license; features that need a paid Elastic subscription are out of scope.
| Toolbox | Tools | Covers |
|---|---|---|
dashboards | 16 | Lens visualizations and dashboards from a declarative spec |
data-management | 11 | Data views and short URLs |
alerting | 15 | Alerting rules and connectors |
cases | 6 | Cases: create, comment, update status |
security-detections | 25 | Detection rules, exception lists, value lists |
fleet | 35 | Agents, agent and package policies, outputs, enrollment |
streams | 12 | Streams: list, summary, ingest and processing (Technical Preview) |
observability | 10 | Synthetics monitors, Uptime settings, APM agent configuration |
platform-admin | 10 | Spaces, roles, upgrade readiness |
platform-health | 3 | Cluster and Kibana status and health |
Arguments and return shape of every tool: tool reference.
Install
From PyPI, with a Kibana API key:
export KIBANA_URL=https://your-kibana.example.com
export KIBANA_API_KEY=<your Kibana API key>
uvx mcp-for-kibana
# or: pip install mcp-for-kibanaIt runs on stdio by default. Connecting Claude Code, LM Studio or an HTTP client, and a disposable local Kibana with sample data: user guide, configuration, deployment.
Studies
- MCP savings study: cost and time of Claude Code on one Kibana job through this server against Kibana's REST API; 600 runs, three models, October 2026. Data, frozen harness and analysis included.