Elasticsearch MCP server

Elasticsearch is a distributed, RESTful search and analytics engine that enables full-text search, complex queries, real-time analytics, and data aggregations at scale. With this MCP server, AI agents can search documents, create indexes, run analytics aggregations, and monitor cluster health through natural language commands.

Setting up an MCP server

This article covers the standard steps for creating an MCP server in AI Gateway and connecting it to an AI client. The steps are the same for every integration — application-specific details (API credentials, OAuth endpoints, and scopes) are covered in the Authentication section on this page.

Before you begin

You'll need:

• Access to AI Gateway with permission to create MCP servers.
• API credentials for the application you're connecting (see the Authentication section on this page for what to collect).

Create an MCP server

Find the app in the catalog

1. Sign in to AI Gateway and select App Catalog from the left navigation.
2. Search for the application you want to connect, then select it from the catalog.
3. Select Create MCP Server to start the wizard.

App Configuration

Confirm the Base URL for the API, then, under Tools, select the endpoints you want to expose. Select Next.

MCP Server Setup

1. Enter a Name for your server — something descriptive that identifies both the application and its purpose.
2. Enter a Description so your team knows what the server is for.
3. Set the log level: choose Production Mode for terser logs, or Non-Production Mode for more verbose logs that can help with debugging.
4. Select Next.

Authentication

Enter the authentication details for the application. This varies by service — see the Authentication section on this page for the specific credentials, OAuth URLs, and scopes to use.

Review

Look over the summary of your MCP server configuration, then select Create & Deploy. AI Gateway provisions the server and provides a server URL you'll use when configuring your AI client.

---

Connect to an AI client

Once your server is deployed, you'll need to add it to the AI client your team uses. Select your client for setup instructions:

• Claude Desktop
• Claude Code
• Cursor
• VS Code
• Windsurf

Tips

• You can create multiple MCP servers for the same application — for example, a read-only server for reporting agents and a read-write server for automation workflows.
• If you're unsure which OAuth scopes to request, start with the minimum read-only set and add write scopes only when needed. Most application pages include scope recommendations.

Authentication

Elasticsearch supports multiple authentication methods. API keys are recommended for API access; OAuth 2.0 through OIDC can be configured for enterprise SSO scenarios. In Kibana, go to Stack Management > API Keys to generate an API key for your integration.

API Key Authentication:

Value	Setting
API key header	Authorization: ApiKey {encoded_api_key}

OAuth 2.0 (OIDC):

Value	Setting
Auth endpoint	https://your-okta-domain.okta.com/oauth2/default/v1/authorize
Token endpoint	https://your-okta-domain.okta.com/oauth2/default/v1/token
Scopes	openid, email, profile

Available tools

The Elasticsearch MCP server exposes search, document management, index operations, and analytics aggregation APIs.

Tool	Purpose
Search	Full-text search, fuzzy matching, filtered queries, multi-index search across documents
Document Management	Index, update, and delete documents; bulk operations; version control; retrieve by ID
Index Management	Create, delete, and reindex indices; manage mappings; configure aliases; set lifecycle policies
Aggregations	Metrics (sum, average, min/max), bucket grouping, histogram, date histogram, pipeline aggregations
Cluster Management	Monitor cluster health; view node status; manage shard allocation; configure cluster settings
Geospatial Queries	Location-based searches; distance calculations; polygon searches; geographic aggregations

Tips

Plan your mappings carefully before indexing data.

Choose appropriate field types for your query patterns and use nested documents for complex data structures.

Use filters for exact matches instead of queries when possible.

Implement pagination with search_after or scroll for large result sets.

Limit returned fields with source filtering.

Run aggregations on smaller datasets by applying filters first.

Use terms aggregations for categorical data.

Consider materialized views for frequently-run analytics.

Regularly check shard allocation and unassigned shards.

Configure appropriate numbers of replicas based on your availability needs.

Set up indices lifecycle management (ILM) for automatic rollover.

Generate separate API keys for different use cases with minimal necessary permissions.

Use role mappings to control access to indices and features.

Rotate credentials regularly.

---