Evaluation record · mcp-server-elasticsearch

MCP Elasticsearch Server

v0.4.6 (deprecated; successor: Agent Builder MCP)

Elastic

MCPsearchanalyticsmcpmodel-context-protocol

Strong

About This MCP

Official Elastic MCP server (elastic/mcp-server-elasticsearch) exposing read-oriented tools - list_indices, get_mappings, search, esql, get_shards - for full-text search, ES|QL, and analytics. IMPORTANT: the standalone server is deprecated (v0.4.6, 2025-10-24, critical security updates only); Elastic directs users to the Agent Builder MCP endpoint ({KIBANA_URL}/api/agent_builder/mcp), GA in Elastic 9.2+ and Elasticsearch Serverless, with API key authentication.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

search accuracy

Search relevance testing

Evidence

Elasticsearch Search — Highly accurate full-text search with relevance scoring

highVerified: 2026-07-09

aggregation reliability

Aggregation accuracy testing

Evidence

Elasticsearch Aggregations — Powerful aggregation framework with accurate analytics

highVerified: 2026-07-09

large index performance

Scalability testing

Evidence

Elasticsearch Performance — Performance degrades with very large indices; requires optimization

mediumVerified: 2026-07-09

cluster stability

Cluster stability testing

Evidence

Elasticsearch Cluster Health — Stable cluster operations with automatic shard management

mediumVerified: 2026-07-09

error recovery

Error handling testing

Evidence

Implementation Review — Handles Elasticsearch errors with retry and timeout management

mediumVerified: 2026-07-09

🛡️Security

authentication security

Authentication mechanism review

Evidence

Elasticsearch Security — Supports API keys, basic auth, and security features (X-Pack)

highVerified: 2026-07-09

credential exposure risk

Credential security analysis

Evidence

MCP Security Model — Elasticsearch credentials stored locally; accessible to AI

highVerified: 2026-07-09

query injection risk

Injection vulnerability testing

Evidence

elastic/mcp-server-elasticsearch Repository — AI can construct arbitrary search and ES|QL queries; blast radius is limited to reads since no write tools exist, but expensive queries and broad data reads remain possible

highVerified: 2026-07-09

index modification risk

Operation authorization testing; raised from 60 because the official Elastic server's tool surface is read-only, unlike earlier community servers with write tools

Evidence

elastic/mcp-server-elasticsearch Repository — The official server ships only read-oriented tools (list_indices, get_mappings, search, esql, get_shards); it exposes no document indexing, update, or write tools

highVerified: 2026-07-09

index deletion risk

Destructive operation testing; raised from 68 as the official tool surface contains no deletion capability

Evidence

elastic/mcp-server-elasticsearch Repository — No index deletion or index management tools are exposed by the official server

highVerified: 2026-07-09

audit logging

Audit logging review

Evidence

Elasticsearch Audit Logging — Comprehensive audit logging available in X-Pack Security

highVerified: 2026-07-09

🔒Privacy & Compliance

document data exposure

Data flow analysis

Evidence

MCP Data Flow — Search results and indexed documents sent to LLM provider

highVerified: 2026-07-09

pii in logs

PII exposure assessment

Evidence

Privacy Analysis — Log data and application logs may contain PII

highVerified: 2026-07-09

field level security

Field security assessment

Evidence

Elasticsearch Field-Level Security — Field-level security available in X-Pack but requires configuration

mediumVerified: 2026-07-09

third party data sharing

Data sharing analysis

Evidence

LLM Provider Policies — Search results shared with LLM provider per their privacy policy

highVerified: 2026-07-09

index pattern exposure

Index privacy assessment

Evidence

Privacy Analysis — Index names and mappings may reveal data structure

mediumVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

Elasticsearch MCP Docs — Good documentation but community-maintained with evolving coverage

mediumVerified: 2026-07-09

query visibility

Query logging assessment

Evidence

MCP Protocol — All queries logged in MCP transaction logs

highVerified: 2026-07-09

open source transparency

Source code review

Evidence

GitHub Repository — Official Elastic implementation, open source under Apache 2.0 (Rust, ~686 stars)

highVerified: 2026-07-09

api coverage clarity

API documentation review

Evidence

MCP Server Documentation — Clear but incomplete documentation of supported Elasticsearch APIs

mediumVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

Setup Documentation — Requires Elasticsearch connection URL and credentials

highVerified: 2026-07-09

search performance

Performance benchmarking

Evidence

Elasticsearch Performance — Performance varies with index size and query complexity (typically 50-500ms)

mediumVerified: 2026-07-09

reliability

Reliability analysis

Evidence

Elasticsearch Stability — Built on mature Elasticsearch client libraries

highVerified: 2026-07-09

api coverage

Feature coverage assessment; lowered from 80 as the official server's surface is narrower than the previously described community coverage

Evidence

elastic/mcp-server-elasticsearch Repository — Deliberately narrow read-only surface: search, ES|QL, index listing, mappings, and shard info; no indexing or index management tools. Broader/custom tool coverage now comes from the Agent Builder MCP endpoint

highVerified: 2026-07-09

community support

Community support assessment; lowered from 75 due to the standalone server's deprecation

Evidence

elastic/mcp-server-elasticsearch Repository — Repository carries a deprecation notice: only critical security updates going forward; users are directed to the Agent Builder MCP endpoint in Elastic 9.2+ / Serverless

highVerified: 2026-07-09

Strengths

+Highly accurate full-text search with relevance scoring, plus ES|QL query support
+Official Elastic implementation, open source under Apache 2.0
+Read-only tool surface limits blast radius (no write or index management tools)
+Excellent for log analysis and business intelligence
+Supports stdio and streamable-HTTP transports
+Clear migration path to the GA Agent Builder MCP endpoint with custom tools

Limitations

!DEPRECATED: standalone server receives only critical security updates; Elastic directs users to the Agent Builder MCP endpoint (Elastic 9.2+/Serverless)
!Search results and indexed documents exposed to LLM provider
!Log data may contain PII and sensitive information
!Elasticsearch credentials/API keys stored in local client configuration
!Arbitrary search and ES|QL queries can be expensive on large indices
!Field-level security requires platform security features and careful configuration

Metadata

license: Apache 2.0

supported platforms

0: All platforms (Rust binary, Docker); Agent Builder MCP via Kibana endpoint

programming languages

0: Rust

mcp version: 1.0

github repo: https://github.com/elastic/mcp-server-elasticsearch

status: Deprecated (critical security updates only) as of the v0.4.x line

successor: Elastic Agent Builder MCP endpoint: {KIBANA_URL}/api/agent_builder/mcp (GA in Elastic 9.2+ and Elasticsearch Serverless)

latest release: v0.4.6 (2025-10-24)

transport types

0: stdio

1: streamable-http

api dependency: Elasticsearch REST API

authentication: Elasticsearch API keys or username/password; Agent Builder endpoint uses Kibana API keys

first release: 2025

maintained by: Elastic

Use Case Ratings

code generation

Good for generating search queries and analytics dashboards

customer support

Excellent for searching support tickets and knowledge bases

content creation

Useful for content search and recommendation systems

data analysis

Excellent for log analysis, business intelligence, and data exploration

research assistant

Ideal for full-text research across large document collections

legal compliance

Risk of exposing legal documents; requires field-level security

healthcare

High risk of exposing patient data in logs and indices

financial analysis

Moderate risk; financial transaction data exposure concerns

education

Excellent for teaching search technologies and data analytics

creative writing

Useful for searching writing archives and research materials