Elasticsearch MCP Server

docker run -i --rm -e ES_URL -e ES_API_KEY docker.elastic.co/mcp/elasticsearch stdio

{
  "mcpServers": {
    "elasticsearch-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "ES_URL",
        "-e",
        "ES_API_KEY",
        "docker.elastic.co/mcp/elasticsearch",
        "stdio"
      ]
    }
  }
}

Elastic's server gives an agent five operations: list indices, read their mappings, run a search, run an ES|QL query, and inspect shard allocation. Because mappings are readable, the model can shape a query against fields that actually exist instead of guessing at the schema. It ships as a Docker image and authenticates with an API key or basic credentials against a cluster URL. Elastic has marked this repository as receiving only critical security fixes and points Elasticsearch 9.2 and newer at the Agent Builder MCP endpoint instead.