Kibana MCP Server: Programmatic and Natural Language Access

Overview

This MCP (Model Context Protocol) server provides programmatic and natural-language access to Kibana instances. It acts as a thin middleware that exposes Kibana operations as composable “tools” for downstream MCP-compatible clients (chat assistants, automation scripts, or CI pipelines). By translating structured requests and natural-language intents into authenticated Kibana API calls, the server enables automation, observability workflows, and conversational control without embedding Kibana credentials in client code.

The project is community-maintained and designed to be lightweight and extensible. Developers can run it locally, in containers, or integrate it into larger orchestration systems to perform searches, manage saved objects and dashboards, query index/cluster health, and execute ingest or management tasks via either programmatic JSON requests or natural-language prompts interpreted by an MCP client.

Features

• Exposes Kibana operations as MCP-compatible tools for use by LLM agents and automation clients
• Support for both structured (API) calls and natural-language requests routed through an MCP workflow
• Authentication proxying to Kibana using API keys, basic auth, or token credentials
• Lightweight Node.js implementation with Docker image for easy deployment
• Extensible tool set: search, dashboards, saved objects, index/cluster health, ingest pipelines, and settings
• Configurable logging, rate-limiting and access control for multi-tenant scenarios
• Community-maintained with an open GitHub repository for visibility and contributions

Installation / Configuration

Clone the repository and install dependencies, or run via Docker.

1. Clone + Node.js (development)

git clone https://github.com/TocharianOU/mcp-server-kibana.git
cd mcp-server-kibana
npm ci
cp .env.example .env
# Edit .env to set KIBANA_URL and credentials
npm start

2. Docker (recommended for production/testing)

Build and run locally:

docker build -t mcp-server-kibana .
docker run -p 3000:3000 \
  -e KIBANA_URL="https://kibana.example.internal:5601" \
  -e KIBANA_API_KEY="abc:xyz" \
  -e MCP_SERVER_PORT=3000 \
  mcp-server-kibana

docker-compose example:

version: "3.8"
services:
  mcp-kibana:
    image: your-registry/mcp-server-kibana:latest
    ports:
      - "3000:3000"
    environment:
      - KIBANA_URL=https://kibana:5601
      - KIBANA_API_KEY=${KIBANA_API_KEY}
      - MCP_SERVER_PORT=3000

Common environment variables

Note: If using sensitive credentials, store them in secure secret stores (Vault, Kubernetes secrets) rather than plaintext .env.

Repository: https://github.com/TocharianOU/mcp-server-kibana.git

Available Tools / Resources

The server provides a collection of tools (endpoints) that map common Kibana operations into MCP-friendly primitives. Typical tool categories include:

• search: run Elasticsearch/Kibana searches and return hits/aggregations
• dashboards: list, fetch, render, or export dashboards and visualizations
• saved_objects: create, update, retrieve, or delete saved objects
• indices & cluster: check index status, mappings, cluster health
• ingest_pipelines: manage ingest pipelines and simulate ingest
• settings: read or update Kibana settings and telemetry

Each tool accepts structured input that specifies the action, target (index/dashboard/id), and optional query/body. The server translates the request to the appropriate Kibana API call and returns a JSON result.

Use Cases

1. Incident Triage (natural language)

• A chat assistant receives: “Show me the top 5 error messages for service X in the last 30 minutes.”
• The MCP client sends a natural-language intent to the MCP server, which crafts a search query against the Kibana index pattern and returns the aggregated results for the assistant to present.

2. Automating Dashboards (programmatic)

• CI job: export a specific dashboard as JSON and store it in version control before upgrades.
• Example programmatic request (curl):

curl -X POST http://localhost:3000/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <MCP_CLIENT_KEY>" \
  -d '{
    "tool": "dashboards",
    "action": "export",
    "id": "dashboard-1234"
  }'

3. Routine Health Checks

• Scheduler calls the indices/cluster tool to verify index health and alert if any shards are unassigned or red.

4. ChatOps and Reporting

• Slack bot routes user prompts to the MCP server to generate ad-hoc reports and create saved searches or alerts in Kibana via conversational commands.

5. Bulk Index Management

• Devops script uses saved_objects and index toolset to reindex, update mappings, or clean obsolete saved searches programmatically.

Security and Best Practices

• Restrict the MCP server behind an API gateway or internal network; require client authentication (API keys or mTLS).
• Limit Kibana privileges used by the server to only the necessary read/write scopes.
• Use rate limits and audit logging for any natural-language-driven actions to avoid runaway automated changes.
• Validate and sanitize incoming requests before relaying to Kibana to reduce injection risks.

Contributing and Resources

This is a community-maintained project; contributions, issue reports, and feature requests are welcome at the GitHub repository: https://github.com/TocharianOU/mcp-server-kibana.git

For integration examples or client adapters, check the repository’s examples directory and open an issue or PR to propose new tools or enhancements.