Labsco
MCP SERVER

Elasticsearch Security Solution

by TocharianOU ↗

Ask an Elasticsearch cluster security questions in plain language, with a harness that checks every field against the live mapping before the query runs.

Threat Intelligence & Digital Forensics
Summary
The harness stops doomed queries and returns the nearest real fields instead.

A spurious `.keyword` suffix is corrected silently and the correction reported; an unknown field blocks the query and comes back with live suggestions rather than a provider error. That is the difference between an agent that iterates productively and one that retries the same broken DSL. The gate to clear first is licensing — a basic cluster will not run this at all, so activate a trial before troubleshooting anything else.

What it is

An Elasticsearch server aimed at security analysis, threat hunting and incident investigation. Its distinguishing piece is a query harness sitting between the model and the cluster: intent comes from the model, correctness comes from the harness, which validates field names against the cluster's real capabilities before anything executes.

What you get
  • `es_search` runs full Query DSL with auto-highlighting, plus harness validation and auto-fix
  • `esql_query` runs pipe-based ES|QL with the same validation and tabular output, on ES 8.11+ clusters
  • `lookup_fields` finds the right field names by intersecting the bundled ECS vocabulary with the index's actual fields — so the full dictionary stays out of the context window
  • `list_indices` and `get_mappings` with pattern, health and field filters, flat, tree or raw modes and multi-index compare
  • `get_shards` reports shard health with problem detection, and `list_data_streams` covers ILM and backing indices on ES 7.9+
  • `execute_es_api` calls any REST endpoint directly when the typed tools do not cover it
  • Version detection is automatic across ES 5.x to 9.x — unsupported tools are simply not registered, and `skip_lint: true` bypasses validation for edge cases such as externally defined runtime fields
Requirements

An Elasticsearch instance with a valid licence — trial, platinum or enterprise; the server will not start without one, and a 30-day trial can be activated through the cluster's _license/start_trial endpoint. `ES_URL` is required; authenticate with `ES_API_KEY` or with `ES_USERNAME` and `ES_PASSWORD`. `ES_CA_CERT` points at a custom CA and `NODE_TLS_REJECT_UNAUTHORIZED` set to 0 disables certificate validation for development only. `MAX_TOKEN_CALL` defaults to 20000. The npm package is `@tocharianou/elasticsearch-mcp`, version 0.9.0, needing Node 18+; `MCP_TRANSPORT=http` switches to a standalone HTTP server on `MCP_HTTP_PORT`, defaulting to 3000.

Setup effort

One command plus a key — npm install -g @tocharianou/elasticsearch-mcp, then supply credentials