LabscoMCP early access ↗
TocharianOUMCP SERVER

Elasticsearch Security Solution

Ask an Elasticsearch cluster security questions in plain language, with a harness that checks every field against the live mapping before the query runs.

by TocharianOU ↗Threat Intelligence & Digital ForensicsCommunity

LABSCO SUMMARY

The harness stops doomed queries and returns the nearest real fields instead.

A spurious .keyword suffix is corrected silently and the correction reported; an unknown field blocks the query and comes back with live suggestions rather than a provider error. That is the difference between an agent that iterates productively and one that retries the same broken DSL. The gate to clear first is licensing — a basic cluster will not run this at all, so activate a trial before troubleshooting anything else.

What it is

An Elasticsearch server aimed at security analysis, threat hunting and incident investigation. Its distinguishing piece is a query harness sitting between the model and the cluster: intent comes from the model, correctness comes from the harness, which validates field names against the cluster's real capabilities before anything executes.

What you get

  • es_search runs full Query DSL with auto-highlighting, plus harness validation and auto-fix
  • esql_query runs pipe-based ES|QL with the same validation and tabular output, on ES 8.11+ clusters
  • lookup_fields finds the right field names by intersecting the bundled ECS vocabulary with the index's actual fields — so the full dictionary stays out of the context window
  • list_indices and get_mappings with pattern, health and field filters, flat, tree or raw modes and multi-index compare
  • get_shards reports shard health with problem detection, and list_data_streams covers ILM and backing indices on ES 7.9+
  • execute_es_api calls any REST endpoint directly when the typed tools do not cover it
  • Version detection is automatic across ES 5.x to 9.x — unsupported tools are simply not registered, and skip_lint: true bypasses validation for edge cases such as externally defined runtime fields

Requirements

An Elasticsearch instance with a valid licence — trial, platinum or enterprise; the server will not start without one, and a 30-day trial can be activated through the cluster's _license/start_trial endpoint. ES_URL is required; authenticate with ES_API_KEY or with ES_USERNAME and ES_PASSWORD. ES_CA_CERT points at a custom CA and NODE_TLS_REJECT_UNAUTHORIZED set to 0 disables certificate validation for development only. MAX_TOKEN_CALL defaults to 20000. The npm package is @tocharianou/elasticsearch-mcp, version 0.9.0, needing Node 18+; MCP_TRANSPORT=http switches to a standalone HTTP server on MCP_HTTP_PORT, defaulting to 3000.

Setup effort

One command — npm install -g @tocharianou/elasticsearch-mcp

See installation options