The analysis tools are the ones worth having: analyze_deletion_impact and analyze_object_dependencies map what a saved object connects to, so a cleanup does not quietly break a dashboard downstream — and scan_all_dashboards_health finds the ones already broken. Underneath, execute_kb_api plus the API-path search means anything Kibana's API can do is reachable, which is why the saved-object tools are described as universal across every object type.
A community-maintained server for Kibana, built from Elastic's OpenAPI spec for Stack 8.x: 16 tools covering saved-object CRUD across all types, the full Kibana API surface, multi-space support, and dashboard dependency and health analysis.
- The whole Kibana API is reachable: execute_kb_api runs a custom request with multi-space support, search_kibana_api_paths finds endpoints by keyword, list_all_kibana_api_paths lists them as a resource, and get_kibana_api_detail returns one endpoint's detail
- Saved objects handled universally by type and ID — vl_search_saved_objects with Elasticsearch query syntax across dashboards, visualizations, index-patterns, lens, maps, tags, canvas and more, plus vl_get_saved_object to read one
- Writes across the same universal surface: vl_create_saved_object, vl_update_saved_object (partial), vl_bulk_update_saved_objects, and vl_bulk_delete_saved_objects, which permanently removes objects and cannot be undone
- Spaces are first-class: get_available_spaces lists them with the current context, and get_status reports server status per space
- Dependency and impact analysis: analyze_object_dependencies builds the dependency tree for a saved object, and analyze_deletion_impact shows what breaks if you delete or modify it — before you do
- Dashboard health: check_dashboard_health detects broken references and performance issues on one dashboard, and scan_all_dashboards_health returns a summary across a whole space
Your Kibana instance URL in KIBANA_URL, and authentication either as a KIBANA_API_KEY or as KIBANA_USERNAME and KIBANA_PASSWORD for basic auth. Node, run as npx @tocharianou/mcp-server-kibana over stdio, or over StreamableHTTP with MCP_TRANSPORT=http on MCP_HTTP_PORT (default 3000). It is community-maintained and not an official Elastic product.
One command — npm install -g @tocharianou/mcp-server-kibana