"Why doesn't this document match?" is usually a tokenization question, and analyze_text answers it directly instead of by inference from result sets, while general_api_request keeps anything the dedicated tools skip one HTTP shape away. Deletes sit in the same tool set as the reads and take no confirmation step, and dropping a data stream takes its backing indices with it — so before pointing this at production, either set DISABLE_HIGH_RISK_OPERATIONS=true or name the calls you want gone in DISABLE_OPERATIONS.
A query and administration surface over Elasticsearch and OpenSearch. Every tool takes an optional cluster name, so several named clusters can be addressed in one session.
- Document work end to end: search with a query body, create or update with an optional id, fetch or delete by id, and delete everything matching a query
- Index lifecycle — list them, read mappings, settings and aliases for one, create with a configuration body, delete
- Aliases as their own tools rather than a raw call: list all, read one index's aliases, create or update, delete
- Data streams created, inspected by name or wildcard, and deleted along with their backing indices
- Cluster health and high-level statistics
- analyze_text runs a string through an analyzer, tokenizer, filter or char_filter — or through an index's configured analyzer — and shows the tokens that come out
- general_api_request takes a method, path, params and body, so an endpoint with no dedicated tool is still reachable
- Write tools removed from the client's view entirely with DISABLE_HIGH_RISK_OPERATIONS=true, or a named subset removed with DISABLE_OPERATIONS
- RESPONSE_FORMAT=gcf re-encodes tool results as Graph Compact Format — measured at about 39% fewer tokens than compact JSON on representative responses — while structured output is left as JSON
A reachable cluster and uv, since it starts through uvx. Hosts and credentials come from the environment: ELASTICSEARCH_HOSTS with ELASTICSEARCH_USERNAME and ELASTICSEARCH_PASSWORD, or ELASTICSEARCH_API_KEY, and the OPENSEARCH_ equivalents for OpenSearch; several named clusters go in ELASTICSEARCH_CLUSTERS or a file named by ELASTICSEARCH_CLUSTERS_FILE, with DEFAULT_CLUSTER deciding which one a call without a cluster lands on. Pick the package that matches the server: elasticsearch-mcp-server for 8.x, elasticsearch-mcp-server-es7 for 7.x, elasticsearch-mcp-server-es9 for 9.x, opensearch-mcp-server for OpenSearch. Over SSE or Streamable HTTP, set MCP_API_KEY — without it the server answers anyone who can reach the port. Apache-2.0.
One command plus a key — uvx elasticsearch-mcp-server-es7, then supply credentials