Kibana MCP server
55 operations0 webhooks
Elastic's data exploration and management interface, with endpoints for saved objects, data views, dashboards, alerting rules, cases, connectors, security detections, and Fleet.
Try Kibana with your agent
Connect Kibana, then paste this into Claude, ChatGPT or Cursor. For ideas from other apps, see the use cases.
Using Corsair, show me what you can do in Kibana on my account, then run one read-only example and show me the result.
Kibana tools and triggers
Tools are what your agent can do in Kibana through Corsair's MCP server. Triggers are the Kibana events a routine can start from.
Fleet
- Agent Policies ListRead-only
List Fleet agent policies with pagination
fleet.agentPoliciesList
- Agents SetupRead-only
Check Fleet agents setup status
fleet.agentsSetup
- Agents VersionsRead-only
List available Fleet agent versions
fleet.agentsVersions
- Check PermissionsRead-only
Check permissions for the Fleet API
fleet.checkPermissions
- Enrollment Key GetRead-only
Retrieve a Fleet enrollment API key by ID
fleet.enrollmentKeyGet
- Enrollment Keys ListRead-only
List Fleet enrollment API keys
fleet.enrollmentKeysList
- Epm CategoriesRead-only
List Fleet EPM package categories
fleet.epmCategories
- Epm Data StreamsRead-only
List Fleet EPM data streams
fleet.epmDataStreams
- Epm Package DetailsRead-only
Retrieve details of a Fleet EPM package version
fleet.epmPackageDetails
- Epm Package FileRead-only
Retrieve a file from a Fleet EPM package
fleet.epmPackageFile
- Epm Package StatsRead-only
Retrieve usage statistics for a Fleet package
fleet.epmPackageStats
- Epm Packages InstalledRead-only
List installed Fleet EPM packages
fleet.epmPackagesInstalled
- Epm Packages LimitedRead-only
List Fleet EPM package names only
fleet.epmPackagesLimited
- Epm Packages ListRead-only
List available Fleet EPM packages
fleet.epmPackagesList
- Output DeleteDestructive
Delete a Fleet output by ID
fleet.outputDelete
- Package Policies ListRead-only
List Fleet package policies with pagination
fleet.packagePoliciesList
- Proxy DeleteDestructive
Delete a Fleet proxy by ID
fleet.proxyDelete
- Server Host GetRead-only
Retrieve a Fleet Server host by ID
fleet.serverHostGet
- Server Hosts ListRead-only
List Fleet Server hosts
fleet.serverHostsList
Connectors
- CreateWrite
Create a new connector in Kibana
connectors.create
- DeleteDestructive
Delete a connector by ID
connectors.delete
- GetRead-only
Retrieve a connector by ID
connectors.get
- ListRead-only
List all connectors in Kibana
connectors.list
- List TypesRead-only
List available connector (action) types
connectors.listTypes
Dashboards
- CreateWrite
Create a new dashboard in Kibana
dashboards.create
- DeleteDestructive
Delete a dashboard by ID
dashboards.delete
- GetRead-only
Retrieve a dashboard by ID
dashboards.get
- SearchRead-only
Search dashboards in Kibana
dashboards.search
- UpsertWrite
Create or update a dashboard by ID
dashboards.upsert
Saved Objects
- CreateWrite
Create a new saved object in Kibana
savedObjects.create
- DeleteDestructive
Delete a saved object by type and ID
savedObjects.delete
- FindRead-only
Find saved objects matching search query or type filters
savedObjects.find
- GetRead-only
Retrieve a specific saved object by type and ID
savedObjects.get
- UpdateWrite
Update attributes of an existing saved object by type and ID
savedObjects.update
Alerting
- Create RuleWrite
Create a new alerting rule in Kibana
alerting.createRule
- Delete RuleDestructive
Delete an alerting rule by ID
alerting.deleteRule
- List Rule TypesRead-only
List available alerting rule types
alerting.listRuleTypes
- List RulesRead-only
List alerting rules with pagination and filters
alerting.listRules
Security
- Entities ListRead-only
List Entity Store entities
security.entitiesList
- Entity Store EnginesRead-only
Retrieve Entity Store engines (derived from the entity-store status response; no separate engines endpoint exists in the spec)
security.entityStoreEngines
- Entity Store StatusRead-only
Retrieve Entity Store status
security.entityStoreStatus
- List Endpoint ItemsRead-only
List Endpoint exception list items
security.listEndpointItems
Data Views
- CreateWrite
Create a new data view in Kibana
dataViews.create
- GetRead-only
Retrieve data view details by ID
dataViews.get
- ListRead-only
List all data views in Kibana
dataViews.list
Cases
- CreateWrite
Create a new case in Kibana
cases.create
- ListRead-only
Find and list cases with filters
cases.list
Detection
- Find AlertsRead-only
Find and aggregate detection alerts
detection.findAlerts
- Find RulesRead-only
Find detection engine rules with filters
detection.findRules
Index
- List IndicesRead-only
List indices via Index Management (not in the official OpenAPI spec; disabled on serverless, works where Index Management UI is enabled)
index.listIndices
Lists
- DeleteDestructive
Delete a value list by ID
lists.delete
Metrics
- GetRead-only
Retrieve Elasticsearch node metrics
metrics.get
Osquery
- Delete Saved QueryDestructive
Delete an Osquery saved query by ID
osquery.deleteSavedQuery
Reporting
- List JobsRead-only
List Kibana reporting jobs (legacy stateful-only API; not in the official OpenAPI spec, 404 on serverless)
reporting.listJobs
Status
- GetRead-only
Retrieve health and version status of the Kibana instance
status.get
Connect Kibana to Claude, ChatGPT or Cursor
- 1
Connect Kibana in Corsair
Add your Kibana API key once in Corsair. Corsair stores the credential encrypted and makes the Kibana API calls for your agent, so it never goes into a prompt or a config file. Connect Kibana
If your link lets the agent add apps, you can skip this: it gives you a sign-in link the first time it needs Kibana. On a ChatGPT personal plan, connect Kibana here first.
- 2
Add Corsair's MCP server to your agent
Every client uses the same address:
https://mcp.corsair.dev/mcpOpen Customize → Connectors → Add custom connector, paste the address, then select Connect.Add a custom MCP server with the address and choose OAuth. Personal plans get read tools only.Add to CursorOr add this to~/.cursor/mcp.json. Cursor opens Corsair to sign in the first time it connects.{ "mcpServers": { "corsair": { "url": "https://mcp.corsair.dev/mcp" } } }Run this, then run/mcpin Claude Code to sign in.claude mcp add --transport http corsair https://mcp.corsair.dev/mcpCodex, Gemini CLI, VS Code, Zed and other clients with OAuth sign-in work the same way. Clients without it, such as GitHub Copilot's coding agent, use a link's own address and an API key. Setup for every client
- 3
Sign in and choose what needs your approval
Your client opens Corsair to sign in. Pick a link: the apps your agent can use and a mode that decides what it may do without asking. In the default Cautious mode, Kibana's read and write operations run right away and its 8 destructive operations wait for your approval. Strict mode asks before every write and refuses destructive operations, and Read mode allows reads only.
FAQ
Install corsair and @corsair-dev/kibana, add the Kibana plugin, and connect with an API key. Then call methods like corsair.kibana.api.alerting.createRule() from your app. Corsair syncs data per tenant.
Yes. Kibana requires an API key from your Kibana account or developer dashboard. Create credentials with access that matches what you automate, then paste them into Corsair or connect through managed auth in Hub.
Yes. One Corsair client can hit Kibana, GitHub, Notion, Stripe, and the rest. Trigger Kibana from a webhook, push updates to Slack, or chain actions across plugins. Same tenant context across integrations, plain TypeScript.
Teams use Corsair for elastic's data exploration and management interface, with endpoints for saved objects, data views, dashboards, alerting rules, cases, connectors, security detections, and fleet. Common builds include sync jobs, admin tooling, and agents that call Kibana APIs from your backend. Local DB entities let you query synced Kibana records without hitting the API on every read.
The SDK is open source. Self-host and you pay Corsair nothing for the integration layer. Hub bills for hosted auth and execution, not per Kibana API call. Hub has a generous free tier. For hobby projects you can probably run the whole thing on free. Paid plans start to matter with more tenants or heavier traffic.
We maintain @corsair-dev/kibana in the open repo. When Kibana ships API changes, upgrade the package. Your call sites stay typed. You should not need to rewrite the integration layer each time.
No. Corsair does not read your Kibana data or hold individual access credentials. Credentials stay in your database. API calls run on your instance. We do not store Kibana data on your behalf.
Yes. Add https://mcp.corsair.dev/mcp as a custom connector or MCP server in Claude, ChatGPT, Cursor, VS Code, Claude Code, Codex or any client that supports remote MCP servers with OAuth sign-in, then sign in to Corsair. On ChatGPT personal plans, custom servers currently get read tools only.
Yes. Put Kibana on a link in Strict mode and every write waits for your approval, while destructive actions are refused. The default Cautious mode asks only before the 8 destructive Kibana operations. You can change a link's mode at hub.corsair.dev/me.