TocharianOU/mcp-server-kibana

A Kibana MCP server implementation that allows any MCP-compatible client (such as Claude Desktop) to access your Kibana instance via natural language or programmatic requests.
> This project is based on the official Elastic Kibana API documentation and uses the OpenAPI YAML specification from Elastic Stack 8.x. For details, see the Kibana API documentation.
This project is community-maintained and is not an official product of Elastic or MCP.
> 💡 Companion Project: For complete Elastic Stack integration, pair this with Elasticsearch MCP Server for direct Elasticsearch data operations.
## 🚀 Installation
bash
# Global installation (recommended)
npm install -g @tocharianou/mcp-server-kibana
# Or use directly with npx
npx @tocharianou/mcp-server-kibana
### From Source
bash
git clone https://github.com/TocharianOU/mcp-server-kibana.git
cd mcp-server-kibana
npm install && npm run build
## 🎯 Quick Start
### Claude Desktop Integration (Recommended)
Add to your Claude Desktop configuration file:
MacOS: ~/Library/Application Support/Claude/claudedesktopconfig.json
Windows: %APPDATA%\Claude\claudedesktopconfig.json
json
"mcpServers": {
"kibana": {
"command": "npx",
"args": ["@tocharianou/mcp-server-kibana"],
"env": {
"KIBANAURL": "http://your-kibana-server:5601",
"KIBANAAPIKEY": "your-api-key",
"KIBANADEFAULTSPACE": "default"
### Direct CLI Usage
bash
# Using API Key (recommended)
KIBANAURL=http://localhost:5601 \
KIBANAAPIKEY=your-api-key \
npx @tocharianou/mcp-server-kibana
# Using Basic Auth
KIBANAURL=http://localhost:5601 \
KIBANAUSERNAME=your-username \
KIBANAPASSWORD=your-password \
npx @tocharianou/mcp-server-kibana
# Using Cookie Auth
KIBANAURL=http://localhost:5601 \
KIBANACOOKIES="sid=xxx; security-session=yyy" \
npx @tocharianou/mcp-server-kibana
### HTTP Mode (Remote Access)
bash
MCPTRANSPORT=http \
MCPHTTPPORT=3000 \
KIBANAURL=http://localhost:5601 \
KIBANAAPIKEY=your-api-key \
npx @tocharianou/mcp-server-kibana
Access at: http://localhost:3000/mcp
Health check: http://localhost:3000/health
Securing HTTP mode. Every session on /mcp acts with the Kibana credentials the server was started with, so treat the endpoint as sensitive:
By default the server listens on localhost only and rejects requests whose Host header is not a loopback name (DNS rebinding protection).
To accept remote clients, set MCPBEARERTOKEN. Clients must then send Authorization: Bearer on every /mcp request. /health stays open.
Binding to a non-loopback address (MCPHTTPHOST=0.0.0.0) without MCPBEARERTOKEN logs a warning at startup: anyone who can reach the port can use your Kibana credentials.
Behind a reverse proxy that forwards its public Host header to a localhost-bound server, list that hostname in MCPALLOWEDHOSTS.
bash
MCPTRANSPORT=http \
MCPHTTPHOST=0.0.0.0 \
MCPBEARERTOKEN="$(openssl rand -hex 32)" \
KIBANAURL=http://localhost:5601 \
KIBANAAPIKEY=your-api-key \
npx @tocharianou/mcp-server-kibana
## ✨ Features
### Core Capabilities
Dual transport modes: Stdio (local) and HTTP (remote access)
Multiple authentication methods: API Key, Basic Auth, Cookie-based
Multi-space support: Enterprise-ready Kibana space management
SSL/TLS support: Custom CA certificate configuration