Kibana MCP server for AI agents

The Kibana MCP server implementation allows any MCP-compatible client (such as Claude Desktop) to access your Kibana instance through natural language or programmatic requests. It connects to your Kibana instances and exposes the Kibana API endpoints as both tools and resources that can be queried and executed.

Installation and Configuration

Requirements

Node.js installed on your system
Access to a Kibana instance
Valid Kibana credentials

Configuration Options

Configure the server using these environment variables:

Variable Name	Description	Required
`KIBANA_URL`	Kibana server address (e.g., http://localhost:5601)	Yes
`KIBANA_USERNAME`	Kibana username	Yes
`KIBANA_PASSWORD`	Kibana password	Yes
`KIBANA_CA_CERT`	CA certificate path (for SSL verification)	No
`KIBANA_TIMEOUT`	Request timeout in ms (default 30000)	No
`KIBANA_MAX_RETRIES`	Max request retries (default 3)	No
`NODE_TLS_REJECT_UNAUTHORIZED`	Set to `0` to disable SSL certificate validation (use with caution)	No

Starting the Server

Start the server by providing the required environment variables:

KIBANA_URL=http://your-kibana-server:5601 \
KIBANA_USERNAME=your-username \
KIBANA_PASSWORD=your-password \
NODE_TLS_REJECT_UNAUTHORIZED=0 \
npm start

Integration with Claude Desktop

Adding to Claude Desktop Configuration

Add the MCP server to your Claude Desktop configuration file (located at ~/Library/Application Support/Claude/claude_desktop_config.json on MacOS):

{
  "mcpServers": {
    "kibana-mcp-server": {
      "command": "node",
      "args": ["/path/to/mcp-server-kibana/dist/index.js"],
      "env": {
        "KIBANA_URL": "http://your-kibana-server:5601",
        "KIBANA_USERNAME": "your-username",
        "KIBANA_PASSWORD": "your-password",
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }
}

Using the MCP Server

Available Resources

Resource URI	Description
`kibana-api://paths`	Returns all available Kibana API endpoints (can filter with `search` param)
`kibana-api://path/{method}/{encoded_path}`	Returns details for a specific API endpoint

Examples:

kibana-api://paths?search=saved_objects
kibana-api://path/GET/%2Fapi%2Fstatus

Available Tools

Tool Name	Description	Input Parameters
`get_status`	Get the current status of the Kibana server	None
`execute_api`	Execute a custom Kibana API request	`method` (GET/POST/PUT/DELETE), `path` (string), `body` (optional), `params` (optional)
`search_kibana_api_paths`	Search Kibana API endpoints by keyword	`search` (string)
`list_all_kibana_api_paths`	List all Kibana API endpoints	None
`get_kibana_api_detail`	Get details for a specific Kibana API endpoint	`method` (string), `path` (string)

Prompt Modes

When using with Claude Desktop, two interaction modes are available:

Tool-based Prompt Mode

Uses the kibana-tool-expert prompt
Claude directly calls server tools to answer questions or perform actions
Best for conversational, guided experience
Example: "Show all Kibana API endpoints related to saved objects"

Resource-based Prompt Mode

Uses the kibana-resource-helper prompt
Claude interacts with the server via resource URIs
Best for advanced users or clients that only support resource access
Example: "Get resource kibana-api://paths?search=dashboard"

Example Queries

"What is the status of my Kibana server?"
"List all available Kibana API endpoints."
"Show details for the POST /api/saved_objects/_find endpoint."
"Execute a custom API request for /api/status."
"Get a list of all dashboards in Kibana."
"Query API endpoints related to endpoint events."
"List all case-related API endpoints."
"Create a new case in Kibana."
"Create a new dashboard in Kibana."

Troubleshooting

If you encounter issues:

Verify your MCP configuration is correct
Ensure the Kibana address is accessible
Check that authentication credentials have sufficient permissions
For custom CA setups, confirm the certificate path is correct and readable
Be aware of security risks when using NODE_TLS_REJECT_UNAUTHORIZED=0
Check error messages in the terminal output

For debugging, you can use the MCP Inspector:

npm run inspector

This will provide a browser-accessible debugging tool URL.

How to add this MCP server to Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > MCP and click "Add new global MCP server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "cursor-rules-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "cursor-rules-mcp"
            ]
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explictly ask the agent to use the tool by mentioning the tool name and describing what the function does.