mcpField
K
Kibana MCP Server

Kibana MCP Server

Local
github.com/ggilligan12Security13Updated 74w ago
Repository

About Kibana MCP Server

Kibana MCP Server exposes Kibana Security alert and detection-rule management for AI assistants working with SecOps. It supports alert review and tagging, status changes, and rule exception workflows.

Key features

  1. 01Fetch security alerts
  2. 02Add alert tags
  3. 03Change alert status
  4. 04Search detection rules
  5. 05Manage rule exception lists

Use cases

  1. 01Review Kibana Security alerts
  2. 02Categorize alerts and update status
  3. 03Find detection rules and exceptions
  4. 04Create or link rule exception lists

MCP support

As an MCP server, it provides MCP clients with tools for managing Kibana Security alerts, rules, and exceptions.

#kibana#mcp#mcp-server

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "kibana": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "build"
      ]
    }
  }
}
Run commanddocker run -i --rm build

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocibuild

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Kibana MCP Server

Kibana MCP Demo

Model Context Protocol (MCP) server for Kibana Security - manage alerts, rules, and exceptions via AI assistants.

Quick Start

1. Clone and Build
git clone https://github.com/ggilligan12/kibana-mcp.git
cd kibana-mcp
docker build -t kibana-mcp .
2. Configure MCP Client

Add to your MCP client config (Claude Desktop, Cursor, etc.):

Option A: Using Environment Variables (Recommended)

First, set your credentials:

export KIBANA_URL="https://your-kibana.example.com:5601"

# Option 1: API Key (recommended)
export KIBANA_API_KEY="your_base64_api_key"

# Option 2: Username/Password
# export KIBANA_USERNAME="your_username"
# export KIBANA_PASSWORD="your_password"

Then add to your MCP config:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_API_KEY", "kibana-mcp"]
    }
  }
}

For username/password, use:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_USERNAME", "-e", "KIBANA_PASSWORD", "kibana-mcp"]
    }
  }
}

Option B: Direct Credentials (Easier for Claude Desktop)

Using API Key:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_API_KEY=your_base64_api_key",
        "kibana-mcp"
      ]
    }
  }
}

Using Username/Password:

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_USERNAME=your_username",
        "-e", "KIBANA_PASSWORD=your_password",
        "kibana-mcp"
      ]
    }
  }
}

Note: Option B is less secure but more convenient for tools like Claude Desktop where environment variables are harder to manage.

Available Tools

  • get_alerts - Fetch security alerts
  • tag_alert - Add tags to alerts
  • adjust_alert_status - Change alert status (open/acknowledged/closed)
  • find_rules - Search detection rules
  • get_rule_exceptions - Get rule exception items
  • add_rule_exception_items - Add exceptions to rules
  • create_exception_list - Create new exception lists
  • associate_shared_exception_list - Link exception lists to rules

Local Development

# Install dependencies
uv sync

# Set environment variables (see above)

# Run locally
uv run kibana-mcp
Test Environment
# Start local Kibana/Elasticsearch with test data
pip install -r testing/requirements-dev.txt
./testing/quickstart-test-env.sh

# Access at http://localhost:5601 (elastic/elastic)

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.