Elastic's Elasticsearch MCP server lets agents list indices, read mappings, run Query DSL searches and ES|QL queries. It is deprecated and receives only critical security updates; Elastic recommends the Agent Builder MCP endpoint in Elastic 9.2+.
Connect
- 1Add the server to Codex
codex mcp add elasticsearch --env ES_URL=YOUR_ES_URL --env ES_API_KEY=YOUR_ES_API_KEY -- docker run -i --rm -e ES_URL -e ES_API_KEY docker.elastic.co/mcp/elasticsearch stdio
Configs are generated from the publisher's documented endpoint. Check their docs for plan requirements and scopes. New to this? Read the step-by-step tutorial.
Tools 5
list_indicesget_mappingssearchesqlget_shardsThings to ask
- “List all indices in my cluster”
- “Show the mappings for the logs-* index”
- “Find error logs from the last hour”
- “Run an ES|QL query counting events by host”
Remove it
- 1In Codex
codex mcp remove elasticsearchOr delete the [mcp_servers.elasticsearch] block from ~/.codex/config.toml.