Kibana MCP server

Connect Kibana to Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini, GitHub Copilot and any other MCP client, for your whole team. Metorial adds security, governance, and tracing, and gives everyone one Magic MCP URL to connect.

What you can do with the Kibana MCP server

Ask your agent in plain language. Each of these maps to a real tool on the server.

  • Use the search cases tool in Kibana
  • Use the list connectors tool in Kibana
  • Use the list roles tool in Kibana
  • Use the export saved objects tool in Kibana
  • Use the list data views tool in Kibana
  • Use the manage agent policy tool in Kibana

Supported Tools

search_cases

Search Cases

Search and list Kibana cases for incident tracking. Cases can be associated with alerts, have comments and attachments, and can be synced with external case management systems.

list_connectors

List Connectors

List all connectors configured in Kibana. Connectors integrate with external services like email, Slack, PagerDuty, webhook, Jira, ServiceNow, Microsoft Teams, and more.

list_roles

List Roles

List all security roles configured in Kibana. Roles define Elasticsearch and Kibana feature privileges.

export_saved_objects

Export Saved Objects

Export Kibana saved objects in NDJSON format for backup or migration between environments. Specify either object types to export all objects of those types, or provide specific object IDs to export selectively.

list_data_views

List Data Views

List all data views (index patterns) configured in Kibana. Data views define which Elasticsearch indices Kibana queries.

manage_agent_policy

Manage Agent Policy

Create, get, update, or delete a Fleet agent policy. Agent policies define agent behavior, integrations, and monitoring configuration.

execute_connector

Execute Connector

Test or execute a Kibana connector with specific parameters. Useful for testing connector configuration or sending one-off notifications.

get_kibana_status

Get Kibana Status

Get the current status of the Kibana instance, including overall health, version, and plugin status.

add_case_comment

Add Case Comment

Add a comment or alert attachment to an existing Kibana case.

get_enrollment_tokens

Get Enrollment Tokens

Get Fleet enrollment API keys used to enroll new Elastic Agents.

manage_case

Manage Case

Create, get, update, or delete a Kibana case. Cases are used for incident tracking and can be associated with alerts and synced with external case management systems.

manage_data_view

Manage Data View

Create, get, update, or delete a Kibana data view (index pattern). Data views define which Elasticsearch indices Kibana queries. Supports configuring runtime fields, time fields, field formats, and source filters.

manage_connector

Manage Connector

Create, get, update, or delete a Kibana connector. Connectors integrate with external services for rule-triggered notifications. Supported types include email, Slack, PagerDuty, webhook, Jira, ServiceNow, Microsoft Teams, Opsgenie, and more.

manage_saved_object

Manage Saved Object

Get, create, update, or delete a Kibana saved object. Supports dashboards, visualizations, maps, data views, Canvas workpads, and other saved object types. Provide the action to perform along with the object type and ID.

list_spaces

List Spaces

List all Kibana spaces. Spaces organize dashboards and other saved objects into meaningful categories.

manage_slo

Manage SLO

Create, get, update, or delete a Kibana Service Level Objective (SLO). Supports KQL, metric custom, and histogram indicator types with occurrences or timeslices budgeting methods.

search_rules

Search Alerting Rules

Search and list Kibana alerting rules. Rules monitor conditions and trigger actions when thresholds are met. Supports filtering by search terms and KQL filters.

list_agent_policies

List Agent Policies

List Fleet agent policies in Kibana. Agent policies define what data agents collect and which integrations they run.

list_fleet_agents

List Fleet Agents

List Elastic Agents managed by Fleet. Shows agent status, policy assignment, version, and host information.

manage_role

Manage Role

Create, get, update, or delete a Kibana security role. Roles define Elasticsearch cluster/index privileges and Kibana feature privileges per space.

search_saved_objects

Search Saved Objects

Search and list Kibana saved objects such as dashboards, visualizations, maps, data views, Canvas workpads, and other saved objects. Use this to find specific objects by type and search term, or to browse all objects of a given type.

manage_space

Manage Space

Create, get, update, or delete a Kibana space. Spaces enable organizing dashboards and other saved objects into meaningful categories. Rules and connectors are isolated to the space in which they were created.

manage_rule

Manage Alerting Rule

Create, get, update, delete, enable, disable, or mute/unmute a Kibana alerting rule. Rules monitor conditions and trigger actions via connectors when thresholds are met. Supports Elasticsearch query, index threshold, metric threshold, log threshold, and more.

search_slos

Search SLOs

Search and list Kibana Service Level Objectives (SLOs). SLOs define reliability targets for services and can use various indicator types.

list_package_policies

List Package Policies

List Fleet package policies in Kibana. Package policies attach Elastic integrations, such as Nginx or System, to Fleet agent policies.

manage_default_data_view

Manage Default Data View

Get, set, or unset the default Kibana data view for the current space. The default data view is used when no specific data view is selected.

list_rule_types

List Rule Types

List Kibana alerting rule types available to the authenticated user. Use this before creating rules to discover ruleTypeId values, action groups, required license level, and authorized consumers.

list_connector_types

List Connector Types

List Kibana connector types available for rules and cases, including license and feature availability. Use this before creating connectors to discover connectorTypeId values and supported features.

manage_rule_snooze

Manage Rule Snooze

Schedule or delete a Kibana alerting rule snooze schedule. Snooze schedules temporarily suppress rule notifications during maintenance windows or planned downtime.

manage_package_policy

Manage Package Policy

Get, create, update, or delete a Fleet package policy. Package policies attach Elastic integration packages to Fleet agent policies. Provide packagePolicy as the raw Kibana package policy request body for create and update.

Connect Kibana to your AI client

Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.

  1. Enable Kibana in Metorial. In your Metorial portal, enable the Kibana MCP server and sign in with the account that owns the data. Access stays governed by your team policies.
  2. Add a custom connector. Open Customize, then Connectors. Select Add, then Custom, then Web.
  3. Paste your Metorial MCP URL. Name it Metorial, paste your Magic MCP URL (<your-magic-mcp-url>) and continue.
  4. Sign in. Select Add and sign in to load Kibana tools.

Run Kibana through the Metorial gateway

One governed layer for every app your agents reach, not a separate connector per tool.

  • Give Kibana and every other app to your whole team through one MCP gateway, behind your SSO.
  • Scope which teams and agents can use Kibana tools with role-based access control, and trace every call.
  • Prefer to run it yourself? Metorial is open source and self-hostable.

More integrations teams use with Kibana

Google Sheets

Create, read, and update spreadsheets and their cell data. Read and write values to individual cells, ranges, or multiple ranges using A1 notation or named ranges. Apply cell formatting including text styles, backgrounds, borders, number formats, and conditional formatting. Manage sheets (tabs) within a spreadsheet—add, delete, copy, rename, and reorder them. Create and manage embedded charts, pivot tables, filter views, data validation rules, protected ranges, named ranges, and merged cells. Perform batch operations to apply multiple updates atomically.

GitHub

Manage repositories, issues, and pull requests. Create and configure branches, star repositories, review code, and merge changes. Automate CI/CD workflows with GitHub Actions, manage workflow runs, secrets, and artifacts. Track issues with labels, milestones, and assignees. Search across code, repositories, issues, and users. Manage organizations, teams, and memberships. Create and manage projects, gists, packages, deployments, and environments. Access security alerts including code scanning, secret scanning, and Dependabot alerts. Read and write file contents in repositories. Manage webhooks, notifications, and codespaces.

Salesforce

Manage CRM data including Accounts, Contacts, Leads, Opportunities, Cases, and custom objects. Create, read, update, and delete records. Query data using SOQL and search across objects using SOSL. Perform bulk data operations for large-scale imports, exports, and migrations. Execute composite requests to batch multiple operations in a single API call. Access analytics, reports, and dashboards. Manage files and attachments associated with records. Interact with Chatter feeds, posts, and groups for social collaboration. Manage org metadata including custom objects, fields, layouts, and workflows. Query data using GraphQL for precise data retrieval across related objects.

Sharepoint

Manage SharePoint sites, document libraries, lists, and files. Create, read, update, and delete lists and list items with custom columns. Resolve site users to numeric Person/Group LookupId values. Upload, download, move, copy, and version files in document libraries. Search across sites, files, folders, lists, and list items using Microsoft Search. Manage permissions at site, list, and item levels with granular access control. Define and manage content types and site columns. Retrieve site properties and search for sites across Microsoft 365.

Airtable

Create, read, update, and delete records in Airtable bases and tables. Manage base schemas including creating tables and fields. Filter records using formulas, sort by fields, and scope queries to specific views. Upsert records to find, create, or update in a single call. Upload attachments to records, read and write record comments, list accessible bases, and receive real-time base change events through webhooks.

Google Drive

Upload, download, create, copy, move, rename, trash, and permanently delete files and folders in Google Drive. Search for files using complex queries filtering by name, MIME type, owner, modification date, labels, and other metadata. Share files and folders with specific users, groups, or domains with role-based permissions (owner, writer, commenter, reader). Manage shared drives and their members. Export Google Workspace files (Docs, Sheets, Slides) to standard formats like PDF, DOCX, and XLSX. Track file revision history and restore earlier versions. Create, read, update, and delete threaded comments and replies on files. Read label definitions and search files by label. Browse the Drive apps installed for your account. Store app-specific data in a hidden per-user folder.

Technical notes for Kibana

Manage Kibana resources and the Elastic Stack visualization layer programmatically. Create, import, export, and organize saved objects such as dashboards, visualizations, and data views across spaces. Configure alerting rules with threshold, query, and metric conditions, and connect them to actions via connectors (email, Slack, PagerDuty, webhook, Jira, ServiceNow, and more). Manage data views (index patterns) that define which Elasticsearch indices Kibana queries. Create and organize spaces to separate dashboards and objects into meaningful categories. Track incidents with cases, define and monitor Service Level Objectives (SLOs), manage Fleet agent policies and enrollments, configure security detection rules for SIEM, and control role-based access with Kibana feature privileges.

Frequently asked questions

Common questions about connecting Kibana to AI agents with Metorial.

  1. How many tools does the Kibana MCP server have?
    The Kibana MCP server exposes 30 tools, including Search Cases, List Connectors, List Roles. Each one is governed and traced through Metorial.
  2. Kibana exposes tools your agents call on demand; it does not publish event triggers yet. Everything still runs through one governed MCP URL.
  3. Any MCP client, including VS Code, Windsurf, Zed, OpenCode and Grok. Each one reaches the Kibana MCP server through the same Metorial URL.
  4. Use role-based access control to decide which teams, users, and agents can use Kibana and which of its tools they can call.
  5. Yes. Metorial is open source, so you can run the Kibana MCP server yourself or use the hosted gateway.

Connect Kibana to production AI agents

See how Metorial gives your team governed access to Kibana, with tracing and security controls built in.