Elastic Agent Builder

Remote MCP·Remote·HTTP

Exposes built-in and custom Elastic tools from Kibana to MCP clients for search, logs, and security analytics.

Good for:Search and logsElastic toolsSecurity analytics

Installation path

Open Augment→Go to Configuration→Select MCP Registry→Click "Add Server"

Choose Add Server, select Remote MCP, use HTTP, paste {KIBANA_URL}/api/agent_builder/mcp, then authenticate with an Authorization: ApiKey <API_KEY> header for an API key that has Elastic Agent Builder Kibana privileges.

Setup steps

01
Create a Kibana API key
In Kibana, create an API key with Elastic Agent Builder privileges.
02
Open Add Server
Configuration → MCP Registry → Add Server in Cosmos.
03
Pick the Remote MCP tab
04
Set the transport
Transport
HTTP
05
Paste the server URL
For custom Kibana Spaces use {KIBANA_URL}/s/{SPACE_NAME}/api/agent_builder/mcp.
URL
{KIBANA_URL}/api/agent_builder/mcp
06
Choose authentication
Add header Authorization: ApiKey <KEY>.
07
Click Add, then enable
Toggle on the products that need it.
08
Fallback (mcp-remote)
Add as a Local MCP with command npx, args mcp-remote {KIBANA_URL}/api/agent_builder/mcp --header Authorization:ApiKey <KEY>.

Local command

Suggested name: elastic-agent-builder

npx mcp-remote ${KIBANA_URL}/api/agent_builder/mcp --header Authorization:${AUTH_HEADER}

Local fallback only when the client cannot reach the remote endpoint. Set AUTH_HEADER to ApiKey ${API_KEY}.

Remote URL

{KIBANA_URL}/api/agent_builder/mcp

For custom Kibana Spaces, use {KIBANA_URL}/s/{SPACE_NAME}/api/agent_builder/mcp. Replace {KIBANA_URL} with the deployment URL.

Authentication

Kibana API key via header `Authorization: ApiKey <KEY>`.

Variable	Example	Required
API_KEY	<kibana_api_key>	Yes

Official documentation →

← All MCPs Workflows →