# Kibana MCP Server

> Structured Kibana investigations for agents and teams

A read-only MCP server that turns Kibana logs into sources an agent can discover, fields it can inspect and results it can read.

## Table of Contents

### Introduction

- [What is Kibana MCP Server?](/kibana-mcp-server/guide/what-is-it.md): What Kibana MCP Server is, why it exists and what it deliberately does not do.
- [Getting started](/kibana-mcp-server/guide/getting-started.md): Requirements, prompt-free bootstrap, agent skill installation and use in Codex.
- [Investigating with an agent](/kibana-mcp-server/guide/investigating.md): The investigation workflow step by step: configure a source, discover, describe fields, then query.

### Configuration

- [Profiles and environments](/kibana-mcp-server/guide/profiles.md): Saved machine profiles and how to work with several Kibana environments.
- [Configuration file](/kibana-mcp-server/guide/configuration-file.md): Configure the server with a kibana.mcp.config.ts file: connection, catalog store and HTTP options.

### Transports

- [stdio transport](/kibana-mcp-server/deployment/stdio.md): The default stdio transport: what it serves and when to move to HTTP.
- [HTTP transport](/kibana-mcp-server/deployment/http.md): Run one shared server over Streamable HTTP with a source catalog per caller.
- [OpenID Connect authentication](/kibana-mcp-server/deployment/oidc.md): Protect the HTTP transport with your OpenID Connect provider: each user signs in, and gets the catalog named by their token.
- [Security model](/kibana-mcp-server/deployment/security.md): What the HTTP transport trusts, the safeguards built in and how credentials are handled.

### Catalog stores

- [Catalog stores](/kibana-mcp-server/deployment/catalog-stores.md): Where source catalogs can live: files, Redis, PostgreSQL, MongoDB, SQLite or a custom store.
- [Redis store](/kibana-mcp-server/deployment/stores/redis.md): Keep source catalogs in Redis with the redis or ioredis client: options and durability requirements.
- [PostgreSQL store](/kibana-mcp-server/deployment/stores/postgres.md): Keep source catalogs in PostgreSQL: options, table definition and required privileges.
- [MongoDB store](/kibana-mcp-server/deployment/stores/mongodb.md): Keep source catalogs in MongoDB: options, document shape and replica set connections.
- [SQLite store](/kibana-mcp-server/deployment/stores/sqlite.md): Keep source catalogs in a local SQLite file with the built-in node:sqlite module.
- [Custom store](/kibana-mcp-server/deployment/stores/custom.md): Implement the CatalogStore contract to keep source catalogs in any backend.

### Integration examples

- [Integration examples](/kibana-mcp-server/integrations.md): Complete setups for running Kibana MCP Server as a shared service.
- [Behind an MCP gateway](/kibana-mcp-server/integrations/gateway.md): What an MCP gateway or reverse proxy must do in front of the HTTP transport, with an nginx example.
- [Ts.ED gateway](/kibana-mcp-server/integrations/tsed.md): Expose Kibana MCP Server through a Ts.ED gateway protected by OIDC, with one catalog per user.
- [Docker image](/kibana-mcp-server/integrations/docker.md): A Docker image and compose file that run the server over HTTP, protected by OpenID Connect, with catalogs in PostgreSQL.

### AI

- [Built for agents](/kibana-mcp-server/ai.md): How Kibana MCP Server supports AI agents - LLM-friendly documentation, agent plugins for Claude Code and Codex, and a skill installable with skills.sh.
- [LLM-friendly documentation](/kibana-mcp-server/ai/llms.md): The documentation is published as plain Markdown for language models - llms.txt, llms-full.txt and a Markdown version of every page.
- [Agent plugins and skills](/kibana-mcp-server/ai/agent-plugins.md): Install the Kibana log investigation plugin for Claude Code or Codex, or the skill with skills.sh, and connect any MCP client to the server.

### Configuration

- [Command line](/kibana-mcp-server/reference/cli.md): Commands and options of the kibana-mcp-server command line: serve, bootstrap and setup.
- [Environment variables](/kibana-mcp-server/reference/environment.md): Every KIBANA_* environment variable read by the server.
- [Configuration file reference](/kibana-mcp-server/reference/config-file.md): Every option of the configuration file, its precedence and its constraints.
- [Source catalog](/kibana-mcp-server/reference/source-catalog.md): The format of a source definition, the supported backends and schema backends.

### Tools

- [`configure_index`](/kibana-mcp-server/reference/tools/configure-index.md): Reference of the configure_index tool: configure one index or pattern as a logical source.
- [`discover`](/kibana-mcp-server/reference/tools/discover.md): Reference of the discover tool: list the logical sources of the current profile.
- [`describe_fields`](/kibana-mcp-server/reference/tools/describe-fields.md): Reference of the describe_fields tool: inspect the effective fields of a source.
- [`query`](/kibana-mcp-server/reference/tools/query.md): Reference of the query tool: search sources over a time window in six modes.
- [`filter`](/kibana-mcp-server/reference/tools/filter.md): Reference of the filter tool: exact-field filtering without alias resolution.

### Project

- [Development](/kibana-mcp-server/contributing/development.md): Set up a checkout, run the checks and build the documentation site.
- [Architecture](/kibana-mcp-server/contributing/architecture.md): Source layout, the path of a tool call, the profile registry and catalog stores.

### Other

- [Errors](/kibana-mcp-server/reference/errors.md): Kibana request error codes, catalog errors and HTTP transport statuses.