How to integrate Kibana MCP with Claude Code

Manage your Kibana directly from Claude Code with zero worries about OAuth hassles, API-breaking issues, or reliability and security concerns. You can do this in two different ways: Via Composio Connect - Direct and easiest approach Via Composio SDK - Programmatic approach with more control

Kibana logoKibana
Api KeyBasic

Kibana is a visualization and analytics platform for Elasticsearch data. It helps you explore, visualize, and monitor your data using intuitive dashboards and interactive tools.

47 Tools

Introduction

Manage your Kibana directly from Claude Code with zero worries about OAuth hassles, API-breaking issues, or reliability and security concerns.

You can do this in two different ways:

  1. Via Composio Connect - Direct and easiest approach
  2. Via Composio SDK - Programmatic approach with more control

Also integrate Kibana with

Why use Composio?

  • Only one MCP URL to connect multiple apps with Claude Code with zero auth hassles.
  • Programmatic tool calling allows LLMs to write its code in a remote workbench to handle complex tool chaining. Reduces to-and-fro with LLMs for frequent tool calling.
  • Handling Large tool responses out of LLM context to minimize context rot.
  • Dynamic just-in-time access to 20,000 tools across 1000+ other Apps for cross-app workflows. It loads the tools you need, so LLMs aren't overwhelmed by tools you don't need.

Connecting Kibana to Claude Code using Composio

1. Add the Composio MCP to Claude

Terminal

2. Start Claude Code

bash
claude

3. Open your MCP list

bash
/mcp

4. Select Composio and click on Authenticate

Select Composio and click Authenticate

5. This will redirect you to the Composio OAuth page. Complete the flow by authorizing Composio and you're all set.

Composio OAuth authorization page
Composio authorization complete
Ask Claude to connect to your account and authenticate via the link

What is the Kibana MCP server, and what's possible with it?

The Kibana MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Kibana account. It provides structured and secure access so your agent can perform Kibana operations on your behalf.

Connecting Kibana via Composio SDK

Composio SDK is the underlying tech that powers Rube. It's a universal gateway that does everything Rube does but with much more programmatic control. You can programmatically generate an MCP URL with the app you need (here Kibana) for even more tool search precision. It's secure and reliable.

How the Composio SDK works

The Composio SDK follows a three-phase workflow:

  1. Discovery: Searches for tools matching your task and returns relevant toolkits with their details.
  2. Authentication: Checks for active connections. If missing, creates an auth config and returns a connection URL via Auth Link.
  3. Execution: Executes the action using the authenticated connection.

Step-by-step Guide

Step by step10 STEPS
1

Prerequisites

Before starting, make sure you have:
  • Claude Pro, Max, or API billing enabled Anthropic account
  • Composio API Key
  • A Kibana account
  • Basic knowledge of Python or TypeScript
2

Install Claude Code

bash
# macOS, Linux, WSL
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# Windows CMD
curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

To install Claude Code, use one of the following methods based on your operating system:

3

Set up Claude Code

bash
cd your-project-folder
claude

Open a terminal, go to your project folder, and start Claude Code:

  • Claude Code will open in your terminal
  • Follow the prompts to sign in with your Anthropic account
  • Complete the authentication flow
  • Once authenticated, you can start using Claude Code
Claude Code initial setup showing sign-in prompt
Claude Code terminal after successful login
4

Set up environment variables

bash
COMPOSIO_API_KEY=your_composio_api_key_here
USER_ID=your_user_id_here

Create a .env file in your project root with the following variables:

  • COMPOSIO_API_KEY authenticates with Composio (get it from Composio dashboard)
  • USER_ID identifies the user for session management (use any unique identifier)
5

Install Composio library

npm install @composio/core dotenv

Install the Composio TypeScript library to create MCP sessions.

  • @composio/core provides the core Composio functionality
  • dotenv loads environment variables from your .env file
6

Generate Composio MCP URL

import 'dotenv/config';
import { Composio } from '@composio/core';

const { COMPOSIO_API_KEY, USER_ID } = process.env;

if (!COMPOSIO_API_KEY || !USER_ID) {
  throw new Error('COMPOSIO_API_KEY and USER_ID required in .env');
}

const composioClient = new Composio({ apiKey: COMPOSIO_API_KEY });

const composioSession = await composioClient.create(USER_ID, {
  toolkits: ['kibana'],
});

const composioMcpUrl = composioSession?.mcp.url;

console.log(`MCP URL: ${composioMcpUrl}`);
console.log(`\nUse this command to add to Claude Code:`);
console.log(`claude mcp add --transport http kibana-composio "${composioMcpUrl}" --headers "X-API-Key:${COMPOSIO_API_KEY}"`);

Create a script to generate a Composio MCP URL for Kibana. This URL will be used to connect Claude Code to Kibana.

What's happening

  • We import the Composio client and load environment variables
  • Create a Composio instance with your API key
  • Call create() to create a Tool Router session for Kibana
  • The returned mcp.url is the MCP server URL that Claude Code will use
  • The script prints this URL so you can copy it
7

Run the script and copy the MCP URL

node --loader ts-node/esm generate_mcp_url.ts
# or if using tsx
tsx generate_mcp_url.ts

Run your TypeScript script to generate the MCP URL.

  • The script connects to Composio and creates a Tool Router session
  • It prints the MCP URL and the exact command you need to run
  • Copy the entire claude mcp add command from the output
8

Add Kibana MCP to Claude Code

bash
claude mcp add --transport http kibana-composio "YOUR_MCP_URL_HERE" --headers "X-API-Key:YOUR_COMPOSIO_API_KEY"

# Then restart Claude Code
exit
claude

In your terminal, add the MCP server using the command from the previous step. The command format is:

  • claude mcp add registers a new MCP server with Claude Code
  • --transport http specifies that this is an HTTP-based MCP server
  • The server name (kibana-composio) is how you'll reference it
  • The URL points to your Composio Tool Router session
  • --headers includes your Composio API key for authentication

After running the command, close the current Claude Code session and start a new one for the changes to take effect.

9

Verify the installation

bash
claude mcp list

Check that your Kibana MCP server is properly configured.

  • This command lists all MCP servers registered with Claude Code
  • You should see your kibana-composio entry in the list
  • This confirms that Claude Code can now access Kibana tools

If everything is wired up, you should see your kibana-composio entry listed:

Claude Code MCP list showing the toolkit MCP server
10

Authenticate Kibana

The first time you try to use Kibana tools, you'll be prompted to authenticate.

  • Claude Code will detect that you need to authenticate with Kibana
  • It will show you an authentication link
  • Open the link in your browser (or copy/paste it)
  • Complete the Kibana authorization flow
  • Return to the terminal and start using Kibana through Claude Code

Once authenticated, you can ask Claude Code to perform Kibana operations in natural language. For example:

  • "Visualize weekly sales data as a chart"
  • "List top error logs from last 24 hours"
  • "Generate dashboard of user activity trends"

Complete Code

Here's the complete code to get you started with Kibana and Claude Code:

import 'dotenv/config';
import { Composio } from '@composio/core';

const { COMPOSIO_API_KEY, USER_ID } = process.env;

if (!COMPOSIO_API_KEY || !USER_ID) {
  throw new Error('COMPOSIO_API_KEY and USER_ID required in .env');
}

const composioClient = new Composio({ apiKey: COMPOSIO_API_KEY });

const composioSession = await composioClient.create(USER_ID, {
  toolkits: ['kibana'],
});

const composioMcpUrl = composioSession?.mcp.url;

console.log(`MCP URL: ${composioMcpUrl}`);
console.log(`\nUse this command to add to Claude Code:`);
console.log(`claude mcp add --transport http kibana-composio "${composioMcpUrl}" --headers "X-API-Key:${COMPOSIO_API_KEY}"`);

Conclusion

You've successfully integrated Kibana with Claude Code using Composio's MCP server. Now you can interact with Kibana directly from your terminal using natural language commands.

Key features of this setup:

  • Terminal-native experience without switching contexts
  • Natural language commands for Kibana operations
  • Secure authentication through Composio's managed MCP
  • Tool Router for dynamic tool discovery and execution

Next steps:

  • Try asking Claude Code to perform various Kibana operations
  • Add more toolkits to your Tool Router session for multi-app workflows
  • Integrate this setup into your development workflow for increased productivity

You can extend this by adding more toolkits, implementing custom workflows, or building automation scripts that leverage Claude Code's capabilities.

TOOLS

Supported Tools

Every Kibana action and event your agent gets out of the box.

Delete Alerting Rule

Tool to delete an alerting rule in Kibana.

Delete Connector

Tool to delete a connector in Kibana.

Delete Fleet Output

Tool to delete a specific output configuration in Kibana Fleet.

Delete Fleet Proxy

Deletes a Fleet proxy configuration by its unique identifier.

Delete List

Deletes a list.

Delete Osquery Saved Query

Delete a saved Osquery query by its saved object ID.

Delete Saved Object

Tool to delete a saved object in Kibana.

Find Kibana Alerts

Tool to find and/or aggregate detection alerts in Kibana.

Get Action Types

Retrieves all available connector types (actions) in Kibana.

Get Alerting Rules

Tool to retrieve a list of alerting rules in Kibana.

Get Rule Types

Retrieves available rule types (alert types) in Kibana.

Get Cases

Tool to retrieve a list of cases in Kibana.

Get All Connectors

Tool to retrieve a list of all connectors in Kibana.

Get Data Views

Retrieves all data views (formerly known as index patterns) available in Kibana.

Find Detection Engine Rules

Retrieves a paginated list of Kibana detection engine rules with flexible filtering and sorting options.

Get Endpoint List Items

Retrieves Elastic Endpoint exception list items with filtering, pagination, and sorting capabilities.

Get Entity Store Engines

Retrieves all entity store engines configured in Kibana.

List Entity Store Entities

Tool to list entity records in the entity store with support for paging, sorting, and filtering.

Get Entity Store Status

Retrieves the current status of the Kibana Entity Store and its configured engines.

Get Fleet Agent Policies

Retrieves a paginated list of Fleet agent policies with filtering, sorting, and optional detailed information.

Get Fleet Agents Available Versions

Tool to retrieve the available versions for Fleet agents.

Get Fleet Agents Setup Status

Check Fleet setup readiness and identify missing requirements.

Check Fleet Permissions

Tool to check the permissions for the Fleet API.

Get Fleet Enrollment API Key

Tool to retrieve details of a specific enrollment API key by its ID.

Get Fleet Enrollment API Keys

Tool to fetch a list of enrollment API keys.

Get Fleet EPM Categories

Get all available package categories in the Elastic Package Manager (EPM) with package counts.

Get Fleet EPM Data Streams

Tool to retrieve the list of data streams in the Elastic Package Manager.

Get Fleet EPM Package Details

Retrieves comprehensive details for a specific Fleet integration package version from the Elastic Package Manager (EPM).

Get Fleet EPM Package File

Retrieves a specific file from an Elastic Package Manager (EPM) package.

Get Fleet EPM Packages

Tool to fetch the list of available packages in the Elastic Package Manager.

Get Installed EPM Packages

Tool to retrieve the list of installed packages in the Elastic Package Manager.

Get Fleet EPM Packages (Limited)

Retrieves a limited list of package names from the Elastic Package Manager (EPM) registry.

Get EPM Package Statistics

Retrieves usage statistics for a specific Fleet package in Kibana, including the number of package policies and agent policies using the package.

Get Fleet Package Policies

Retrieves a list of Fleet package policies (integration policies) in Kibana.

Get Fleet Server Host

Tool to fetch details of a specific Fleet server host by its item ID.

Get Fleet Server Hosts

Tool to retrieve the list of Fleet Server hosts.

Get Index Management Indices

Tool to fetch information about indices managed by Kibana's Index Management feature.

Get Node Metrics

Tool to retrieve statistics for nodes in an Elasticsearch cluster, often visualized in Kibana.

Get Reporting Jobs

Tool to retrieve a list of reporting jobs in Kibana.

Get Saved Objects

Tool to retrieve a list of saved objects in Kibana based on specified criteria.

Get Kibana Status

Tool to get the current status of Kibana.

Create Alerting Rule

Tool to create a new alerting rule in Kibana.

Create Case

Tool to create a new case in Kibana.

Create Kibana Connector

Tool to create a new connector in Kibana.

Create Dashboard

Tool to create a new dashboard in Kibana.

Create Data View

Tool to create a new data view (index pattern) in Kibana.

Create or Update Saved Object

Tool to create or update a saved object in Kibana.

FAQ

Frequently asked questions

With a standalone Kibana MCP server, the agents and LLMs can only access a fixed set of Kibana tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Kibana and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Claude Code fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Kibana tools.

Yes, absolutely. You can configure which Kibana scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Kibana data and credentials are handled as safely as possible.

Start with Kibana.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Kibana tool your agent needs.Free to start.

Start building