# How to integrate Kibana MCP with Hermes

```json
{
  "title": "How to integrate Kibana MCP with Hermes",
  "toolkit": "Kibana",
  "toolkit_slug": "kibana",
  "framework": "Hermes",
  "framework_slug": "hermes-agent",
  "url": "https://composio.dev/toolkits/kibana/framework/hermes-agent",
  "markdown_url": "https://composio.dev/toolkits/kibana/framework/hermes-agent.md",
  "updated_at": "2026-05-06T08:17:33.368Z"
}
```

## Introduction

Hermes is a 24/7 autonomous agent that lives on your computer or server — it remembers what it learns and evolves as your usage grows.
This guide explains the easiest and most robust way to connect your Kibana account to Hermes. You can do this through either Composio Connect CLI or Composio Connect MCP. For personal use we recommend the CLI, but you won't go wrong with MCP either.

## Also integrate Kibana with

- [OpenAI Agents SDK](https://composio.dev/toolkits/kibana/framework/open-ai-agents-sdk)
- [Claude Agent SDK](https://composio.dev/toolkits/kibana/framework/claude-agents-sdk)
- [Claude Code](https://composio.dev/toolkits/kibana/framework/claude-code)
- [Claude Cowork](https://composio.dev/toolkits/kibana/framework/claude-cowork)
- [Codex](https://composio.dev/toolkits/kibana/framework/codex)
- [OpenClaw](https://composio.dev/toolkits/kibana/framework/openclaw)
- [CLI](https://composio.dev/toolkits/kibana/framework/cli)
- [Google ADK](https://composio.dev/toolkits/kibana/framework/google-adk)
- [LangChain](https://composio.dev/toolkits/kibana/framework/langchain)
- [Vercel AI SDK](https://composio.dev/toolkits/kibana/framework/ai-sdk)
- [Mastra AI](https://composio.dev/toolkits/kibana/framework/mastra-ai)
- [LlamaIndex](https://composio.dev/toolkits/kibana/framework/llama-index)
- [CrewAI](https://composio.dev/toolkits/kibana/framework/crew-ai)

## TL;DR

### What is Composio Connect?
Composio Connect is a consumer offering that lets anyone plug 1,000+ applications directly into their agent harness — including Hermes. It can:
- Search and load tools from relevant toolkits on-demand, reducing context usage.
- Chain multiple tools to accomplish complex workflows via a remote workbench, without excessive back-and-forth with the LLM.
- Manage app authentication end-to-end with zero manual overhead.

## Connect Kibana to Hermes

### Integrating Kibana with Hermes
### Using Composio Connect CLI
1. Install the Composio CLI
Run the install script directly, or paste https://composio.dev/hermes into your Hermes chat box to have it installed for you.

```bash
curl -fsSL https://composio.dev/install | bash
```

## What is the Kibana MCP server, and what's possible with it?

The Kibana MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Kibana account. It provides structured and secure access so your agent can perform Kibana operations on your behalf.

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `KIBANA_DELETE_ACTION` | Delete Action | Tool to delete an action in kibana. use when you need to remove a specific action by its id, optionally within a specific space. |
| `KIBANA_DELETE_ALERTING_RULES` | Delete Alerting Rule | Tool to delete an alerting rule in kibana. use when you need to remove a specific alerting rule by its id. |
| `KIBANA_DELETE_CONNECTORS` | Delete Connector | Tool to delete a connector in kibana. use when you need to remove an existing connector. |
| `KIBANA_DELETE_FLEET_OUTPUT` | Delete Fleet Output | Tool to delete a specific output configuration in kibana fleet. use when you need to remove an existing output by its id. |
| `KIBANA_DELETE_FLEET_PROXY` | Delete Fleet Proxy | Tool to delete a specific fleet proxy configuration by its id. use when you need to remove an existing proxy setup. |
| `KIBANA_DELETE_LIST` | Delete List | Deletes a list. use when you want to delete a list by its id. |
| `KIBANA_DELETE_OSQUERY_SAVED_QUERIES` | Delete Osquery Saved Query | Tool to delete a saved osquery query by its id. use when you need to remove a specific osquery saved query. |
| `KIBANA_DELETE_SAVED_OBJECTS` | Delete Saved Object | Tool to delete a saved object in kibana. use when you need to remove a specific saved object like a visualization or dashboard. |
| `KIBANA_FIND_ALERTS` | Find Kibana Alerts | Tool to find and/or aggregate detection alerts in kibana. use this to retrieve a list of alerts, optionally filtering them with a query and performing aggregations. |
| `KIBANA_GET_ACTION_TYPES` | Get Action Types | Tool to fetch the list of available action types (e.g., '.slack', '.email', '.webhook') in kibana. use this to discover the 'actiontypeid' needed when creating a new action. |
| `KIBANA_GET_ALERTING_RULES` | Get Alerting Rules | Tool to retrieve a list of alerting rules in kibana. use when you need to get a paginated set of rules based on specified conditions. |
| `KIBANA_GET_ALERT_TYPES` | Get Alert Types | Tool to retrieve available alert types in kibana. use when you need to get a list of all possible alert types and their metadata. |
| `KIBANA_GET_CASES` | Get Cases | Tool to retrieve a list of cases in kibana. use when you need to find or list existing security or operational cases, potentially filtering by various attributes like status, assignee, or severity. |
| `KIBANA_GET_CONNECTORS` | Get All Connectors | Tool to retrieve a list of all connectors in kibana. use this tool when you need to get information about available connectors. |
| `KIBANA_GET_DATA_VIEWS` | Get Data Views | Tool to retrieve a list of data views available in kibana. use when you need to get a list of available data views, optionally filtering by a name pattern. |
| `KIBANA_GET_DETECTION_ENGINE_RULES_FIND` | Find Detection Engine Rules | Retrieves a list of detection engine rules based on specified criteria. use this tool to find detection rules. |
| `KIBANA_GET_ENDPOINT_LIST_ITEMS` | Get Endpoint List Items | Tool to retrieve all items from an endpoint exception list. use when you need to get a list of endpoint exceptions, for example, to check existing exceptions before adding a new one. |
| `KIBANA_GET_ENTITY_STORE_ENGINES` | Get Entity Store Engines | Retrieves the list of engines from the entity store. |
| `KIBANA_GET_ENTITY_STORE_ENTITIES_LIST` | List Entity Store Entities | Tool to list entity records in the entity store with support for paging, sorting, and filtering. use when you need to retrieve a list of entities such as users, hosts, or services. |
| `KIBANA_GET_ENTITY_STORE_STATUS` | Get Entity Store Status | Tool to retrieve the status of the entity store in kibana. use this to check if the entity store is operational. |
| `KIBANA_GET_FLEET_AGENT_POLICIES` | Get Fleet Agent Policies | Fetches a list of agent policies in fleet. use when you need to retrieve agent policy configurations. |
| `KIBANA_GET_FLEET_AGENTS_AVAILABLE_VERSIONS` | Get Fleet Agents Available Versions | Tool to retrieve the available versions for fleet agents. use when you need to get a list of all available elastic agent versions. |
| `KIBANA_GET_FLEET_AGENTS_SETUP_STATUS` | Get Fleet Agents Setup Status | Tool to check if the fleet agents are set up. use when you need to verify the fleet agent setup status. |
| `KIBANA_GET_FLEET_CHECK_PERMISSIONS` | Check Fleet Permissions | Tool to check the permissions for the fleet api. use when you need to verify if the current user has the necessary privileges for fleet operations. |
| `KIBANA_GET_FLEET_DATA_STREAMS` | Get Fleet Data Streams | Retrieves the list of data streams in fleet. |
| `KIBANA_GET_FLEET_ENROLLMENT_API_KEY` | Get Fleet Enrollment API Key | Tool to retrieve details of a specific enrollment api key by its id. use when you have the id of an enrollment api key and need its details. |
| `KIBANA_GET_FLEET_ENROLLMENT_API_KEYS` | Get Fleet Enrollment API Keys | Tool to fetch a list of enrollment api keys. use when you need to retrieve existing enrollment tokens for kibana fleet. |
| `KIBANA_GET_FLEET_EPM_CATEGORIES` | Get Fleet EPM Categories | Tool to fetch the list of categories in the elastic package manager. use when you need to retrieve available package categories. |
| `KIBANA_GET_FLEET_EPM_DATA_STREAMS` | Get Fleet EPM Data Streams | Tool to retrieve the list of data streams in the elastic package manager. use when you need to get a list of available data streams, optionally filtering by type, dataset, or categorization. |
| `KIBANA_GET_FLEET_EPM_PACKAGE_DETAILS` | Get Fleet EPM Package Details | Tool to fetch details of a specific package and version in the elastic package manager (epm). use when you need to get information about a particular epm package, such as its title, description, or type. |
| `KIBANA_GET_FLEET_EPM_PACKAGE_FILE` | Get Fleet EPM Package File | Tool to retrieve a specific file from a package in the elastic package manager. use when you need to inspect the contents of a package file. |
| `KIBANA_GET_FLEET_EPM_PACKAGES` | Get Fleet EPM Packages | Tool to fetch the list of available packages in the elastic package manager. use when you need to find available integrations or their details. |
| `KIBANA_GET_FLEET_EPM_PACKAGES_INSTALLED` | Get Installed EPM Packages | Tool to retrieve the list of installed packages in the elastic package manager. use this when you need to check which packages are currently installed in fleet. |
| `KIBANA_GET_FLEET_EPM_PACKAGES_LIMITED` | Get Fleet EPM Packages (Limited) | Tool to fetch a limited list of packages from the elastic package manager. use when you need to retrieve a list of available epm packages with minimal details. |
| `KIBANA_GET_FLEET_EPM_PACKAGE_STATS` | Get EPM Package Statistics | Tool to retrieve statistics for a specific package in the elastic package manager. use when you need to get epm package statistics. |
| `KIBANA_GET_FLEET_PACKAGE_POLICIES` | Get Fleet Package Policies | Tool to retrieve a list of all package policies (agent & epm), providing their ids and associated details. use when you need to get an overview of existing package policies. |
| `KIBANA_GET_FLEET_SERVER_HOST` | Get Fleet Server Host | Tool to fetch details of a specific fleet server host by its item id. use when you need to get information about a particular fleet server host. |
| `KIBANA_GET_FLEET_SERVER_HOSTS` | Get Fleet Server Hosts | Tool to retrieve the list of fleet server hosts. use when you need to get information about the available fleet server hosts. |
| `KIBANA_GET_INDEX_MANAGEMENT_INDICES` | Get Index Management Indices | Tool to fetch information about indices managed by kibana's index management feature. it queries the underlying elasticsearch / cat/indices api to retrieve index details. use when you need to list or get details about one or more indices in the cluster. |
| `KIBANA_GET_METRICS` | Get Node Metrics | Tool to retrieve statistics for nodes in an elasticsearch cluster, often visualized in kibana. use when you need to monitor node health, performance, or resource usage. this action calls the elasticsearch nodes stats api. |
| `KIBANA_GET_REPORTING_JOBS` | Get Reporting Jobs | Tool to retrieve a list of reporting jobs in kibana. use when you need to see pending or completed reports. this uses an internal api endpoint, which might be subject to change without notice. |
| `KIBANA_GET_SAVED_OBJECTS` | Get Saved Objects | Tool to retrieve a list of saved objects in kibana based on specified criteria. use when you need to find dashboards, visualizations, index patterns, or other saved entities. |
| `KIBANA_GET_STATUS` | Get Kibana Status | Tool to get the current status of kibana. use when you need to check if kibana is healthy, monitor its state, or get information about the kibana instance including version, uuid, and metrics. |
| `KIBANA_POST_ALERTING_RULES` | Create Alerting Rule | Tool to create a new alerting rule in kibana. use when you need to define a new condition that, when met, triggers an alert and potentially executes predefined actions. |
| `KIBANA_POST_CASES` | Create Case | Tool to create a new case in kibana. use when you need to open and track issues, incidents, or investigations. you can assign users, set severity levels, add tags, and configure external connectors for integration with itsm systems. |
| `KIBANA_POST_CONNECTORS` | Create Kibana Connector | Tool to create a new connector in kibana. use when you need to integrate kibana with an external service. |
| `KIBANA_POST_DASHBOARDS` | Create Dashboard | Tool to create a new dashboard in kibana. use when you need to create a dashboard to visualize data. dashboards can contain visualizations, saved searches, and other embeddable objects. |
| `KIBANA_POST_DATA_VIEWS` | Create Data View | Tool to create a new data view (index pattern) in kibana. use when you need to define which elasticsearch indices to query and analyze in kibana. data views determine which fields are available in discover, visualize, and other kibana apps. |
| `KIBANA_POST_SAVED_OBJECTS` | Create or Update Saved Object | Tool to create or update a saved object in kibana. use when you need to programmatically manage kibana dashboards, visualizations, index patterns, etc. |

## Supported Triggers

None listed.

## Creating MCP Server - Stand-alone vs Composio SDK

The Kibana MCP server provides comprehensive access to Kibana operations through Composio. Once connected, Hermes can perform all major Kibana actions on your behalf using natural language commands.

## Complete Code

None listed.

## Conclusion

### Way Forward
With Kibana connected, Hermes can now act on your behalf whenever it detects a relevant task or you ask it to.
From here, you can extend Hermes further:
- Connect more apps: Calendar, Slack, Notion, Linear, and hundreds of others are available through the same Composio Connect setup. Each new integration compounds what Hermes can do for you.
- Build workflows across tools: Once multiple apps are connected, Hermes can chain actions together — turn an email into a calendar invite, a Slack message into a Linear ticket, or a meeting note into a follow-up draft.
- Let it learn your patterns: The more you use Hermes, the better it gets at anticipating how you'd handle recurring tasks. Give it feedback on drafts and decisions, and it will adapt.
If you run into trouble or want to share what you've built, join the [community](https://discord.com/invite/composio) or check out the [Docs](https://docs.composio.dev?utm_source=toolkits&utm_medium=framework_template&utm_campaign=hermes&utm_content=docs) for deeper configuration options.

## How to build Kibana MCP Agent with another framework

- [OpenAI Agents SDK](https://composio.dev/toolkits/kibana/framework/open-ai-agents-sdk)
- [Claude Agent SDK](https://composio.dev/toolkits/kibana/framework/claude-agents-sdk)
- [Claude Code](https://composio.dev/toolkits/kibana/framework/claude-code)
- [Claude Cowork](https://composio.dev/toolkits/kibana/framework/claude-cowork)
- [Codex](https://composio.dev/toolkits/kibana/framework/codex)
- [OpenClaw](https://composio.dev/toolkits/kibana/framework/openclaw)
- [CLI](https://composio.dev/toolkits/kibana/framework/cli)
- [Google ADK](https://composio.dev/toolkits/kibana/framework/google-adk)
- [LangChain](https://composio.dev/toolkits/kibana/framework/langchain)
- [Vercel AI SDK](https://composio.dev/toolkits/kibana/framework/ai-sdk)
- [Mastra AI](https://composio.dev/toolkits/kibana/framework/mastra-ai)
- [LlamaIndex](https://composio.dev/toolkits/kibana/framework/llama-index)
- [CrewAI](https://composio.dev/toolkits/kibana/framework/crew-ai)

## Related Toolkits

- [Firecrawl](https://composio.dev/toolkits/firecrawl) - Firecrawl automates large-scale web crawling and data extraction. It helps organizations efficiently gather, index, and analyze content from online sources.
- [Tavily](https://composio.dev/toolkits/tavily) - Tavily offers powerful search and data retrieval from documents, databases, and the web. It helps teams locate and filter information instantly, saving hours on research.
- [Exa](https://composio.dev/toolkits/exa) - Exa is a data extraction and search platform for gathering and analyzing information from websites, APIs, or databases. It helps teams quickly surface insights and automate data-driven workflows.
- [Serpapi](https://composio.dev/toolkits/serpapi) - SerpApi is a real-time API for structured search engine results. It lets you automate SERP data collection, parsing, and analysis for SEO and research.
- [Peopledatalabs](https://composio.dev/toolkits/peopledatalabs) - Peopledatalabs delivers B2B data enrichment and identity resolution APIs. Supercharge your apps with accurate, up-to-date business and contact data.
- [Snowflake](https://composio.dev/toolkits/snowflake) - Snowflake is a cloud data warehouse built for elastic scaling, secure data sharing, and fast SQL analytics across major clouds.
- [Posthog](https://composio.dev/toolkits/posthog) - PostHog is an open-source analytics platform for tracking user interactions and product metrics. It helps teams refine features, analyze funnels, and reduce churn with actionable insights.
- [Amplitude](https://composio.dev/toolkits/amplitude) - Amplitude is a digital analytics platform for product and behavioral data insights. It helps teams analyze user journeys and make data-driven decisions quickly.
- [Bright Data MCP](https://composio.dev/toolkits/brightdata_mcp) - Bright Data MCP is an AI-powered web scraping and data collection platform. Instantly access public web data in real time with advanced scraping tools.
- [Browseai](https://composio.dev/toolkits/browseai) - Browseai is a web automation and data extraction platform that turns any website into an API. It's perfect for monitoring websites and retrieving structured data without manual scraping.
- [ClickHouse](https://composio.dev/toolkits/clickhouse) - ClickHouse is an open-source, column-oriented database for real-time analytics and big data processing using SQL. Its lightning-fast query performance makes it ideal for handling large datasets and delivering instant insights.
- [Coinmarketcal](https://composio.dev/toolkits/coinmarketcal) - CoinMarketCal is a community-powered crypto calendar for upcoming events, announcements, and releases. It helps traders track market-moving developments and stay ahead in the crypto space.
- [Control d](https://composio.dev/toolkits/control_d) - Control d is a customizable DNS filtering and traffic redirection platform. It helps you manage internet access, enforce policies, and monitor usage across devices and networks.
- [Databox](https://composio.dev/toolkits/databox) - Databox is a business analytics platform that connects your data from any tool and device. It helps you track KPIs, build dashboards, and discover actionable insights.
- [Databricks](https://composio.dev/toolkits/databricks) - Databricks is a unified analytics platform for big data and AI on the lakehouse architecture. It empowers data teams to collaborate, analyze, and build scalable solutions efficiently.
- [Datagma](https://composio.dev/toolkits/datagma) - Datagma delivers data intelligence and analytics for business growth and market discovery. Get actionable market insights and track competitors to inform your strategy.
- [Delighted](https://composio.dev/toolkits/delighted) - Delighted is a customer feedback platform based on the Net Promoter System®. It helps you quickly gather, track, and act on customer sentiment.
- [Dovetail](https://composio.dev/toolkits/dovetail) - Dovetail is a research analysis platform for transcript review and insight generation. It helps teams code interviews, analyze feedback, and create actionable research summaries.
- [Dub](https://composio.dev/toolkits/dub) - Dub is a short link management platform with analytics and API access. Use it to easily create, manage, and track branded short links for your business.
- [Elasticsearch](https://composio.dev/toolkits/elasticsearch) - Elasticsearch is a distributed, RESTful search and analytics engine for all types of data. It delivers fast, scalable search and powerful analytics across massive datasets.

## Frequently Asked Questions

### What are the differences in Tool Router MCP and Kibana MCP?

With a standalone Kibana MCP server, the agents and LLMs can only access a fixed set of Kibana tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Kibana and many other apps based on the task at hand, all through a single MCP endpoint.

### Can I use Tool Router MCP with Hermes?

Yes, you can. Hermes fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Kibana tools.

### Can I manage the permissions and scopes for Kibana while using Tool Router?

Yes, absolutely. You can configure which Kibana scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

### How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Kibana data and credentials are handled as safely as possible.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)