Does the "Serverless" tag mean I can’t use those services on self hosted intances?
I want to connect to the MCP endpoint /api/agent_builder/mcp, but it says the docs have the “tag” Serverless. Does this mean I cannot use it?
Hello and welcome,
The tag Serverless means that this feature is available in the Serverless offering from Elastic, but this also has the tack Stack and the version, which means that it is also available on other deployment types like Elastic Cloud Hosted, ECE, ECK, and Self-managed.
Hey, thanks for fast response. That is good news.
When reading the docs, it is hard to find out where on my instance I can add the service.
The docs mentions the Tools GUI, refering to Tools in Elastic Agent Builder, but I dont understand how to navigate to such meny.
Any suggestions for where to start so I can get a better understanding?
The MCP Server and Agent Builder are Kibana features, they run in Kibana.
This could be more clear, but it is in the endpoint as it mentiones KIBANA_URL.
The Agent Builder is an App in Kibana.
Keep in mind that those features require an Enterprise license, you can test using a trial license for tests.
I am not able to get this working.
Should this be the URL for my cloud-hosted instance?
Do I have to install or enable it first, or should it be reachable from an out of the box installation?
HI @ItsMeBrille
What version are you on.
Use the Kibana Public Endpoint
You need a proper API key somthing like.
POST /_security/api_key
{
"name": "my-mcp-api-key",
"expiration": "30d",
"role_descriptors": {
"mcp-access": {
"indices": [
{
"names": ["*"],
"privileges": ["read", "view_index_metadata"]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": ["feature_agentBuilder.read"],
"resources": ["space:default"]
}
]
}
}
}
Then I tested with curl... 
curl -X POST -H "Authorization: ApiKey $API_KEY" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "kbn-xsrf: true" "https://mycooldeploymentwithmcp.kb.us-west1.gcp.cloud.es.io/api/agent_builder/mcp" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
| jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8918 100 8872 100 46 57906 300 --:--:-- --:--:-- --:--:-- 58287
{
"result": {
"tools": [
{
"name": "platform_core_search",
"description": "A powerful tool for searching and analyzing data within your Elasticsearch cluster.\nIt supports both full-text relevance searches and structured analytical queries.\n\nUse this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.\n\nExamples of queries:\n- \"find articles about serverless architecture\"\n- \"search for support tickets mentioning 'billing issue'
...
Thank you very much. It works now.
However, I noticed something wierd. I cannot access /app/agent_builder/tools without first adding an LLM as a connection. I belive this is a bug, as I want access to the MCP dashboard without using the LLM through Elastic connectors.
I solved it temporarily by adding an LLM, but I wish I didnt have to do it that way.
@ItsMeBrille Exactly what version are you on?
9.3.1
That is a limitation to build tools through UI you can build them through the API and execute the tools via API
DELETE kbn:/api/agent_builder/tools/logs-count
POST kbn:/api/agent_builder/tools
{
"id": "logs-count",
"type": "esql",
"description": "Counts Logs",
"tags": [
"incident",
"timeline",
"observability"
],
"configuration": {
"query": "FROM logs-*-* | STATS count = COUNT(*)",
"params": {}
}
}
POST kbn://api/agent_builder/tools/_execute
{
"tool_id": "logs-count",
"tool_params": {
}
}
result
{
"results": [
{
"type": "query",
"data": {
"esql": "FROM logs-*-* | STATS count = COUNT(*)"
},
"tool_result_id": "oEZytM"
},
{
"tool_result_id": "XFbIlX",
"type": "tabular_data",
"data": {
"source": "esql",
"query": "FROM logs-*-* | STATS count = COUNT(*)",
"columns": [
{
"name": "count",
"type": "long"
}
],
"values": [
[
84456890
]
]
}
}
]
}
okok. I see that some of the mcp tools actually require an LLM, which I think is a wierd way to utilize MCP, but so be it.
Any reason why you limited it in the UI?
Don't know ...
It is not I that limit it .... I think the simple reason is that from within
Kibana / Elastic self contained workflow
Agents Call Tools
Agent need an LLM
Think it is that simple
Agree seems like you should be able to build a tool without an Agent
You CAN via the API which if you have no Agent that will be the only way to Call
So UI vs API ...
I will pass on our you can certainly open a Bug / Feature request against the Kibana Repo.
BTW From Internal
We disable the ui without an llm, to try force you to connect an llm. Doesn’t need to have an llm for tools but there are some tools that require llm (search tool (index_search type) for example)
We probably need a skip button. A workaround is just adding a connector with dummy details to enable