--- title: "Elasticsearch MCP server for AI agents - actionlake" description: "Give Claude 711 Elasticsearch actions through one MCP server: indices, ML, security, core. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/elasticsearch updated: 2026-10-23 --- Connectors · Developer & infrastructure # Elasticsearch MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Elasticsearch and the rest of your systems. It gives your agent 711 Elasticsearch actions (363 reads, 256 writes and 92 that wait for a confirmation) and holds the Elasticsearch credential itself, so the agent never does. It paces Elasticsearch's limits and records every call. [Connect Elasticsearch free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "elasticsearch.cat.nodes", intent: "check which Elasticsearch account is connected" } # Get node information · read · 1 upstream call ``` - 711 actions in one signed file - 363 read look, never change - 256 write create and update - 92 wait for a yes destructive, confirmed first Set up ## Connect Elasticsearch in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Elasticsearch. API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Elasticsearch API key, the base64 `encoded` value (Kibana > Stack Management > API keys > Create API key, or POST… - `host` Where your Elasticsearch lives: your host ``` account { op: "connections.requirements", service: "elasticsearch" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "elasticsearch.cat.nodes" } # get node information · read · 1 upstream call check { action: "elasticsearch.nodes.reload_secure_settings", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Elasticsearch at a glance **Sign-in** API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` **Setup fields** `host` **Limits we pace to** 600 calls a minute, per connection **API covered** Elasticsearch REST API 9.x (elasticsearch-specification main), at your Elasticsearch instance's API base URL, which you enter when connecting **Built from** Elasticsearch's documentation, read 22 October 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/elastic/elasticsearch-specification/main/output/openapi/elasticsearch-openapi.json) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** Not cached: every read goes to the vendor **Shared entities** 2, so ask can line Elasticsearch up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Elasticsearch. 711 actions in 39 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **363** read look, never change - **256** write create and update - **92** destructive wait for a confirmation 1. ### Indices 97 55 read · 32 write · 10 destructive Create an index · Roll over to a new index · Roll over to a new index · Create a data stream 2. ### ML 90 43 read · 32 write · 15 destructive Predict future behavior of a time series · Add scheduled events to the calendar · Send data to an anomaly detection job for analysis · Clear trained model deployment cache 3. ### Security 78 30 read · 34 write · 14 destructive Activate a user profile · Bulk create or update roles · Bulk update API keys · Clone an API key 4. ### Core 61 39 read · 14 write · 8 destructive Create a new document in the index · Create or update a document in an index · Get multiple documents · Get multiple documents 5. ### Inference 49 5 read · 41 write · 3 destructive Perform streaming chat completion inference on the service · Perform completion inference on the service · Perform dense embedding inference on the service · Perform inference on the service 6. ### Cat 45 45 read · 0 write · 0 destructive Get node information · Get node attribute information · Get thread pool statistics · Get thread pool statistics 7. ### Connector 30 4 read · 23 write · 3 destructive Create a connector · Check in a connector · Get a connector · Get all connectors 8. ### Cluster 20 14 read · 4 write · 2 destructive Get the pending cluster tasks · Get component templates · Explain the shard allocations · Get component templates **31 more areas · 241 actions** - Esql **19** - Nodes **18** - Ingest **16** - Snapshot **16** - Watcher **16** - Transform **15** - CCR **14** - Ilm **12** - Search application **11** - Rollup **10** - SLM **10** - Query rules **8** - License **7** - Searchable snapshots **7** - Synonyms **7** - Enrich **6** - SQL **6** - Async search **5** - Eql **4** - Fleet **4** - Logstash **4** - Migration **4** - Tasks **4** - Text structure **4** - Dangling indices **3** - Streams **3** - Features **2** - Simulate **2** - Xpack **2** - Graph **1** - SSL **1** Top actions ## The Elasticsearch API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 68 of Elasticsearch's 68 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `elasticsearch.cat.nodes` Get node information | Get node information | read | `infra.instance.list` 18 connectors | | `elasticsearch.nodes.info` Get node information | Get node information | read | `infra.instance.list` 18 connectors | | `elasticsearch.nodes.reload_secure_settings` Reload the keystore on nodes in the cluster | Reload the keystore on nodes in the cluster | write | `infra.instance.update` 15 connectors | | `elasticsearch.cat.indices` Get index information | Get index information | read | `infra.search_index.list` 5 connectors | | `elasticsearch.cat.snapshots` Get snapshot information | Get snapshot information | read | `infra.snapshot.list` 12 connectors | | `elasticsearch.cat.snapshots_by_repository` Get snapshot information | Get snapshot information | read | `infra.snapshot.list` 12 connectors | | `elasticsearch.cat.indices_by_index` Get index information | Get index information | read | `infra.search_index.list` 5 connectors | | `elasticsearch.core.index_document` Create or update a document in an index | Create or update a document in an index | write | `content.record.create` 15 connectors | | `elasticsearch.core.create_document` Create a new document in the index | Create a new document in the index | write | `content.record.create` 15 connectors | | `elasticsearch.snapshot.delete` Delete snapshots | Delete snapshots | destructive | `infra.snapshot.delete` 9 connectors | | `elasticsearch.cat.tasks` Get task information | Get task information | read | `automation.background_job.list` 34 connectors | | `elasticsearch.tasks.list` Get all tasks | Get all tasks | read | `automation.background_job.list` 34 connectors | Try it ## Prompts to paste into Claude. Each one names the Elasticsearch actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Get node information in Elasticsearch and tell me what stands out. calls `elasticsearch.cat.nodes` 2. Write write Reload the keystore on nodes in the cluster in Elasticsearch. Show me exactly what you will send before you save it. calls `elasticsearch.nodes.reload_secure_settings` Governance for Elasticsearch ## Destructive actions wait for a yes. 92 Elasticsearch actions are destructive. The first 10: - Delete snapshots `elasticsearch.snapshot.delete` - Delete indices `elasticsearch.indices.delete` - Delete documents `elasticsearch.core.delete_by_query` - Delete a document `elasticsearch.core.delete_document` - Delete a dangling index `elasticsearch.dangling_indices.delete_dangling_index` - Clear a scrolling search `elasticsearch.core.clear_scroll` - Delete an alias `elasticsearch.indices.delete_alias` - Delete pipelines `elasticsearch.ingest.delete_pipeline` - Delete a legacy index template `elasticsearch.indices.delete_template` - Delete data streams `elasticsearch.indices.delete_data_stream` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do elasticsearch.snapshot.delete confirm_policy: **human** Delete snapshots? **intent:** the user asked me to delete snapshots run suspended · waiting for a named person · key _elasticsearch-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "elasticsearch-agent", allowed_actions: ["elasticsearch.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "elasticsearch.snapshot.delete", approver: "lead@example.com" }, { match: "elasticsearch.indices.delete", approver: "lead@example.com" }, { match: "elasticsearch.core.delete_by_query", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Elasticsearch only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Elasticsearch costs on actionlake. Every Elasticsearch action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Elasticsearch refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 711 Elasticsearch actions - 711 actions page each page of a long list is one call - 0 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Elasticsearch action. 711 actions by area: the id your agent calls, what it does, and its effect. **Indices 97** - `elasticsearch.indices.create` Create an index write - `elasticsearch.indices.create_data_stream` Create a data stream write - `elasticsearch.indices.rollover` Roll over to a new index write - `elasticsearch.indices.rollover_by_new_index` Roll over to a new index write - `elasticsearch.indices.add_block` Add an index block write - `elasticsearch.indices.analyze` Get tokens from text analysis read - and 91 more in this area **ML 90** - `elasticsearch.ml.clear_trained_model_deployment_cache` Clear trained model deployment cache write - `elasticsearch.ml.forecast` Predict future behavior of a time series write - `elasticsearch.ml.post_calendar_events` Add scheduled events to the calendar write - `elasticsearch.ml.post_data` Send data to an anomaly detection job for analysis write - `elasticsearch.ml.close_job` Close anomaly detection jobs write - `elasticsearch.ml.delete_calendar` Delete a calendar destructive - and 84 more in this area **Security 78** - `elasticsearch.security.activate_user_profile` Activate a user profile write - `elasticsearch.security.bulk_put_role` Bulk create or update roles write - `elasticsearch.security.bulk_update_api_keys` Bulk update API keys write - `elasticsearch.security.clone_api_key` Clone an API key write - `elasticsearch.security.authenticate` Authenticate a user read - `elasticsearch.security.bulk_delete_role` Bulk delete roles destructive - and 72 more in this area **Core 61** - `elasticsearch.core.create_document` Create a new document in the index write - `elasticsearch.core.index_document` Create or update a document in an index write - `elasticsearch.core.index_document_by_id` Create or update a document in an index write - `elasticsearch.core.mget` Get multiple documents read - `elasticsearch.core.mget_by_index` Get multiple documents read - `elasticsearch.core.bulk` Bulk index or delete documents write - and 55 more in this area **Inference 49** - `elasticsearch.inference.chat_completion_unified` Perform streaming chat completion inference on the service write - `elasticsearch.inference.completion` Perform completion inference on the service write - `elasticsearch.inference.embedding` Perform dense embedding inference on the service write - `elasticsearch.inference.inference` Perform inference on the service write - `elasticsearch.inference.inference_by_task_type` Perform inference on the service write - `elasticsearch.inference.delete` Delete an inference endpoint destructive - and 43 more in this area **Cat 45** - `elasticsearch.cat.nodeattrs` Get node attribute information read - `elasticsearch.cat.nodes` Get node information read - `elasticsearch.cat.thread_pool` Get thread pool statistics read - `elasticsearch.cat.thread_pool_by_thread_pool_patterns` Get thread pool statistics read - `elasticsearch.cat.aliases` Get aliases read - `elasticsearch.cat.aliases_by_name` Get aliases read - and 39 more in this area **Connector 30** - `elasticsearch.connector.check_in` Check in a connector write - `elasticsearch.connector.get` Get a connector read - `elasticsearch.connector.list` Get all connectors read - `elasticsearch.connector.post` Create a connector write - `elasticsearch.connector.delete` Delete a connector destructive - `elasticsearch.connector.put` Create or update a connector write - and 24 more in this area **Cluster 20** - `elasticsearch.cluster.allocation_explain` Explain the shard allocations read - `elasticsearch.cluster.get_component_template` Get component templates read - `elasticsearch.cluster.get_component_template_by_name` Get component templates read - `elasticsearch.cluster.pending_tasks` Get the pending cluster tasks read - `elasticsearch.cluster.delete_component_template` Delete component templates destructive - `elasticsearch.cluster.delete_voting_config_exclusions` Clear cluster voting config exclusions destructive - and 14 more in this area **Esql 19** - `elasticsearch.esql.async_query` Run an async ES|QL query write - `elasticsearch.esql.async_query_get` Get async ES|QL query results read - `elasticsearch.esql.get_query` Get a specific running ES|QL query information read - `elasticsearch.esql.query` Run an ES|QL query read - `elasticsearch.esql.async_query_delete` Delete an async ES|QL query destructive - `elasticsearch.esql.async_query_stop` Stop async ES|QL query write - and 13 more in this area **Nodes 18** - `elasticsearch.nodes.info` Get node information read - `elasticsearch.nodes.info_by_metric` Get node information read - `elasticsearch.nodes.info_by_node_id` Get node information read - `elasticsearch.nodes.info_by_node_id_and_metric` Get node information read - `elasticsearch.nodes.clear_repositories_metering_archive` Clear the archived repositories metering destructive - `elasticsearch.nodes.get_repositories_metering_info` Get cluster repositories metering read - and 12 more in this area **Ingest 16** - `elasticsearch.ingest.delete_pipeline` Delete pipelines destructive - `elasticsearch.ingest.get_pipeline` Get pipelines read - `elasticsearch.ingest.get_pipeline_by_id` Get pipelines read - `elasticsearch.ingest.processor_grok` Run a grok processor read - `elasticsearch.ingest.delete_geoip_database` Delete GeoIP database configurations destructive - `elasticsearch.ingest.delete_ip_location_database` Delete IP geolocation database configurations destructive - and 10 more in this area **Snapshot 16** - `elasticsearch.snapshot.create` Create a snapshot write - `elasticsearch.snapshot.get` Get snapshot information read - `elasticsearch.snapshot.status` Get the snapshot status read - `elasticsearch.snapshot.status_by_repository` Get the snapshot status read - `elasticsearch.snapshot.status_by_repository_and_snapshot` Get the snapshot status read - `elasticsearch.snapshot.cleanup_repository` Clean up the snapshot repository write - and 10 more in this area **Watcher 16** - `elasticsearch.watcher.activate_watch` Activate a watch write - `elasticsearch.watcher.execute_watch` Run a watch write - `elasticsearch.watcher.execute_watch_by_id` Run a watch write - `elasticsearch.watcher.query_watches` Query watches read - `elasticsearch.watcher.ack_watch` Acknowledge a watch write - `elasticsearch.watcher.ack_watch_by_action_id` Acknowledge a watch write - and 10 more in this area **Transform 15** - `elasticsearch.transform.get_node_stats` Get node stats read - `elasticsearch.transform.get_transform` Get transforms read - `elasticsearch.transform.get_transform_by_transform_id` Get transforms read - `elasticsearch.transform.get_transform_stats` Get transform stats read - `elasticsearch.transform.delete_transform` Delete a transform destructive - `elasticsearch.transform.preview_transform` Preview a transform read - and 9 more in this area **CCR 14** - `elasticsearch.ccr.follow` Create a follower write - `elasticsearch.ccr.follow_info` Get follower information read - `elasticsearch.ccr.follow_stats` Get follower stats read - `elasticsearch.ccr.get_auto_follow_pattern` Get auto-follow patterns read - `elasticsearch.ccr.get_auto_follow_pattern_by_name` Get auto-follow patterns read - `elasticsearch.ccr.delete_auto_follow_pattern` Delete auto-follow patterns destructive - and 8 more in this area **Ilm 12** - `elasticsearch.ilm.explain_lifecycle` Explain the lifecycle state read - `elasticsearch.ilm.get_lifecycle` Get lifecycle policies read - `elasticsearch.ilm.get_lifecycle_by_policy` Get lifecycle policies read - `elasticsearch.ilm.get_status` Get the ILM status read - `elasticsearch.ilm.delete_lifecycle` Delete a lifecycle policy destructive - `elasticsearch.ilm.migrate_to_data_tiers` Migrate to data tiers routing write - and 6 more in this area **Search application 11** - `elasticsearch.search_application.get` Get search application details read - `elasticsearch.search_application.get_behavioral_analytics` Get behavioral analytics collections read - `elasticsearch.search_application.get_behavioral_analytics_by_name` Get behavioral analytics collections read - `elasticsearch.search_application.post_behavioral_analytics_event` Create a behavioral analytics collection event write - `elasticsearch.search_application.search` Run a search application search read - `elasticsearch.search_application.delete` Delete a search application destructive - and 5 more in this area **Rollup 10** - `elasticsearch.rollup.get_jobs` Get rollup job information read - `elasticsearch.rollup.get_jobs_by_id` Get rollup job information read - `elasticsearch.rollup.get_rollup_caps` Get the rollup job capabilities read - `elasticsearch.rollup.get_rollup_caps_by_id` Get the rollup job capabilities read - `elasticsearch.rollup.rollup_search` Search rolled-up data read - `elasticsearch.rollup.delete_job` Delete a rollup job destructive - and 4 more in this area **SLM 10** - `elasticsearch.slm.execute_lifecycle` Run a policy write - `elasticsearch.slm.execute_retention` Run a retention policy write - `elasticsearch.slm.get_lifecycle` Get policy information read - `elasticsearch.slm.get_lifecycle_by_policy_id` Get policy information read - `elasticsearch.slm.delete_lifecycle` Delete a policy destructive - `elasticsearch.slm.get_stats` Get snapshot lifecycle management statistics read - and 4 more in this area **Query rules 8** - `elasticsearch.query_rules.get_rule` Get a query rule read - `elasticsearch.query_rules.get_ruleset` Get a query ruleset read - `elasticsearch.query_rules.list_rulesets` Get all query rulesets read - `elasticsearch.query_rules.test` Test a query ruleset read - `elasticsearch.query_rules.delete_rule` Delete a query rule destructive - `elasticsearch.query_rules.delete_ruleset` Delete a query ruleset destructive - and 2 more in this area **License 7** - `elasticsearch.license.get` Get license information read - `elasticsearch.license.post` Update the license write - `elasticsearch.license.post_start_basic` Start a basic license write - `elasticsearch.license.post_start_trial` Start a trial write - `elasticsearch.license.delete` Delete the license destructive - `elasticsearch.license.get_basic_status` Get the basic license status read - and 1 more in this area **Searchable snapshots 7** - `elasticsearch.searchable_snapshots.cache_stats` Get cache statistics read - `elasticsearch.searchable_snapshots.cache_stats_by_node_id` Get cache statistics read - `elasticsearch.searchable_snapshots.clear_cache` Clear the cache write - `elasticsearch.searchable_snapshots.clear_cache_by_index` Clear the cache write - `elasticsearch.searchable_snapshots.mount` Mount a snapshot write - `elasticsearch.searchable_snapshots.stats` Get searchable snapshot statistics read - and 1 more in this area **Synonyms 7** - `elasticsearch.synonyms.delete_synonym` Delete a synonym set destructive - `elasticsearch.synonyms.get_synonym` Get a synonym set read - `elasticsearch.synonyms.get_synonym_rule` Get a synonym rule read - `elasticsearch.synonyms.get_synonyms_sets` Get all synonym sets read - `elasticsearch.synonyms.delete_synonym_rule` Delete a synonym rule destructive - `elasticsearch.synonyms.put_synonym` Create or update a synonym set write - and 1 more in this area **Enrich 6** - `elasticsearch.enrich.execute_policy` Run an enrich policy write - `elasticsearch.enrich.get_policy` Get an enrich policy read - `elasticsearch.enrich.get_policy_by_name` Get an enrich policy read - `elasticsearch.enrich.stats` Get enrich stats read - `elasticsearch.enrich.delete_policy` Delete an enrich policy destructive - `elasticsearch.enrich.put_policy` Create an enrich policy write **SQL 6** - `elasticsearch.sql.clear_cursor` Clear an SQL search cursor write - `elasticsearch.sql.get_async` Get async SQL search results read - `elasticsearch.sql.get_async_status` Get the async SQL search status read - `elasticsearch.sql.query` Get SQL search results read - `elasticsearch.sql.delete_async` Delete an async SQL search destructive - `elasticsearch.sql.translate` Translate SQL into Elasticsearch queries read **Async search 5** - `elasticsearch.async_search.get` Get async search results read - `elasticsearch.async_search.status` Get the async search status read - `elasticsearch.async_search.submit` Run an async search write - `elasticsearch.async_search.submit_by_index` Run an async search write - `elasticsearch.async_search.delete` Delete an async search destructive **Eql 4** - `elasticsearch.eql.delete` Delete an async EQL search destructive - `elasticsearch.eql.get` Get async EQL search results read - `elasticsearch.eql.get_status` Get the async EQL status read - `elasticsearch.eql.search` Get EQL search results read **Fleet 4** - `elasticsearch.fleet.global_checkpoints` Get global checkpoints read - `elasticsearch.fleet.msearch` Run multiple Fleet searches read - `elasticsearch.fleet.msearch_by_index` Run multiple Fleet searches read - `elasticsearch.fleet.search` Run a Fleet search read **Logstash 4** - `elasticsearch.logstash.delete_pipeline` Delete a Logstash pipeline destructive - `elasticsearch.logstash.get_pipeline` Get Logstash pipelines read - `elasticsearch.logstash.get_pipeline_by_id` Get Logstash pipelines read - `elasticsearch.logstash.put_pipeline` Create or update a Logstash pipeline write **Migration 4** - `elasticsearch.migration.deprecations` Get deprecation information read - `elasticsearch.migration.deprecations_by_index` Get deprecation information read - `elasticsearch.migration.get_feature_upgrade_status` Get feature migration information read - `elasticsearch.migration.post_feature_upgrade` Start the feature migration write **Tasks 4** - `elasticsearch.tasks.cancel` Cancel a task destructive - `elasticsearch.tasks.cancel_by_task_id` Cancel a task destructive - `elasticsearch.tasks.get` Get task information read - `elasticsearch.tasks.list` Get all tasks read **Text structure 4** - `elasticsearch.text_structure.find_field_structure` Find the structure of a text field read - `elasticsearch.text_structure.find_message_structure` Find the structure of text messages read - `elasticsearch.text_structure.find_structure` Find the structure of a text file read - `elasticsearch.text_structure.test_grok_pattern` Test a Grok pattern read **Dangling indices 3** - `elasticsearch.dangling_indices.delete_dangling_index` Delete a dangling index destructive - `elasticsearch.dangling_indices.import_dangling_index` Import a dangling index write - `elasticsearch.dangling_indices.list_dangling_indices` Get the dangling indices read **Streams 3** - `elasticsearch.streams.logs_disable` Disable a named stream write - `elasticsearch.streams.logs_enable` Enable a named stream write - `elasticsearch.streams.status` Get the status of streams read **Features 2** - `elasticsearch.features.get_features` Get the features read - `elasticsearch.features.reset_features` Reset the features destructive **Simulate 2** - `elasticsearch.simulate.ingest` Simulate data ingestion read - `elasticsearch.simulate.ingest_by_index` Simulate data ingestion read **Xpack 2** - `elasticsearch.xpack.info` Get information read - `elasticsearch.xpack.usage` Get usage information read **Graph 1** - `elasticsearch.graph.explore` Explore graph analytics read **SSL 1** - `elasticsearch.ssl.certificates` Get SSL certificates read This index shows a sample of each area. All 711 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Elasticsearch MCP server, answered. **Is there an Elasticsearch MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 711 Elasticsearch actions across indices, ML, security and core, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Elasticsearch. **What do I need to connect Elasticsearch?** Elasticsearch API key, the base64 `encoded` value (Kibana > Stack Management > API keys > Create API key, or POST…. Plus your host. The free call account { op: "connections.requirements", service: "elasticsearch" } lists exactly what to paste. **Can an AI agent delete or change things in Elasticsearch?** Only if its key allows it, and only with an explicit confirmation. 92 Elasticsearch actions are destructive, including delete snapshots, delete indices and delete documents. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Elasticsearch API limit?** actionlake paces every call to the limits in the Elasticsearch service file: 600 calls a minute per connection. **What does an Elasticsearch action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (711 Elasticsearch actions page). Cache hits, searches, dry runs and calls Elasticsearch refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Elasticsearch API does it cover?** The Elasticsearch REST API 9.x (elasticsearch-specification main) at your Elasticsearch instance's API base URL, which you enter when connecting. It is built from Elasticsearch's documentation as read on 22 October 2026. 711 actions in 39 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Elasticsearch data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Elasticsearch responses are not cached. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Elasticsearch credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Elasticsearch Shares the most action names with - [OpenSearch 68](https://actionlake.com/connectors/opensearch) - [Google Compute Engine 6](https://actionlake.com/connectors/google-compute-engine) - [Zoho Creator 5](https://actionlake.com/connectors/zoho-creator) - [Kintone 5](https://actionlake.com/connectors/kintone) - [SeaTable 5](https://actionlake.com/connectors/seatable) - [SmartSuite 4](https://actionlake.com/connectors/smartsuite) Joins with, on shared entities - [NetBox 1](https://actionlake.com/connectors/netbox) - [DigitalOcean 1](https://actionlake.com/connectors/digitalocean) - [Appwrite Cloud 1](https://actionlake.com/connectors/appwrite-cloud) - [Metabase 1](https://actionlake.com/connectors/metabase) - [Vultr 1](https://actionlake.com/connectors/vultr) - [Tableau 1](https://actionlake.com/connectors/tableau) Browse - [All Developer & infrastructure connectors](https://actionlake.com/connectors/category/developer-and-infrastructure) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Elasticsearch; the name is the vendor's own. Counts are from the Elasticsearch service file, version 1.0.0. ## Give your agent Elasticsearch today. [Connect Elasticsearch free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/elasticsearch More: https://actionlake.com/llms.txt