Skip to content

Elastic Observability MCP App v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Apr 22:09
· 138 commits to main since this release
v1.0.0
987496e

v1.0.0 — Elastic Observability MCP App

Initial stable release of the Elastic Observability MCP App — an MCP App that brings interactive SRE workflows directly into Claude, Cursor, VS Code, and other MCP-compatible AI hosts. Tools return React-based UIs that render inline in the conversation, so investigations happen where the conversation is.

Tools

Six interactive SRE tools, grouped by the Elastic Observability backend they require. A logs-or-metrics-only deployment can use the Universal tools immediately; the prefixed tools (apm-*, k8s-*, ml-*) surface their requirements in both name and description.

watch (Universal) — Blocks the tool call until an ML anomaly fires or an ES|QL metric condition is met. Three modes: ML anomaly watch, live metric polling with accumulating sparkline, and single-shot "now" metric reads. Works on any numeric field in any index.

create-alert-rule (Universal) — Create a persistent Kibana custom-threshold alerting rule against any metric field in any index. Optional KQL scoping, threshold/comparator configuration, and a form UI that lets the user review and edit the rule before it's created.

ml-anomalies (ML) — Query ML anomaly-detection records and open an inline anomaly-explainer view with model_plot time series, influencers, and detail-mode drill-down. Requires ML jobs configured.

apm-health-summary (APM) — Cluster-level health rollup from APM service telemetry; fuzzy namespace matching and pod-name top_entities, with K8s and ML context layered in when available.

apm-service-dependencies (APM) — Service dependency graph showing upstream/downstream services, protocols, and call volume — rendered as an interactive graph view.

k8s-blast-radius (Kubernetes) — Assess the impact of a node going offline: full outage, degraded, unaffected, and reschedule feasibility per workload. APM context is layered in when available.

Every tool emits an investigation_actions list so the UI can surface opinionated next-step prompts — click-to-send follow-ups without forcing the user to guess the right tool name.

Installation

Multiple installation paths, depending on your AI host:

  • Claude Desktop — one-click install via .mcpb package
  • Cursor / VS Code — via npx, local stdio, or HTTP
  • Claude Code — via the claude mcp add CLI
  • Claude.ai — via a cloudflared tunnel

See the installation guides for step-by-step setup per target.

Skills

Six Agent Skills teach Claude when and how to use each tool from natural-language user intent — so users don't need to know tool names or deployment specifics. One skill per tool (apm-health-summary, apm-service-dependencies, create-alert-rule, k8s-blast-radius, ml-anomalies, watch) plus an anomaly-explainer view skill. Install via npx, local clone, or by uploading the individual .zip artifacts in Claude Desktop via Customize → Skills → Create Skill → Upload a skill.

Agent Builder workflow

An Agent Builder workflow ships alongside for clients that prefer Agent Builder workflows over MCP tools:

  • k8s-crashloop-investigation-otel.yaml — automatic CrashLoopBackOff / OOMKilled investigation for clusters on the OTel ingest path (EDOT / kube-stack). Pulls pod context, ML anomalies, upstream health, and recent changes, then synthesizes a root-cause hypothesis.

Requirements

  • Node.js 22+
  • Elasticsearch 8.x or 9.x
  • Kibana 8.x or 9.x (for alerting rules, APM, and ML features)
  • An Elasticsearch API key

Elastic Cloud users: on Elastic Cloud the same API key works for both Elasticsearch and Kibana — KIBANA_URL and KIBANA_API_KEY are optional and fall back to the Elasticsearch key.

Assets 12
Loading