Basic auth failed - 401 Unauthorized

[AeaZer]

I deployed the MCP Server using docker and entered the container to confirm that the environment variables ES_USERNAME, ES_PASSWORD, and even ES_lOGIN configuration were all correct. However, it still said that my identity authentication failed. Could you tell me which one has the problem

One questionable point is that I am currently using the ES 7.12.x version

[JoshMock]

One questionable point is that I am currently using the ES 7.12.x version

Elasticsearch 7.x is only supported on a best-effort basis, so thanks for noting this. But, in the case of basic authentication or using the _cat API (which has been pretty stable from 7 onward), it would be a surprise to see that being the issue.

Have you re-pulled the image lately? It's had a lot of changes over the past couple weeks, so I would do a fresh docker pull docker.elastic.co/mcp/elasticsearch:latest to make sure you're running with the latest fixes and changes.

[A12SH2]

My version 7.17.23 ES also reported error 401 Unauthorized when using MCP Server
mcp-server-elasticsearch version 0.4.1

[JoshMock]

Can you try authenticating to your ES server directly with curl to see if it's an issue with MCP or with Elasticsearch?

curl -u 'my-username:my-password' 'https://my-elasticsearch/_cat/indices'

[een-anoopkp]

I am facing the exact same issue with ES-8.2.0.
The curl command works just fine

[JoshMock]

Can you share your docker run command so we can see exactly how you're running it? Please make sure to remove any secrets from whatever you paste.

[rabberbock]

I am using this mcp configuration which results in a 401 error.

"mcpServers": {
    "elasticsearch-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--env-file",
        "/Users/username/.env.mcp",
        "docker.elastic.co/mcp/elasticsearch",
        "stdio"
      ]
    }
  }

/Users/username/.env.mcp

ES_URL=https://host.docker.internal:9200
ES_USERNAME=username
ES_PASSWORD=password
ES_SSL_SKIP_VERIFY=true

[marcmlc]

Facing the same issue on my side while curl works fine. v8.18.2

[NavaneethaKannan]

I am too facing the same 401 unauthorized error in the latest docker image when attempting to call the "get_mappings" tool. Authentication works fine when tried with the curl command. Elastic search version is v8.17.6

[Moscagus]

The underlying problem is in:
https://github.com/elastic/mcp-server-elasticsearch/blob/main/src/servers/elasticsearch/mod.rs#L51
"pub login: Option,"

Does not exist in the structure: username.

Therefore, for it to work well, one possibility could be to change:
https://github.com/elastic/mcp-server-elasticsearch/blob/main/src/lib.rs#L102
to:
"login": "${ES_USERNAME:}",

[jasonnan1]

@Moscagus
issue:
✅ Authentication issue resolved - no more 401 Unauthorized errors
❌ New issue: Insufficient permissions - now appears 403 Forbidden error
HTTP status client error (403 Forbidden) for url (http://10.8.129.3:9200/_cat/indices/mcp*?format=json&h=index%2Cstatus%2Cdocs.count)

Now that my 401 authentication problem has been solved, why is there insufficient permissions: 403 Forbidden error, I am using the 7.X version of elasticsearch, can you help me see what is the problem?

[EstebanAguirrePerf]

I am facing the same issue again, this time with Elastic version v8.13.3.
Now, using the Docker version with the same credentials, I’m getting the error:
HTTP status client error (401 Unauthorized)

• A curl command from my machine using the same credentials works fine, confirming the credentials are correct.
• The same credentials work with both curl and the MCP server via npm/npx.
• The issue occurs with both the latest and 0.4.5 Docker images.
• Environment variables are present and correct inside the container.
• Tried with and without --network host.

My MCP configuration looks like this:
"elasticsearch-mcp-server": {
"command": "docker",
"args": [
"run", "--network", "host", "-i", "--rm",
"-e", "ES_URL", "-e", "ES_USERNAME", "-e", "ES_PASSWORD",
"docker.elastic.co/mcp/elasticsearch:latest",
"stdio"
],
"env": {
"ES_URL": "https://elastic-test.elastic-cloud.com:port",
//"ES_API_KEY": "",
"ES_USERNAME": "user",
"ES_PASSWORD": "pass"
}
}

[ShouryaRSharma]

Is there a priority on when this might be addressed? For those of us using username and password instead of the API KEY, this effectively blocks us from using the MCP server at all.

[Moscagus]

For those using K8s:
"
args:
- http
- '--sse'
- '--config'
- /etc/mcp-server-elasticsearch/config.json
"

For those not using K8s:
"http --sse --config /etc/mcp-server-elasticsearch/config.json"

And the "config.json" file with the following content:
{
"elasticsearch": {
"url": "${ES_URL}",
"api_key": "${ES_API_KEY:}",
"login": "${ES_USERNAME:}",
"password": "${ES_PASSWORD:}",
"ssl_skip_verify": "${ES_SSL_SKIP_VERIFY:false}"
}
}