How to Connect Elasticsearch to Cursor via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Elasticsearch, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Elasticsearch + Cursor

Let your AI explore and query your Elasticsearch cluster on Elastic Cloud, Serverless or your own servers: list indices and data streams, read mappings, search, aggregate, count, run ES|QL and, with your confirmation, write documents.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

ELASTICSEARCH_URL, ELASTICSEARCH_API_KEY

Step 1 — Get credentials

1. Find your Elasticsearch endpoint. Elastic Cloud Hosted: open the deployment at https://cloud.elastic.co and copy the Elasticsearch endpoint, e.g. https://my-deployment.es.europe-west3.gcp.cloud.es.io. Serverless: open the project and copy its Elasticsearch endpoint. Self-managed: the HTTPS address and port your cluster answers on, e.g. https://search.example.com:9200. Paste it into ELASTICSEARCH_URL without a trailing slash. Use the Elasticsearch endpoint, not the Kibana address.
2. Create an API key in Kibana under Stack Management → API keys → Create API key (Serverless: project settings → API keys). Name it, for example anythingmcp, set an expiry and turn on Control security privileges to limit it (see below).
3. Copy the Encoded value (base64): Elastic shows it only once. Paste it into ELASTICSEARCH_API_KEY and install the connector. The id and api_key values on their own do not work, and username and password are not supported.
4. Check the setup with elasticsearch_whoami: it needs no privileges and shows who the key belongs to.

Where your cluster runs: Elastic Cloud Hosted, Elastic Cloud Serverless and self-managed clusters, version 8 or later. AnythingMCP Cloud needs a cluster it can reach over the internet; a self-hosted AnythingMCP can also reach a cluster in your own network once an admin allows that host.

Read-only key (recommended): use these role descriptors in the Kibana form, or run the request in Kibana Dev Tools and copy encoded from the answer:

POST /_security/api_key
{
  "name": "anythingmcp-read",
  "expiration": "365d",
  "role_descriptors": {
    "anythingmcp_read": {
      "cluster": ["monitor"],
      "indices": [
        { "names": ["*"], "privileges": ["read", "view_index_metadata", "monitor"] }
      ]
    }
  }
}

Replace "*" with the index patterns the AI may see, e.g. ["products", "logs-*"]. read covers search, count, aggregations, ES|QL and single documents; view_index_metadata covers mappings, aliases and data streams; monitor covers the index list and cluster health. A key never has more rights than the user who creates it.

What the AI can do: list indices, aliases and data streams; read an index's field mapping before querying it; search with the Query DSL (10 hits by default, at most 100 per call); run aggregations such as counts per value, sums, averages and date histograms; count matches; run ES|QL queries for tabular answers (at most 500 rows); and read single documents. Common vector fields are left out of search results. Cluster health is not available on Serverless, where Elastic runs the cluster.

Writes ask first: elasticsearch_index_document creates or replaces a whole document, and elasticsearch_update_document changes some fields of one. Before each, the AI shows you the index, the _id and the content and waits for your yes. Both need the write privilege, so with the read-only key above they fail with 403, which is the intended safety net.

Switched off at install: elasticsearch_delete_document and elasticsearch_delete_by_query. Deletes cannot be undone, and a delete by query can remove millions of documents. An administrator turns them on deliberately; the AI then counts the matching documents first and asks before deleting.

Common errors: 401: the key is wrong, expired or invalidated, or the id was pasted instead of the Encoded value. 403 security_exception: the key lacks the privilege named in the message. 404 index_not_found_exception: unknown index name. 400 parsing_exception or verification_exception: the query has a mistake; the message names the field or position. 429: the cluster is overloaded; wait and retry.

The connector talks to Elasticsearch only, not to Kibana. It does not create or delete indices, change mappings or settings, or cover snapshots, ingest pipelines, security administration or the bulk API.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Cursor

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Cursor reads MCP servers from ~/.cursor/mcp.json. Add this entry:

{
  "mcpServers": {
    "anythingmcp": {
      "url": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart Cursor.
3. Open Cursor → Settings → MCP and check that anythingmcp is listed and connected.
4. Start chatting: the agent can now call the Elasticsearch tools.

Available tools

Example prompts

• "Which indices do we have, how many documents does each hold and how big are they?"
• "Search the products index for wireless headphones under 100 euros and show name, brand and price."
• "With ES|QL, count the errors per host in logs- over the last 24 hours and show the top 10."*
• "How many orders per day did we get in September? Use a date histogram on the orders index."
• "Set the stock field of product 4711 in the products index to 0. Show me the change before you make it."

FAQ

Does Cursor support custom MCP servers on the free tier? Yes, MCP is available on Hobby, Pro and Business plans.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT