Kibana MCP

🚀 Kibana-MCP Server Documentation

This documentation provides a comprehensive guide on installing dependencies, building, publishing, and setting up a development and testing environment for the Kibana-MCP server.

📦 Installation

Use uv to synchronize dependencies:

uv sync

🚀 Build and Publish

Prepare a Release Version

1. Build the package distribution:

   uv build
   

   This will create source and wheel distributions in the dist/ directory.

2. Publish to PyPI:

   uv publish
   

   Note: You need to configure your PyPI credentials.

💻 Development Environment and Testing

Dependencies

Install development dependencies:

pip install -r requirements-dev.txt

Quick Start Script

Run the quick start script from the project root directory:

./testing/quickstart-test-env.sh

The script (testing/main.py) will perform the following actions:

1. Check for Docker and Docker Compose.
2. Parse the testing/docker-compose.yml configuration.
3. Run docker compose up -d.
4. Wait for the Elasticsearch and Kibana APIs to start.
5. Create a custom user (kibana_system_user) and role for internal Kibana use.
6. Create an index template (mcp_auth_logs_template).
7. Read testing/sample_rule.json (a detection rule) and send a POST request to http://localhost:5601/api/detection_engine/rules to create the rule.
8. Write sample data from testing/auth_events.ndjson to the mcp-auth-logs-default index.
9. Check for detection signals at http://localhost:5601/api/detection_engine/signals/search.
10. Print the status, URL, credentials, and shutdown command.

Stop the Test Environment

• Run the shutdown command printed by the script (e.g., docker compose -f testing/docker-compose.yml down). Use the -v flag (down -v) to remove data volumes.