What can AI agents do with Elasticsearch through Ferentin?

Through Ferentin, agents can use Elasticsearch for index search, esql generation, index discovery and custom agent tools. Every call is checked against your Ferentin policies first.

How does Ferentin secure Elasticsearch access?

Requests through the Elasticsearch integration are covered by API key scoped privileges, index level authorization and deployment scoped endpoint. These controls are applied by Ferentin, not by Elasticsearch, so they hold across every connected agent.

How do I connect Elasticsearch to Ferentin?

Open the Ferentin admin console, add Elasticsearch as a new connection and authenticate with API key. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.

Is the Elasticsearch integration generally available?

The Elasticsearch integration is currently beta on Ferentin.

MCP Servers

Elasticsearch

Beta

Search, ES|QL, and index discovery over your Elasticsearch data via Elastic Agent Builder.

MCP ServersElasticsearchElasticSearch

Configure Setup guide

How it works

Every agent request passes through Ferentin policy before it reaches Elasticsearch.

AI agentAsks for something
Ferentin policies
- API key scoped privileges
- Index level authorization
- Deployment scoped endpoint
Elasticsearch MCP serverAuthorized connection
Governed resultMasked, logged, returned

What you can do with Elasticsearch

Index search
Esql generation
Index discovery
Custom agent tools

Overview

Elasticsearch is a distributed search and analytics engine, and the foundation of the Elastic Stack for search, observability, and security workloads. Agent Builder is Elastic's framework for exposing indexed data to AI agents as governed tools.

Website Developer docs

Ferentin integration

Ferentin connects to the Agent Builder MCP endpoint on your own Kibana deployment using an Elasticsearch API key sent with the ApiKey scheme. Because the endpoint is deployment-scoped, the server URL is supplied at install time. Elasticsearch role and index privileges on the key remain the authorization boundary.

Connection details

Status: Beta
Integration type: Remote MCP server
Authentication: API key
Hosting: Vendor-hosted endpoint

Configure Setup guide

Security controls3

API key scoped privileges
Index level authorization
Deployment scoped endpoint

Technical details

Vendor: Elasticsearch

The URL shipped with this card is an EXAMPLE host and will not resolve — installing without overriding the endpoint fails to connect.
The header scheme is 'ApiKey', NOT 'Bearer'. The credential value must include the literal 'ApiKey ' prefix; Ferentin sends the Authorization header verbatim.
Missing feature_agentBuilder.read or feature_actions.read produces HTTP 403 rather than a clear MCP error.
For a non-default Kibana space the path is {KIBANA_URL}/s/{space}/api/agent_builder/mcp.
Elasticsearch role and index privileges attached to the API key are the authorization boundary — scope the key to the indices the agent should reach.
The standalone mcp-server-elasticsearch project is deprecated and receives only critical security fixes; this Agent Builder endpoint supersedes it.

Frequently asked about Elasticsearch

What can AI agents do with Elasticsearch through Ferentin?: Through Ferentin, agents can use Elasticsearch for index search, esql generation, index discovery and custom agent tools. Every call is checked against your Ferentin policies first.
How does Ferentin secure Elasticsearch access?: Requests through the Elasticsearch integration are covered by API key scoped privileges, index level authorization and deployment scoped endpoint. These controls are applied by Ferentin, not by Elasticsearch, so they hold across every connected agent.
How do I connect Elasticsearch to Ferentin?: Open the Ferentin admin console, add Elasticsearch as a new connection and authenticate with API key. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the Elasticsearch integration generally available?: The Elasticsearch integration is currently beta on Ferentin.