The Problem

Kibana AI Agents are powerful conversational AI systems, but they're limited to tools built directly into Kibana. They can't access your local filesystem, run system commands, query external APIs, or use the thousands of tools available through the Model Context Protocol ecosystem.

The Solution

The AI agent can request tool executions, and the runner picks up those requests, executes them via MCP servers, and returns the results—all without the agent needing direct access to external systems.

This runner creates a "three-way call" between you, the AI agent, and remote tool runners:

sequenceDiagram
    participant User as 👤 User
    participant Agent as 🤖 Kibana AI Agent
    participant Runner as 🏃 Runner

    User->>Agent: Ask a question
    Agent->>Agent: Needs external tool
    Agent->>Runner: Request tool execution
    Runner->>Runner: Execute via MCP
    Runner->>Agent: Return results
    Agent->>User: Answer with insights

Loading

Secret Channel: The AI Agent and runner communicate through a secret channel where the runner can poll for requests and the AI Agent can store requests!

MCP Tools: Runners have attached MCP servers for their tools so any MCP tool can be used by the AI agent!

See the Architecture Guide for detailed flow diagrams.

Quick Start

Prerequisites

• Python 3.13 or later
• uv for dependency management
• Access to Kibana and Elasticsearch

Installation

# Install uv
pip install uv

# Clone and install
git clone https://github.com/strawgate/project-eagle.git
cd project-eagle
uv sync --all-groups

Configuration

Create a .env file or set environment variables:

KB_URL=https://your-kibana-instance.com
ES_URL=https://your-elasticsearch-instance.com
API_KEY=your-elasticsearch-api-key

Create mcp.json to configure your MCP servers:

{
    "mcpServers": {
        "docker": {
            "command": "uvx",
            "args": [
                "docker-mcp"
            ]
        },
        "time": {
            "command": "uvx",
            "args": ["mcp-server-time"]
        }
    }
}

Run

uv run python -m elastic_agent_builder_runner.main

The runner will:

1. Register itself in Elasticsearch with its hostname
2. Publish available MCP tools to Elasticsearch
3. Poll Elasticsearch for tool call requests
4. Execute tools and store results
5. Store results to Elasticsearch

Example

Here is a very simple example demonstrating how the Agent in Kibana interacts with your infrastructure. You can try this out with the provided mcp.json file if you have Docker running on your host:

Documentation

• Architecture Guide: Detailed technical architecture and implementation details
• Contributing Guide: Development setup and contribution guidelines

Related Projects

• Model Context Protocol - Specification for AI tool integration
• FastMCP - Python MCP framework
• Elastic Agent Builder - Kibana AI Assistant
• MCP Servers - Collection of MCP server implementations