@havesomecode/kibana-mcp-server 1.1.2 → 1.2.1

package/dist/src/secret_store.js

@@ -36,15 +36,8 @@ class MacOsSecretStore {
         return parseStoredSecret(result.stdout);
     }
     async save(profileId, secret) {
-        await this.execute("add-generic-password", [
-            "-U",
-            "-s",
-            this.serviceName,
-            "-a",
-            profileId,
-            "-w",
-            serializeSecret(secret),
-        ]);
+        const serialized = serializeSecret(secret);
+        await this.execute("add-generic-password", ["-U", "-s", this.serviceName, "-a", profileId, "-w"], `${serialized}\n${serialized}\n`);
     }
     async delete(profileId) {
         try {
@@ -57,9 +50,9 @@ class MacOsSecretStore {
             throw error;
         }
     }
-    async execute(subcommand, args) {
+    async execute(subcommand, args, stdin) {
         try {
-            const result = await this.runner("security", [subcommand, ...args]);
+            const result = await this.runner("security", [subcommand, ...args], { stdin });
             if (result.exitCode === 44) {
                 throw new SecretStoreError(`No saved credentials found for profile '${args.at(-1)}'.`, "NOT_FOUND");
             }
@@ -110,7 +103,10 @@ class LinuxSecretStore {
             const result = await this.runner("secret-tool", [command, ...args], { stdin });
             if (result.exitCode !== 0) {
                 const stderr = result.stderr.trim().toLowerCase();
-                if (stderr.includes("not found")) {
+                const missingWithoutMessage = (command === "lookup" || command === "clear") &&
+                    result.exitCode === 1 &&
+                    stderr.length === 0;
+                if (stderr.includes("not found") || missingWithoutMessage) {
                     throw new SecretStoreError(`No saved credentials found for profile '${args.at(-1) ?? "unknown"}'.`, "NOT_FOUND");
                 }
                 throw new SecretStoreError(result.stderr.trim() || "Secret Service command failed.", "OPERATION_FAILED");
@@ -133,42 +129,45 @@ class WindowsSecretStore {
         const result = await this.execute(`
 [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
 $vault = New-Object Windows.Security.Credentials.PasswordVault
+$payload = ConvertFrom-Json ([Console]::In.ReadToEnd())
 try {
-  $credential = $vault.Retrieve($args[0], $args[1])
+  $credential = $vault.Retrieve($payload.serviceName, $payload.profileId)
   $credential.RetrievePassword()
   [Console]::Out.Write($credential.Password)
   exit 0
 } catch {
   exit 3
 }
-      `, [this.serviceName, profileId]);
+      `, profileId);
         return parseStoredSecret(result.stdout);
     }
     async save(profileId, secret) {
         await this.execute(`
 [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
 $vault = New-Object Windows.Security.Credentials.PasswordVault
+$payload = ConvertFrom-Json ([Console]::In.ReadToEnd())
 try {
-  $existing = $vault.Retrieve($args[0], $args[1])
+  $existing = $vault.Retrieve($payload.serviceName, $payload.profileId)
   $vault.Remove($existing)
 } catch {}
-$credential = New-Object Windows.Security.Credentials.PasswordCredential($args[0], $args[1], $args[2])
+$credential = New-Object Windows.Security.Credentials.PasswordCredential($payload.serviceName, $payload.profileId, $payload.secret)
 $vault.Add($credential)
-      `, [this.serviceName, profileId, serializeSecret(secret)]);
+      `, profileId, secret);
     }
     async delete(profileId) {
         try {
             await this.execute(`
 [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
 $vault = New-Object Windows.Security.Credentials.PasswordVault
+$payload = ConvertFrom-Json ([Console]::In.ReadToEnd())
 try {
-  $credential = $vault.Retrieve($args[0], $args[1])
+  $credential = $vault.Retrieve($payload.serviceName, $payload.profileId)
   $vault.Remove($credential)
   exit 0
 } catch {
   exit 3
 }
-        `, [this.serviceName, profileId]);
+        `, profileId);
         }
         catch (error) {
             if (error instanceof SecretStoreError && error.code === "NOT_FOUND") {
@@ -177,17 +176,16 @@ try {
             throw error;
         }
     }
-    async execute(script, args) {
+    async execute(script, profileId, secret) {
         try {
-            const result = await this.runner("powershell.exe", [
-                "-NoProfile",
-                "-NonInteractive",
-                "-Command",
-                script.trim(),
-                ...args,
-            ]);
+            const stdin = JSON.stringify({
+                serviceName: this.serviceName,
+                profileId,
+                ...(secret ? { secret: serializeSecret(secret) } : {}),
+            });
+            const result = await this.runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script.trim()], { stdin });
             if (result.exitCode === 3) {
-                throw new SecretStoreError(`No saved credentials found for profile '${args[1]}'.`, "NOT_FOUND");
+                throw new SecretStoreError(`No saved credentials found for profile '${profileId}'.`, "NOT_FOUND");
             }
             if (result.exitCode !== 0) {
                 throw new SecretStoreError(result.stderr.trim() || "Windows Credential Manager command failed.", "OPERATION_FAILED");
@@ -237,6 +235,18 @@ async function runCommand(command, args, options = {}) {
         });
         let stdout = "";
         let stderr = "";
+        let settled = false;
+        const finish = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            callback();
+        };
+        const timeout = setTimeout(() => {
+            child.kill("SIGTERM");
+            finish(() => reject(new Error("Credential-store command timed out after 30000ms.")));
+        }, 30000);
         child.stdout.setEncoding("utf8");
         child.stderr.setEncoding("utf8");
         child.stdout.on("data", (chunk) => {
@@ -245,13 +255,14 @@ async function runCommand(command, args, options = {}) {
         child.stderr.on("data", (chunk) => {
             stderr += chunk;
         });
-        child.on("error", reject);
+        child.on("error", (error) => finish(() => reject(error)));
+        child.stdin.on("error", (error) => finish(() => reject(error)));
         child.on("close", (exitCode) => {
-            resolve({
+            finish(() => resolve({
                 stdout,
                 stderr,
                 exitCode: exitCode ?? 1,
-            });
+            }));
         });
         if (options.stdin) {
             child.stdin.write(options.stdin);

package/dist/src/server.js

@@ -1,12 +1,37 @@
 import { McpServer } from "@modelcontextprotocol/server";
-import { KibanaClient } from "./kibana_client.js";
+import { KibanaClient, KibanaRequestError } from "./kibana_client.js";
 import { SchemaCatalog } from "./schema_catalog.js";
 import { SourceCatalog } from "./source_catalog.js";
 import { configureInputSchema, configureOutputSchema, createConfigureCallToolResult, executeConfigure, } from "./tools/configure.js";
+import { configureIndexInputSchema, configureIndexOutputSchema, createConfigureIndexCallToolResult, executeConfigureIndex, } from "./tools/configure_index.js";
 import { createDescribeFieldsCallToolResult, describeFieldsInputSchema, describeFieldsOutputSchema, executeDescribeFields, } from "./tools/describe_fields.js";
 import { createDiscoverCallToolResult, discoverInputSchema, discoverOutputSchema, executeDiscover, } from "./tools/discover.js";
 import { createFilterCallToolResult, executeFilter, filterInputSchema, filterOutputSchema, } from "./tools/filter.js";
 import { createQueryCallToolResult, executeQuery, queryInputSchema, queryOutputSchema, } from "./tools/query.js";
+async function withKibanaRequestDiagnostics(operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        if (!(error instanceof KibanaRequestError)) {
+            throw error;
+        }
+        return {
+            content: [{ type: "text", text: error.message }],
+            isError: true,
+            _meta: {
+                kibana_request_error: {
+                    code: error.code,
+                    phase: error.phase,
+                    source_id: error.sourceId,
+                    timeout_ms: error.timeoutMs,
+                    ...(error.status === undefined ? {} : { status: error.status }),
+                    ...(error.causeCode === undefined ? {} : { cause_code: error.causeCode }),
+                },
+            },
+        };
+    }
+}
 export function createApplication(initialConfig, dependencies) {
     const server = new McpServer({
         name: "kibana-log-investigation",
@@ -20,6 +45,24 @@ export function createApplication(initialConfig, dependencies) {
         ? (dependencies?.kibanaClient ?? kibanaClientFactory(activeConfig.kibana))
         : null;
     let schemaCatalog = kibanaClient ? new SchemaCatalog(kibanaClient) : null;
+    async function withKibanaToolDeadline(callerSignal, operation) {
+        const timeoutMs = activeConfig?.kibana.timeoutMs;
+        if (timeoutMs === undefined) {
+            throw new Error("Server is not configured. Call the 'configure' tool first.");
+        }
+        const timeoutSignal = AbortSignal.timeout(timeoutMs);
+        const signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+        try {
+            return await operation(signal);
+        }
+        catch (error) {
+            if (callerSignal?.aborted || !timeoutSignal.aborted) {
+                throw error;
+            }
+            const requestError = error instanceof KibanaRequestError ? error : undefined;
+            throw new KibanaRequestError("KIBANA_TIMEOUT", requestError?.phase ?? "request", requestError?.sourceId, timeoutMs, `Kibana tool call exceeded its ${timeoutMs} ms backend deadline.`, error, requestError?.status, requestError?.causeCode);
+        }
+    }
     function requireConfigured() {
         if (!sourceCatalog || !kibanaClient || !schemaCatalog) {
             throw new Error("Server is not configured. Call the 'configure' tool first.");
@@ -41,24 +84,52 @@ export function createApplication(initialConfig, dependencies) {
         schemaCatalog = new SchemaCatalog(kibanaClient);
         return result;
     };
-    const describeFieldsHandler = (input) => executeDescribeFields(describeFieldsInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().schemaCatalog);
+    const configureIndexHandler = async (input, callerSignal) => {
+        if (!activeConfig || !kibanaClient) {
+            throw new Error("No saved Kibana connection is available. Run connection bootstrap first.");
+        }
+        const configured = activeConfig;
+        const client = kibanaClient;
+        const configureIndexFn = dependencies?.configureIndexFn ?? executeConfigureIndex;
+        const { sources, result } = await withKibanaToolDeadline(callerSignal, (signal) => configureIndexFn(configureIndexInputSchema.parse(input), {
+            config: configured,
+            kibanaClient: client,
+            callerSignal: signal,
+        }));
+        activeConfig = { ...activeConfig, sources };
+        sourceCatalog = new SourceCatalog(sources);
+        schemaCatalog = new SchemaCatalog(client);
+        return result;
+    };
+    const describeFieldsHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeDescribeFields(describeFieldsInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().schemaCatalog, signal));
     const discoverHandler = (input) => executeDiscover(discoverInputSchema.parse(input), requireConfigured().sourceCatalog);
-    const filterHandler = (input) => executeFilter(filterInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
+    const filterHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeFilter(filterInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
         schemaCatalog: requireConfigured().schemaCatalog,
-    });
-    const queryHandler = (input) => executeQuery(queryInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
+        callerSignal: signal,
+    }));
+    const queryHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeQuery(queryInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
         schemaCatalog: requireConfigured().schemaCatalog,
-    });
-    server.registerTool("configure", {
-        description: "Configure the Kibana connection and logical source catalog for this server session.",
-        inputSchema: configureInputSchema,
-        outputSchema: configureOutputSchema,
-    }, async (input) => createConfigureCallToolResult(await configureHandler(input)));
+        callerSignal: signal,
+    }));
+    if (!initialConfig) {
+        server.registerTool("configure", {
+            description: "Advanced legacy setup for a server started without a saved profile. Replaces the Kibana connection and full source catalog.",
+            inputSchema: configureInputSchema,
+            outputSchema: configureOutputSchema,
+        }, async (input) => createConfigureCallToolResult(await configureHandler(input)));
+    }
+    else {
+        server.registerTool("configure_index", {
+            description: "Configure exactly one Kibana index or index pattern after the user has explicitly named it. Never guess, list, scan, or auto-select indexes before calling this tool.",
+            inputSchema: configureIndexInputSchema,
+            outputSchema: configureIndexOutputSchema,
+        }, async (input, context) => withKibanaRequestDiagnostics(async () => createConfigureIndexCallToolResult(await configureIndexHandler(input, context.mcpReq.signal))));
+    }
     server.registerTool("describe_fields", {
         description: "Describe the effective field capabilities for a configured logical source.",
         inputSchema: describeFieldsInputSchema,
         outputSchema: describeFieldsOutputSchema,
-    }, async (input) => createDescribeFieldsCallToolResult(await describeFieldsHandler(input)));
+    }, async (input, context) => withKibanaRequestDiagnostics(async () => createDescribeFieldsCallToolResult(await describeFieldsHandler(input, context.mcpReq.signal))));
     server.registerTool("discover", {
         description: "List configured logical log sources and field hints for investigation work.",
         inputSchema: discoverInputSchema,
@@ -68,16 +139,17 @@ export function createApplication(initialConfig, dependencies) {
         description: "Run an exact-field filter when the field name is already known, bypassing alias resolution.",
         inputSchema: filterInputSchema,
         outputSchema: filterOutputSchema,
-    }, async (input) => createFilterCallToolResult(await filterHandler(input)));
+    }, async (input, context) => withKibanaRequestDiagnostics(async () => createFilterCallToolResult(await filterHandler(input, context.mcpReq.signal))));
     server.registerTool("query", {
         description: "Query one or more logical log sources over an absolute time window with text, filters, and aggregate modes.",
         inputSchema: queryInputSchema,
         outputSchema: queryOutputSchema,
-    }, async (input) => createQueryCallToolResult(await queryHandler(input)));
+    }, async (input, context) => withKibanaRequestDiagnostics(async () => createQueryCallToolResult(await queryHandler(input, context.mcpReq.signal))));
     return {
         server,
         handlers: {
             configure: configureHandler,
+            configure_index: configureIndexHandler,
             describe_fields: describeFieldsHandler,
             discover: discoverHandler,
             filter: filterHandler,

package/dist/src/setup_flow.js

@@ -5,6 +5,7 @@ import { sourceCatalogSchema } from "./config.js";
 import { resolveProfilePaths } from "./profile_paths.js";
 import { ProfileStore, deriveProfileId } from "./profile_store.js";
 import { SecretStoreError, createSecretStore } from "./secret_store.js";
+import { acquireStateLock } from "./state_lock.js";
 const DEFAULT_TIMEOUT_MS = 10000;
 const KNOWN_ENDPOINT_PATHS = [
     "/internal/search/es",
@@ -24,44 +25,52 @@ export async function runSetupFlow(prompter, dependencies = {}) {
     await prompter.info("Guided setup will save one machine-level Kibana profile and reuse it in later threads.");
     let continueAddingProfiles = true;
     while (continueAddingProfiles) {
-        const existingProfiles = await profileStore.listProfiles();
+        const stateBeforePrompts = await profileStore.load();
+        const existingProfiles = stateBeforePrompts.profiles;
         const profileName = await promptForProfileName(prompter, existingProfiles.map((profile) => profile.name));
-        const existingProfile = existingProfiles.find((profile) => profile.name.toLowerCase() === profileName.toLowerCase());
-        const profileId = existingProfile?.id ??
-            deriveProfileId(profileName, existingProfiles.map((profile) => profile.id));
         const baseUrl = await promptForBaseUrl(prompter);
         const username = await promptForRequiredValue(prompter, "Kibana username");
         const password = await promptForRequiredValue(prompter, "Kibana password", { secret: true });
         const importPath = await promptForSourceCatalogPath(prompter, cwd);
-        const importedCatalogPath = join(paths.sourceCatalogsDir, `${profileId}.json`);
-        await copyValidatedSourceCatalog(importPath, importedCatalogPath, {
-            readFile: readFileImpl,
-            writeFile: writeFileImpl,
-            mkdir: mkdirImpl,
-        });
+        const makeDefault = existingProfiles.length === 0
+            ? true
+            : await prompter.confirm(`Make '${profileName}' the default environment for new threads?`, false);
+        const releaseLock = await acquireStateLock(paths.stateRoot);
+        let profile;
+        let importedCatalogPath;
         try {
-            await secretStore.save(profileId, { username, password });
-        }
-        catch (error) {
-            if (error instanceof SecretStoreError) {
-                throw new Error(`Could not save Kibana credentials securely: ${error.message}`);
+            const currentState = await profileStore.load();
+            if (JSON.stringify(currentState) !== JSON.stringify(stateBeforePrompts)) {
+                throw new Error("Saved Kibana profiles changed while setup was collecting input. Re-run setup to avoid overwriting concurrent changes.");
             }
-            throw error;
-        }
-        const profile = await profileStore.upsertProfile({
-            id: profileId,
-            name: profileName,
-            baseUrl,
-            timeoutMs: DEFAULT_TIMEOUT_MS,
-            sourceCatalogPath: importedCatalogPath,
-        }, {
-            makeDefault: existingProfiles.length === 0,
-        });
-        if (existingProfiles.length > 0) {
-            const makeDefault = await prompter.confirm(`Make '${profile.name}' the default environment for new threads?`, false);
-            if (makeDefault) {
-                await profileStore.setDefaultProfile(profile.id);
+            const existingProfile = currentState.profiles.find((candidate) => candidate.name.toLowerCase() === profileName.toLowerCase());
+            const profileId = existingProfile?.id ??
+                deriveProfileId(profileName, currentState.profiles.map((candidate) => candidate.id));
+            importedCatalogPath = join(paths.sourceCatalogsDir, `${profileId}.json`);
+            await copyValidatedSourceCatalog(importPath, importedCatalogPath, {
+                readFile: readFileImpl,
+                writeFile: writeFileImpl,
+                mkdir: mkdirImpl,
+            });
+            try {
+                await secretStore.save(profileId, { username, password });
+            }
+            catch (error) {
+                if (error instanceof SecretStoreError) {
+                    throw new Error(`Could not save Kibana credentials securely: ${error.message}`);
+                }
+                throw error;
             }
+            profile = await profileStore.upsertProfile({
+                id: profileId,
+                name: profileName,
+                baseUrl,
+                timeoutMs: DEFAULT_TIMEOUT_MS,
+                sourceCatalogPath: importedCatalogPath,
+            }, { makeDefault });
+        }
+        finally {
+            await releaseLock();
         }
         savedProfileNames.push(profile.name);
         savedCatalogPaths.push(importedCatalogPath);
@@ -123,18 +132,21 @@ async function promptForRequiredValue(prompter, label, options = {}) {
     }
 }
 async function promptForSourceCatalogPath(prompter, cwd) {
-    const bundledCatalogPath = await resolveBundledSourceCatalogPath();
     while (true) {
-        const rawValue = (await prompter.prompt("Source catalog path to import", {
-            defaultValue: bundledCatalogPath,
-        })).trim();
-        const importPath = rawValue ? resolve(cwd, rawValue) : bundledCatalogPath;
+        const rawValue = (await prompter.prompt("Source catalog path to import (or type 'example')")).trim();
+        if (!rawValue) {
+            await prompter.info("A source catalog is required. Enter a JSON path or type 'example' explicitly.");
+            continue;
+        }
+        const importPath = rawValue.toLowerCase() === "example"
+            ? await resolveBundledSourceCatalogPath()
+            : resolve(cwd, rawValue);
         try {
             await access(importPath);
             return importPath;
         }
         catch {
-            await prompter.info(`Source catalog not found at ${importPath}. Use a JSON file or accept the bundled example.`);
+            await prompter.info(`Source catalog not found at ${importPath}.`);
         }
     }
 }

package/dist/src/source_catalog.js

@@ -5,6 +5,9 @@ export class SourceCatalog {
         this.sources = sources;
         this.sourceMap = new Map(sources.map((source) => [source.id, source]));
     }
+    count() {
+        return this.sources.length;
+    }
     list(query, limit = 20) {
         const normalizedQuery = query?.trim().toLowerCase();
         const filtered = normalizedQuery