@havesomecode/kibana-mcp-server 1.1.2 → 1.2.1

package/dist/src/state_lock.js

@@ -0,0 +1,370 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, readdir, rename, rm, stat, utimes, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+const DEFAULT_TIMEOUT_MS = 30000;
+const DEFAULT_STALE_MS = 5 * 60 * 1000;
+const DEFAULT_RETRY_MS = 50;
+const DEFAULT_RECLAIM_GRACE_MS = 25;
+const LOCK_DIRECTORY_NAME = ".state.lock";
+export async function acquireStateLock(stateRoot, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+    const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+    const reclaimGraceMs = options.reclaimGraceMs ?? DEFAULT_RECLAIM_GRACE_MS;
+    const releaseGraceMs = options.releaseGraceMs ?? 0;
+    const releaseTimeoutMs = options.releaseTimeoutMs ?? Math.max(1000, reclaimGraceMs * 4);
+    const startedAt = Date.now();
+    const lockPath = join(stateRoot, LOCK_DIRECTORY_NAME);
+    const ownerPath = join(lockPath, "owner.json");
+    const token = randomUUID();
+    const pendingPath = join(stateRoot, `${LOCK_DIRECTORY_NAME}.${token}.pending`);
+    const pendingOwnerPath = join(pendingPath, "owner.json");
+    const owner = {
+        token,
+        pid: process.pid,
+        createdAt: new Date().toISOString(),
+    };
+    await mkdir(stateRoot, { recursive: true });
+    await mkdir(pendingPath);
+    try {
+        await writeFile(pendingOwnerPath, `${JSON.stringify(owner)}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        while (true) {
+            try {
+                await rename(pendingPath, lockPath);
+            }
+            catch (error) {
+                if (!isLockOccupiedError(error))
+                    throw error;
+                if (!(await lockExists(lockPath))) {
+                    if (Date.now() - startedAt >= timeoutMs)
+                        throw error;
+                    await sleep(retryMs);
+                    continue;
+                }
+                if (await tryReclaimStaleLock(lockPath, ownerPath, staleMs, token, reclaimGraceMs)) {
+                    continue;
+                }
+                if (Date.now() - startedAt >= timeoutMs) {
+                    throw new Error(`Timed out waiting for another Kibana MCP setup process to release '${lockPath}'.`);
+                }
+                await sleep(retryMs);
+                continue;
+            }
+            const heartbeatMs = options.heartbeatMs ?? Math.min(30000, Math.max(1000, Math.floor(staleMs / 3)));
+            const heartbeatClaimStaleMs = Math.max(1000, Math.min(staleMs, 30000));
+            let heartbeatInFlight = Promise.resolve();
+            const heartbeat = setInterval(() => {
+                heartbeatInFlight = heartbeatInFlight
+                    .then(() => refreshOwnerHeartbeat(lockPath, ownerPath, token, heartbeatClaimStaleMs))
+                    .catch(() => { });
+            }, heartbeatMs);
+            heartbeat.unref();
+            return async () => {
+                clearInterval(heartbeat);
+                await heartbeatInFlight;
+                // The critical section has already committed or rolled back. Release is best effort;
+                // lease recovery handles any remaining lock without changing that outcome.
+                await releaseOwnedLock(lockPath, ownerPath, token, staleMs, retryMs, reclaimGraceMs, releaseGraceMs, releaseTimeoutMs).catch(() => { });
+            };
+        }
+    }
+    catch (error) {
+        await rm(pendingPath, { recursive: true, force: true }).catch(() => { });
+        throw error;
+    }
+}
+async function refreshOwnerHeartbeat(lockPath, ownerPath, ownerToken, claimStaleMs) {
+    const claimPath = join(lockPath, ".reclaim");
+    const claimToken = `${ownerToken}.heartbeat.${randomUUID()}`;
+    const releaseClaim = await acquireTransitionLease(claimPath, claimToken, claimStaleMs);
+    if (!releaseClaim)
+        return;
+    try {
+        if ((await readOwner(ownerPath))?.token !== ownerToken)
+            return;
+        const now = new Date();
+        await utimes(ownerPath, now, now);
+    }
+    finally {
+        await releaseClaim();
+    }
+}
+async function acquireTransitionLease(claimPath, token, staleMs) {
+    if (!(await acquireReclaimClaim(claimPath, token, staleMs)))
+        return undefined;
+    const claimHandle = await open(claimPath, "r+");
+    const heartbeatMs = Math.max(100, Math.floor(staleMs / 3));
+    const heartbeat = setInterval(() => {
+        const now = new Date();
+        void claimHandle.utimes(now, now).catch(() => { });
+    }, heartbeatMs);
+    heartbeat.unref();
+    return async (removeMarker = true) => {
+        clearInterval(heartbeat);
+        await claimHandle.close().catch(() => { });
+        if (removeMarker && (await claimIsOwned(claimPath, token))) {
+            await rm(claimPath, { force: true }).catch(() => { });
+        }
+    };
+}
+async function releaseOwnedLock(lockPath, ownerPath, token, staleMs, retryMs, reclaimGraceMs, releaseGraceMs, releaseTimeoutMs) {
+    const releasePath = join(lockPath, `.release.${token}`);
+    const releaseDeadline = Date.now() + releaseTimeoutMs;
+    const claimPath = join(lockPath, ".reclaim");
+    const claimStaleMs = Math.max(1000, Math.min(staleMs, 30000), reclaimGraceMs * 4);
+    let releaseClaim;
+    while (!releaseClaim) {
+        releaseClaim = await acquireTransitionLease(claimPath, token, claimStaleMs);
+        if (releaseClaim)
+            break;
+        if (Date.now() >= releaseDeadline)
+            return;
+        await sleep(Math.max(1, Math.min(10, retryMs)));
+    }
+    try {
+        const ownerBeforeRelease = await readOwner(ownerPath);
+        const partialRelease = await readOwner(releasePath);
+        if (ownerBeforeRelease?.token !== token && partialRelease?.token !== token)
+            return;
+        while (true) {
+            try {
+                await rename(ownerPath, releasePath);
+            }
+            catch (error) {
+                if (!isMissingFileError(error))
+                    throw error;
+                const existingReleaseOwner = await readOwner(releasePath);
+                if (existingReleaseOwner?.token === token)
+                    break;
+                if (!(await hasLockTransitionMarker(lockPath)))
+                    return;
+                if (Date.now() >= releaseDeadline)
+                    return;
+                await sleep(Math.max(1, Math.min(10, retryMs)));
+                continue;
+            }
+            break;
+        }
+        const claimedOwner = await readOwner(releasePath);
+        if (claimedOwner?.token !== token) {
+            await rename(releasePath, ownerPath).catch(() => { });
+            return;
+        }
+        if (releaseGraceMs > 0)
+            await sleep(releaseGraceMs);
+        if ((await readOwner(releasePath))?.token !== token)
+            return;
+        if (!(await claimIsOwned(claimPath, token)))
+            return;
+        await releaseClaim(false);
+        await removeLockGeneration(lockPath, token, "released");
+    }
+    finally {
+        await releaseClaim();
+    }
+}
+async function tryReclaimStaleLock(lockPath, ownerPath, staleMs, claimantToken, reclaimGraceMs) {
+    const claimPath = join(lockPath, ".reclaim");
+    const claimStaleMs = Math.max(1000, Math.min(staleMs, 30000), reclaimGraceMs * 4);
+    const observedOwner = await readOwner(ownerPath);
+    const ownerStat = await stat(ownerPath).catch(() => undefined);
+    if (ownerStat) {
+        if (Date.now() - ownerStat.mtimeMs <= staleMs)
+            return false;
+    }
+    else {
+        const claimStat = await stat(claimPath).catch(() => undefined);
+        if (claimStat && Date.now() - claimStat.mtimeMs <= claimStaleMs)
+            return false;
+        const claimedOwnerStat = await newestTransitionOwnerStat(lockPath);
+        if (claimedOwnerStat && Date.now() - claimedOwnerStat.mtimeMs <= staleMs)
+            return false;
+        if (!claimStat && !claimedOwnerStat) {
+            const lockStat = await stat(lockPath).catch(() => undefined);
+            if (!lockStat || Date.now() - lockStat.mtimeMs <= staleMs)
+                return false;
+        }
+    }
+    if (!(await acquireReclaimClaim(claimPath, claimantToken, claimStaleMs)))
+        return false;
+    const claimHandle = await open(claimPath, "r+");
+    const claimHeartbeatMs = Math.max(100, Math.floor(claimStaleMs / 3));
+    const claimHeartbeat = setInterval(() => {
+        const now = new Date();
+        void claimHandle.utimes(now, now).catch(() => { });
+    }, claimHeartbeatMs);
+    claimHeartbeat.unref();
+    try {
+        if (reclaimGraceMs > 0)
+            await sleep(reclaimGraceMs);
+        if (!(await claimIsOwned(claimPath, claimantToken)))
+            return false;
+        const claimedOwnerPath = join(lockPath, `.owner.${claimantToken}`);
+        try {
+            await rename(ownerPath, claimedOwnerPath);
+        }
+        catch (error) {
+            if (isMissingFileError(error)) {
+                if (!(await claimIsOwned(claimPath, claimantToken)) ||
+                    observedOwner ||
+                    (await readOwner(ownerPath))) {
+                    return false;
+                }
+                clearInterval(claimHeartbeat);
+                await claimHandle.close().catch(() => { });
+                await removeLockGeneration(lockPath, claimantToken, "reclaimed");
+                return true;
+            }
+            throw error;
+        }
+        if (reclaimGraceMs > 0)
+            await sleep(reclaimGraceMs);
+        if (!(await claimIsOwned(claimPath, claimantToken))) {
+            await rename(claimedOwnerPath, ownerPath).catch(() => { });
+            return false;
+        }
+        const claimedOwner = await readOwner(claimedOwnerPath);
+        const claimedStat = await stat(claimedOwnerPath).catch(() => undefined);
+        const ownerUnchanged = claimedOwner?.token === observedOwner?.token;
+        const stillStale = Boolean(claimedStat && Date.now() - claimedStat.mtimeMs > staleMs);
+        if (ownerUnchanged && stillStale) {
+            clearInterval(claimHeartbeat);
+            await claimHandle.close().catch(() => { });
+            await removeLockGeneration(lockPath, claimantToken, "reclaimed");
+            return true;
+        }
+        await rename(claimedOwnerPath, ownerPath).catch(() => { });
+        return false;
+    }
+    finally {
+        clearInterval(claimHeartbeat);
+        await claimHandle.close().catch(() => { });
+        if (await claimIsOwned(claimPath, claimantToken)) {
+            await rm(claimPath, { force: true }).catch(() => { });
+        }
+    }
+}
+async function removeLockGeneration(lockPath, token, reason) {
+    const disposalPath = `${lockPath}.${token}.${reason}`;
+    try {
+        await rename(lockPath, disposalPath);
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return;
+        throw error;
+    }
+    await rm(disposalPath, { recursive: true, force: true });
+}
+async function newestTransitionOwnerStat(lockPath) {
+    let names;
+    try {
+        names = (await readdir(lockPath)).filter((name) => name.startsWith(".owner.") || name.startsWith(".release."));
+    }
+    catch {
+        return undefined;
+    }
+    const stats = await Promise.all(names.map(async (name) => await stat(join(lockPath, name)).catch(() => undefined)));
+    return stats.reduce((newest, candidate) => {
+        if (!candidate)
+            return newest;
+        return !newest || candidate.mtimeMs > newest.mtimeMs ? candidate : newest;
+    }, undefined);
+}
+async function acquireReclaimClaim(claimPath, claimantToken, staleMs) {
+    try {
+        await writeFile(claimPath, claimantToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return false;
+        if (!isAlreadyExistsError(error))
+            throw error;
+    }
+    const observedStat = await stat(claimPath).catch(() => undefined);
+    if (!observedStat || Date.now() - observedStat.mtimeMs <= staleMs)
+        return false;
+    const quarantinePath = `${claimPath}.${claimantToken}.stale`;
+    try {
+        await rename(claimPath, quarantinePath);
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return false;
+        throw error;
+    }
+    const claimedStat = await stat(quarantinePath).catch(() => undefined);
+    if (claimedStat && Date.now() - claimedStat.mtimeMs <= staleMs) {
+        await rename(quarantinePath, claimPath).catch(async () => {
+            await rm(quarantinePath, { force: true }).catch(() => { });
+        });
+        return false;
+    }
+    await rm(quarantinePath, { force: true });
+    try {
+        await writeFile(claimPath, claimantToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        if (isAlreadyExistsError(error) || isMissingFileError(error))
+            return false;
+        throw error;
+    }
+}
+async function claimIsOwned(claimPath, claimantToken) {
+    try {
+        return (await readFile(claimPath, "utf8")) === claimantToken;
+    }
+    catch {
+        return false;
+    }
+}
+async function readOwner(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        return typeof parsed.token === "string" ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function hasLockTransitionMarker(lockPath) {
+    try {
+        return (await readdir(lockPath)).some((name) => name === ".reclaim" ||
+            name.startsWith(".reclaim.") ||
+            name.startsWith(".owner.") ||
+            name.startsWith(".release."));
+    }
+    catch {
+        return false;
+    }
+}
+async function lockExists(lockPath) {
+    try {
+        await stat(lockPath);
+        return true;
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return false;
+        throw error;
+    }
+}
+function isLockOccupiedError(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return false;
+    return ["EEXIST", "ENOTEMPTY", "EPERM", "EACCES"].includes(String(error.code));
+}
+function isAlreadyExistsError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "EEXIST");
+}
+function isMissingFileError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+async function sleep(milliseconds) {
+    await new Promise((resolve) => setTimeout(resolve, milliseconds));
+}

package/dist/src/tools/configure_index.js

@@ -0,0 +1,104 @@
+import { readFile } from "node:fs/promises";
+import { z } from "zod";
+import { buildGeneratedSource, chooseGeneratedSourceFields, createGeneratedCatalog, parseGeneratedCatalog, } from "../bootstrap.js";
+import { persistSourceCatalog } from "../config.js";
+import { resolveProfilePaths } from "../profile_paths.js";
+import { acquireStateLock } from "../state_lock.js";
+export const configureIndexInputSchema = z
+    .object({
+    index: z.string().trim().min(1),
+    source_name: z.string().trim().min(1).optional(),
+    source_id: z.string().trim().min(1).optional(),
+    time_field: z.string().trim().min(1).optional(),
+    replace: z.boolean().default(false),
+})
+    .strict();
+export const configureIndexOutputSchema = z.object({
+    configured: z.literal(true),
+    persisted: z.literal(true),
+    source_catalog_path: z.string(),
+    source_count: z.number().int().positive(),
+    source_id: z.string(),
+    index: z.string(),
+    time_field: z.string(),
+});
+export async function executeConfigureIndex(inputValue, options) {
+    const input = configureIndexInputSchema.parse(inputValue);
+    const sourceCatalogPath = options.config.sourceCatalogPath;
+    if (!sourceCatalogPath) {
+        throw new Error("configure_index requires a persisted source catalog. Run connection bootstrap first.");
+    }
+    const stateRoot = options.stateRoot ?? resolveProfilePaths().stateRoot;
+    const releaseLock = await acquireStateLock(stateRoot);
+    try {
+        const existingContent = await readFile(sourceCatalogPath, "utf8");
+        const existingCatalog = parseGeneratedCatalog(existingContent);
+        if (!existingCatalog) {
+            throw new Error("configure_index can update only a managed generated catalog. Refusing to overwrite a hand-authored or modified catalog.");
+        }
+        const proposedSource = buildGeneratedSource([input.index], input.source_name, input.source_id);
+        const existingSource = existingCatalog.sources.find((source) => source.id === proposedSource.id);
+        if (existingSource &&
+            !input.replace &&
+            JSON.stringify(existingSource.backend.index) !== JSON.stringify(proposedSource.backend.index)) {
+            throw new Error(`Source id '${proposedSource.id}' already refers to a different index. Re-run with replace=true only after the user explicitly approves replacement.`);
+        }
+        const discoveredFields = await options.kibanaClient.describeFields(proposedSource, options.callerSignal);
+        if (discoveredFields.length === 0) {
+            throw new Error(`Explicit index pattern '${input.index}' resolved to no fields. Check the index and Kibana permissions.`);
+        }
+        const generatedFields = chooseGeneratedSourceFields(discoveredFields, input.time_field);
+        const verifiedSource = {
+            ...proposedSource,
+            ...generatedFields,
+        };
+        await options.kibanaClient.execute({
+            source: verifiedSource,
+            request: {
+                body: {
+                    size: 1,
+                    track_total_hits: false,
+                    query: { match_all: {} },
+                },
+            },
+            resolvedFilters: [],
+            resolvedNestedFilters: [],
+            resolvedSortBy: verifiedSource.timeField,
+            advisories: [],
+        }, options.callerSignal);
+        const sources = existingSource
+            ? existingCatalog.sources.map((source) => source.id === verifiedSource.id ? verifiedSource : source)
+            : [...existingCatalog.sources, verifiedSource];
+        const generatedCatalog = createGeneratedCatalog(sources);
+        await persistSourceCatalog(sources, {
+            sourceCatalogPath,
+            catalog: generatedCatalog,
+        });
+        return {
+            sources,
+            result: {
+                configured: true,
+                persisted: true,
+                source_catalog_path: sourceCatalogPath,
+                source_count: sources.length,
+                source_id: verifiedSource.id,
+                index: input.index,
+                time_field: verifiedSource.timeField,
+            },
+        };
+    }
+    finally {
+        await releaseLock();
+    }
+}
+export function createConfigureIndexCallToolResult(result) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `Configured source '${result.source_id}' for the explicitly requested index '${result.index}' with time field '${result.time_field}'.`,
+            },
+        ],
+        structuredContent: result,
+    };
+}

package/dist/src/tools/describe_fields.js

@@ -21,9 +21,9 @@ export const describeFieldsOutputSchema = z.object({
         preferred_exact_field: z.string().optional(),
     })),
 });
-export async function executeDescribeFields(input, sourceCatalog, schemaCatalog) {
+export async function executeDescribeFields(input, sourceCatalog, schemaCatalog, callerSignal) {
     const [source] = sourceCatalog.getRequiredSources([input.source_id]);
-    const fields = await schemaCatalog.getFields(source);
+    const fields = await schemaCatalog.getFields(source, callerSignal);
     const filteredFields = schemaCatalog.filterFields(fields, input.query, input.limit);
     return {
         source_id: source.id,

package/dist/src/tools/discover.js

@@ -4,6 +4,7 @@ export const discoverInputSchema = z.object({
     limit: z.number().int().positive().max(100).default(20),
 });
 export const discoverOutputSchema = z.object({
+    configured_total: z.number().int().nonnegative(),
     total: z.number().int().nonnegative(),
     sources: z.array(z.object({
         id: z.string(),
@@ -22,11 +23,15 @@ export const discoverOutputSchema = z.object({
 export function executeDiscover(input, sourceCatalog) {
     const sources = sourceCatalog.list(input.query, input.limit);
     return {
+        configured_total: sourceCatalog.count(),
         total: sources.length,
         sources,
     };
 }
 export function formatDiscoverResult(result) {
+    if (result.configured_total === 0) {
+        return "No log source is configured. Ask the user which Kibana index or index pattern they want to use, then call 'configure_index' with exactly that value.";
+    }
     if (result.sources.length === 0) {
         return "No sources matched the requested discovery query.";
     }

package/dist/src/tools/filter.js

@@ -111,6 +111,7 @@ export async function executeFilter(input, sourceCatalog, kibanaClient, options)
         resolveFieldAliases: false,
         resolvePreferredExactFields: true,
         schemaCatalog: options?.schemaCatalog,
+        callerSignal: options?.callerSignal,
     });
 }
 export function formatFilterResult(result) {

package/dist/src/tools/query.js

@@ -234,9 +234,12 @@ export async function executeQuery(input, sourceCatalog, kibanaClient, options)
     if (schemaCatalog && needsSchemaResolution) {
         for (const source of sources) {
             try {
-                sourceSchemas.set(source.id, await schemaCatalog.getFields(source));
+                sourceSchemas.set(source.id, await schemaCatalog.getFields(source, options?.callerSignal));
             }
             catch (error) {
+                if (options?.callerSignal?.aborted) {
+                    throw error;
+                }
                 sourceSchemaErrors.set(source.id, error instanceof Error ? error.message : String(error));
             }
         }
@@ -246,7 +249,7 @@ export async function executeQuery(input, sourceCatalog, kibanaClient, options)
         ...(sourceSchemas.size > 0 ? { sourceSchemas } : {}),
         ...(sourceSchemaErrors.size > 0 ? { sourceSchemaErrors } : {}),
     });
-    const executions = await kibanaClient.executeMany(plan.sourceQueries);
+    const executions = await kibanaClient.executeMany(plan.sourceQueries, options?.callerSignal);
     return queryOutputSchema.parse(normalizeQueryResponse(plan, executions));
 }
 export function formatQueryResult(result) {

package/docs/project/compatibility-matrix.md

@@ -17,6 +17,7 @@ This matrix distinguishes guaranteed support from best-effort behavior. Each cla
 | `elasticsearch_search` backend | Guaranteed | Verified in tests | Direct Elasticsearch-compatible search path. |
 | Schema metadata endpoints | Best-effort | Known 404s in some deployments | `describe_fields` may fail if endpoints are blocked. |
 | Nested query features | Best-effort | Depends on schema availability | Requires schema metadata for validation. |
-| Public package install | Guaranteed | Published on npm and verified through packlist, release-contract, and release automation checks | Direct machine setup uses `npx -y @havesomecode/kibana-mcp-server`. |
+| Connection-only package bootstrap | Guaranteed | Verified through CLI, rollback, packlist, and release-contract tests | Use `npx -y @havesomecode/kibana-mcp-server bootstrap --client codex`; configure an index only after the user names it. |
+| Agent Skill installation | Guaranteed after publication | Repository discovery is verified with the `skills` CLI; skills.sh indexing follows the public branch | Install `kibana-log-investigation` from `Havesomecode/kibana-mcp-server`. |
 
 Upgrade a row from best-effort to guaranteed only after verifying it in CI or in a reproducible environment test and documenting the evidence here.

package/docs/project/distribution-strategy.md

@@ -9,12 +9,24 @@ updated: 2026-04-09
 ## Goals
 
 - Make the MCP installable by AI agents without manual explanation.
-- Preserve the repo-local Codex plugin workflow as the guaranteed path.
+- Make prompt-free package bootstrap and skills.sh discovery the guaranteed newcomer path.
+- Preserve the repo-local Codex plugin workflow for contributors.
 - Keep the public package path healthy and aligned with the repo-local workflow.
 
 ## Supported Distribution Paths
 
-### 1. Repo-local Codex plugin (guaranteed)
+### 1. Public package plus Agent Skill (guaranteed)
+
+The newcomer path is:
+
+1. Install `kibana-log-investigation` from `Havesomecode/kibana-mcp-server` with the `skills` CLI.
+2. Run the package's prompt-free `bootstrap --client codex` command.
+3. Let bootstrap verify only the Kibana connection, save an empty managed catalog, register through `codex mcp add`, and read the registration back.
+4. In a fresh agent session, ask the user which exact index or pattern to configure before calling `configure_index`.
+
+Bootstrap never lists, scans, infers, or configures indexes. Index validation begins only after the user explicitly supplies one.
+
+### 2. Repo-local Codex plugin
 
 This is the primary, always-supported path:
 
@@ -25,11 +37,11 @@ This is the primary, always-supported path:
 
 This path is required for development and is the baseline for support.
 
-### 2. Public package
+### 3. Public package without the skill
 
 The package is published for agent-friendly execution via:
 
-- `npx -y @havesomecode/kibana-mcp-server`
+- `npx -y @havesomecode/kibana-mcp-server bootstrap --client codex`
 - MCP clients that invoke the published package binary instead of a repo-local build
 
 This path depends on the following remaining true:
@@ -48,6 +60,7 @@ The release artifact must include:
 
 - `dist/` runtime build output
 - plugin metadata and MCP config
+- `skills/kibana-log-investigation/SKILL.md`
 - `README.md`, `LICENSE`
 
 The release artifact must exclude:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@havesomecode/kibana-mcp-server",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "license": "MIT",
   "description": "Read-only MCP server for Kibana-backed log investigation and schema-aware querying",
   "homepage": "https://havesomecode.github.io/kibana-mcp-server/",
@@ -21,6 +21,7 @@
     "dist/**",
     "plugins/kibana-log-investigation/.mcp.json",
     "plugins/kibana-log-investigation/.codex-plugin/plugin.json",
+    "skills/kibana-log-investigation/**",
     "README.md",
     "LICENSE",
     "config/sources.example.json",

package/plugins/kibana-log-investigation/.codex-plugin/plugin.json

@@ -15,15 +15,15 @@
   "interface": {
     "displayName": "Kibana Log Investigation",
     "shortDescription": "Local Kibana log investigation MCP for Codex",
-    "longDescription": "Install the repo-local Kibana investigation MCP for Codex, or use the published package directly. The homepage covers the public install story, while this plugin keeps the local repository workflow first-class.",
+    "longDescription": "Use the repo-local read-only Kibana investigation MCP in Codex. Run connection-only bootstrap to create an empty managed catalog without importing examples, inspecting indexes, or editing client configuration.",
     "developerName": "Havesomecode",
     "category": "Productivity",
-    "capabilities": ["Interactive", "Read", "Write"],
+    "capabilities": ["Interactive", "Read"],
     "websiteURL": "https://havesomecode.github.io/kibana-mcp-server/",
     "privacyPolicyURL": "https://github.com/Havesomecode/kibana-mcp-server",
     "termsOfServiceURL": "https://github.com/Havesomecode/kibana-mcp-server",
     "defaultPrompt": [
-      "Install the Kibana Log Investigation plugin from this repo, bootstrap Node.js if needed, and configure it for my Kibana environment.",
+      "Install the Kibana Log Investigation plugin from this repo, bootstrap Node.js if needed, and run connection-only bootstrap with --client none. Do not inspect indexes. After installation, ask me which exact index or pattern to configure before calling configure_index.",
       "Use the Kibana Log Investigation plugin to inspect log sources and query a time window."
     ],
     "brandColor": "#1F6FEB"