@havesomecode/kibana-mcp-server 1.4.0 → 2.0.0

package/dist/src/server.js

@@ -2,7 +2,6 @@ import { McpServer } from "@modelcontextprotocol/server";
 import { KibanaRequestError } from "./kibana/client.js";
 import { requireProfileRuntime, runWithProfileRuntime } from "./profiles/context.js";
 import { ProfileRuntimeRegistry } from "./profiles/runtime.js";
-import { configureInputSchema, configureOutputSchema, createConfigureCallToolResult, executeConfigure, } from "./tools/configure.js";
 import { configureIndexInputSchema, configureIndexOutputSchema, createConfigureIndexCallToolResult, executeConfigureIndex, } from "./tools/configure_index.js";
 import { createDescribeFieldsCallToolResult, describeFieldsInputSchema, describeFieldsOutputSchema, executeDescribeFields, } from "./tools/describe_fields.js";
 import { createDiscoverCallToolResult, discoverInputSchema, discoverOutputSchema, executeDiscover, } from "./tools/discover.js";
@@ -63,23 +62,7 @@ export function createApplication(initialConfig, dependencies) {
             throw new KibanaRequestError("KIBANA_TIMEOUT", requestError?.phase ?? "request", requestError?.sourceId, timeoutMs, `Kibana tool call exceeded its ${timeoutMs} ms backend deadline.`, error, requestError?.status, requestError?.causeCode);
         }
     }
-    const configureHandler = async (input) => {
-        const current = registry.getDefault()?.config;
-        const { nextConfig, result } = await executeConfigure(configureInputSchema.parse(input), {
-            sourceCatalogPath: current?.sourceCatalogPath,
-        });
-        registry.setDefault({
-            ...nextConfig,
-            sourceCatalogPath: result.source_catalog_path,
-            profileName: current?.profileName,
-            sourceCatalogOrigin: current?.sourceCatalogOrigin,
-        });
-        return result;
-    };
     const configureIndexHandler = async (input, callerSignal) => {
-        if (!registry.isConfigured) {
-            throw new Error("No saved Kibana connection is available. Run connection bootstrap first.");
-        }
         const configureIndexFn = dependencies?.configureIndexFn ?? executeConfigureIndex;
         return withProfile((runtime) => withKibanaToolDeadline(callerSignal, async (signal) => {
             const { sources, result, catalogContent } = await configureIndexFn(configureIndexInputSchema.parse(input), {
@@ -101,20 +84,11 @@ export function createApplication(initialConfig, dependencies) {
         schemaCatalog: runtime.schemaCatalog,
         callerSignal: signal,
     })));
-    if (!registry.isConfigured) {
-        server.registerTool("configure", {
-            description: "Advanced legacy setup for a server started without a saved profile. Replaces the Kibana connection and full source catalog.",
-            inputSchema: configureInputSchema,
-            outputSchema: configureOutputSchema,
-        }, async (input) => createConfigureCallToolResult(await configureHandler(input)));
-    }
-    else {
-        server.registerTool("configure_index", {
-            description: "Configure exactly one Kibana index or index pattern after the user has explicitly named it. Never guess, list, scan, or auto-select indexes before calling this tool.",
-            inputSchema: configureIndexInputSchema,
-            outputSchema: configureIndexOutputSchema,
-        }, async (input, context) => withKibanaRequestDiagnostics(async () => createConfigureIndexCallToolResult(await configureIndexHandler(input, context.mcpReq.signal))));
-    }
+    server.registerTool("configure_index", {
+        description: "Configure exactly one Kibana index or index pattern after the user has explicitly named it. Never guess, list, scan, or auto-select indexes before calling this tool.",
+        inputSchema: configureIndexInputSchema,
+        outputSchema: configureIndexOutputSchema,
+    }, async (input, context) => withKibanaRequestDiagnostics(async () => createConfigureIndexCallToolResult(await configureIndexHandler(input, context.mcpReq.signal))));
     server.registerTool("describe_fields", {
         description: "Describe the effective field capabilities for a configured logical source.",
         inputSchema: describeFieldsInputSchema,
@@ -138,7 +112,6 @@ export function createApplication(initialConfig, dependencies) {
     return {
         server,
         handlers: {
-            configure: configureHandler,
             configure_index: configureIndexHandler,
             describe_fields: describeFieldsHandler,
             discover: discoverHandler,

package/dist/src/setup/bootstrap.d.ts

@@ -45,6 +45,6 @@ export declare function buildGeneratedSource(rawIndexes: string[], sourceName?:
 export declare function chooseGeneratedSourceFields(fields: SourceFieldDescriptor[], explicitTimeField?: string): GeneratedSourceFields;
 export declare function runBootstrap(rawOptions: BootstrapOptions, dependencies?: BootstrapDependencies): Promise<BootstrapResult>;
 export declare function resolveCurrentPackageSpecifier(): Promise<string>;
-export declare function createGeneratedCatalog(sourceOrSources: SourceDefinition | SourceDefinition[]): ReturnType<typeof sourceCatalogSchema.parse>;
+export declare function createGeneratedCatalog(sources: SourceDefinition[]): ReturnType<typeof sourceCatalogSchema.parse>;
 export declare function parseGeneratedCatalog(content: string): ReturnType<typeof sourceCatalogSchema.parse> | undefined;
 export {};

package/dist/src/setup/bootstrap.js

@@ -264,8 +264,7 @@ export async function resolveCurrentPackageSpecifier() {
     }
     throw new Error("Could not resolve the running package version for deterministic registration.");
 }
-export function createGeneratedCatalog(sourceOrSources) {
-    const sources = Array.isArray(sourceOrSources) ? sourceOrSources : [sourceOrSources];
+export function createGeneratedCatalog(sources) {
     const parsedSources = sources.map((source) => sourceDefinitionSchema.parse(source));
     return sourceCatalogSchema.parse({
         generatedBy: {

package/dist/src/tools/configure_index.js

@@ -27,8 +27,7 @@ export async function executeConfigureIndex(inputValue, options) {
     // only happens if the catalog is still the one that was read, so Kibana is never called under a lock.
     const catalog = options.config.catalog ?? fileCatalogOf(options.config, options.stateRoot);
     const existingContent = await catalog.read();
-    // Sources without a catalog at the persisted location were loaded from somewhere else, such as
-    // the static fallback catalog: starting from an empty catalog would silently drop them.
+    // A disappeared catalog must not silently discard sources already loaded into memory.
     if (existingContent === undefined && options.config.sources.length > 0) {
         throw new Error(`Source catalog '${catalog.location}' does not exist although sources are configured. Refusing to replace them with a new managed catalog.`);
     }

package/dist/src/transports/http.js

@@ -41,7 +41,7 @@ async function listen(resolved, startupConfiguration) {
         throw new Error("A profile header requires named profiles: use saved profiles, a store in the configuration file, or the {profile} placeholder in KIBANA_SOURCE_CATALOG_PATH.");
     }
     if (!resolved.profileHeader && !registry.hasDefault) {
-        throw new Error("The HTTP transport needs a profile header, or a default profile named with --profile or KIBANA_PROFILE to serve every caller the same catalog. The legacy 'configure' tool is available over stdio only.");
+        throw new Error("The HTTP transport needs a profile header, or a default profile named with --profile or KIBANA_PROFILE to serve every caller the same catalog.");
     }
     // Modern and handshake-free legacy calls stay per-request.
     const handler = createMcpHandler((context) => {

package/dist/src/transports/stdio.js

@@ -2,8 +2,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { DEFAULT_PROFILE_NAME, loadStartupConfiguration } from "../config/startup.js";
 import { createApplication } from "../server.js";
 export async function startMcpServer(envInput = process.env) {
-    // stdio serves one global configuration: the default profile, or the legacy 'configure' flow.
-    // It has a single caller, so per-profile catalogs fall back to one well-known profile.
+    // stdio has one caller and serves the configured default profile.
     const { startupConfiguration } = await loadStartupConfiguration(envInput);
     let server;
     let closing;

package/dist/src/types.d.ts

@@ -60,7 +60,6 @@ export interface ResolvedAppConfig extends AppConfig {
     /** Set when the catalog of the profile lives in a catalog store rather than at a plain path. */
     catalog?: CatalogHandle;
     sourceCatalogPath?: string;
-    sourceCatalogOrigin?: "environment" | "profile" | "runtime_default" | "static_default";
 }
 export interface SavedProfile {
     id: string;

package/docs/project/compatibility-matrix.md

@@ -15,9 +15,11 @@ This matrix distinguishes guaranteed support from best-effort behavior. Each cla
 | Fully autonomous plugin install by prompting alone across Codex model variants | Best-effort | Field reports show model-dependent behavior | Manual install from the local marketplace is the supported fallback when the agent cannot complete the UI step itself. |
 | `kibana_internal_search_es` backend | Guaranteed | Verified in tests | Primary search transport. |
 | `elasticsearch_search` backend | Guaranteed | Verified in tests | Direct Elasticsearch-compatible search path. |
-| Schema metadata endpoints | Best-effort | Known 404s in some deployments | `describe_fields` may fail if endpoints are blocked. |
+| Schema metadata endpoints | Best-effort | Known 404s in some deployments | The server can sample fields through the configured search backend on `404`; this fallback is heuristic and `describe_fields` can still fail. |
 | Nested query features | Best-effort | Depends on schema availability | Requires schema metadata for validation. |
 | Connection-only package bootstrap | Guaranteed | Verified through CLI, rollback, packlist, and release-contract tests | Use `npx -y @havesomecode/kibana-mcp-server bootstrap --client codex`; configure an index only after the user names it. |
 | Agent Skill installation | Guaranteed after publication | Repository discovery is verified with the `skills` CLI; skills.sh indexing follows the public branch | Install `kibana-log-investigation` from `Havesomecode/kibana-mcp-server`. |
 
+Saved profiles carry an explicit catalog path. Direct connection startup requires `KIBANA_SOURCE_CATALOG_PATH` or a configuration-file catalog store; no checkout catalog is loaded implicitly. Without a saved connection, startup fails with `No saved Kibana connection is available. Run connection bootstrap first.` Guided `setup` remains supported for hand-authored catalogs.
+
 Upgrade a row from best-effort to guaranteed only after verifying it in CI or in a reproducible environment test and documenting the evidence here.

package/docs/project/distribution-strategy.md

@@ -66,7 +66,7 @@ The release artifact must include:
 The release artifact must exclude:
 
 - tests and fixtures
-- local operator config (`config/sources.json`, `config/sources.runtime.json`)
+- local operator catalogs and saved machine profiles
 - development-only scripts and tooling that do not affect runtime execution
 
 ## Versioning

package/docs/project/release-checklist.md

@@ -10,8 +10,11 @@ updated: 2026-04-09
 
 - CI is green on `master`.
 - `npm run verify` passes locally.
+- Build output must correspond to current source: `npm run build` replaces root `dist/`, and every packed `dist/src/**/*.js` or `dist/src/**/*.d.ts` must have its corresponding `src/**/*.ts` file. `npm run verify:packlist` rejects orphaned outputs from removed modules.
 - The compatibility matrix is up to date (`docs/project/compatibility-matrix.md`).
 - Any new env or config requirements are documented in `README.md` and `INSTALL.md`.
+- Startup requires a connection and an explicit catalog path or store; saved profiles use their stored path. Docs must not advertise a credential-taking MCP setup tool or implicit checkout catalog.
+- Connection-only bootstrap remains the default install flow; guided setup remains supported for explicitly selected hand-authored catalogs.
 - The hosted homepage still matches the supported install paths and support posture.
 - The npm scope and package name (`@havesomecode/kibana-mcp-server`) are owned by the maintainers.
 - Maintainers understand that released versions are tracked in npm, tags, and GitHub Releases, not by the `package.json` version committed in git.

package/docs/project/support-policy.md

@@ -1,7 +1,7 @@
 ---
 title: Support Policy
 status: active
-updated: 2026-04-09
+updated: 2026-10-14
 ---
 
 # Support Policy
@@ -15,8 +15,14 @@ This MCP is designed for operators and AI agents that need read-only access to K
 - Node.js 22+ runtime
 - Repo-local Codex plugin install
 - `kibana_internal_search_es` and `elasticsearch_search` backends
-- Guided machine setup with saved profiles and imported source catalogs
-- Runtime configuration via `configure` plus persisted non-secret source catalogs
+- Connection-only bootstrap with saved profiles and platform credentials
+- Guided machine setup for explicitly selected hand-authored source catalogs
+- Startup with a saved profile, or a complete explicit connection plus `KIBANA_SOURCE_CATALOG_PATH` or a configuration-file catalog store
+- Explicit user-approved source configuration through `configure_index`; no MCP tool accepts connection credentials
+
+## Connection Setup Boundary
+
+Connection setup is an operator step, not an MCP capability. The credential-taking `configure` tool and unconfigured startup are intentionally retired in favor of `bootstrap` plus `configure_index`. Direct environment startup must select a catalog path or store explicitly; the server no longer searches the working directory for one. This does not change the catalog JSON schema or delete existing catalog or profile files.
 
 ## Best-Effort Support
 
@@ -27,14 +33,16 @@ This MCP is designed for operators and AI agents that need read-only access to K
 
 Best-effort means we will investigate issues but cannot guarantee behavior across all deployments.
 
+Startup without a saved connection fails with `No saved Kibana connection is available. Run connection bootstrap first.` Run connection-only bootstrap before reconnecting the MCP client. For saved-profile use, leave direct connection variables unset in the server environment.
+
 ## Known Environment Constraints
 
 - Some Codex model variants are less reliable at completing repo-local plugin installation without a manual Codex UI step. The supported fallback is to install the plugin manually from the local marketplace, then continue with MCP configuration.
-- Some Kibana deployments proxy or block schema metadata endpoints. In those cases, schema-aware features may be unavailable.
+- Some Kibana deployments proxy or block schema metadata endpoints. When all known Kibana data-view or index-pattern metadata endpoints return `404`, the server can sample fields through the configured search backend. Direct Elasticsearch field-capability errors do not use this fallback. Sampling is heuristic, not authoritative; schema-dependent features can still be unavailable.
 - `KIBANA_BASE_URL` must be the Kibana base prefix, not a full search endpoint such as `/internal/search/es`.
 - Linux secure storage depends on a Secret Service-compatible keyring being available and unlocked.
-- If you run staging and production side by side, prefer saved machine profiles plus `KIBANA_PROFILE` selection. If you stay on env bootstrap, keep `KIBANA_SOURCE_CATALOG_PATH` distinct per entry so runtime-persisted sources do not overwrite each other.
-- Credentials are not persisted to repo-local files or tracked config. Guided setup stores them in the platform credential store.
+- If you run staging and production side by side, prefer saved machine profiles plus `KIBANA_PROFILE` selection. For direct environment startup, name `KIBANA_SOURCE_CATALOG_PATH` explicitly and keep it distinct per entry so managed sources from different environments do not mix.
+- Credentials are not persisted to repo-local files or tracked config. Bootstrap and guided setup store them in the platform credential store.
 
 ## Security Reporting
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@havesomecode/kibana-mcp-server",
-  "version": "1.4.0",
+  "version": "2.0.0",
   "license": "MIT",
   "description": "Read-only MCP server for Kibana-backed log investigation and schema-aware querying",
   "homepage": "https://havesomecode.github.io/kibana-mcp-server/",
@@ -49,6 +49,9 @@
     "dist/**",
     "plugins/kibana-log-investigation/.mcp.json",
     "plugins/kibana-log-investigation/.codex-plugin/plugin.json",
+    "plugins/kibana-log-investigation/mcp-launcher.mjs",
+    "plugins/kibana-log-investigation/dist/**",
+    "plugins/kibana-log-investigation/skills/**",
     "skills/kibana-log-investigation/**",
     "README.md",
     "LICENSE",
@@ -59,7 +62,7 @@
     "node": ">=22.0.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node scripts/build-plugin.mjs",
     "check:types": "tsc --noEmit -p tsconfig.json",
     "lint": "biome lint .",
     "format": "biome format . --write",
@@ -111,6 +114,7 @@
     "@commitlint/cli": "^20.1.0",
     "@commitlint/config-conventional": "^20.0.0",
     "@types/node": "^25.5.2",
+    "esbuild": "^0.28.2",
     "ioredis": "^6.0.0",
     "mongodb": "^7.6.0",
     "pg": "^8.23.0",

package/plugins/kibana-log-investigation/.mcp.json

@@ -3,8 +3,9 @@
     "kibana-log-investigation": {
       "type": "stdio",
       "command": "node",
-      "args": ["./dist/src/mcp_entry.js"],
-      "note": "Local stdio MCP server for this repo. Requires Node.js 22+ and a built dist/ directory. If dependencies or dist are missing, run npm install and npm run build from the repository root first."
+      "args": ["./mcp-launcher.mjs"],
+      "cwd": ".",
+      "note": "Requires Node.js 22+. The built plugin includes its runtime dependencies. Build the checkout before installing the plugin. If runtime files are missing, rebuild and reinstall; opening new discussions does not repair startup failures."
     }
   }
 }

package/plugins/kibana-log-investigation/dist/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zacaria
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.