@havesomecode/kibana-mcp-server 1.4.1 → 2.0.0

package/dist/src/setup/bootstrap.d.ts

@@ -45,6 +45,6 @@ export declare function buildGeneratedSource(rawIndexes: string[], sourceName?:
 export declare function chooseGeneratedSourceFields(fields: SourceFieldDescriptor[], explicitTimeField?: string): GeneratedSourceFields;
 export declare function runBootstrap(rawOptions: BootstrapOptions, dependencies?: BootstrapDependencies): Promise<BootstrapResult>;
 export declare function resolveCurrentPackageSpecifier(): Promise<string>;
-export declare function createGeneratedCatalog(sourceOrSources: SourceDefinition | SourceDefinition[]): ReturnType<typeof sourceCatalogSchema.parse>;
+export declare function createGeneratedCatalog(sources: SourceDefinition[]): ReturnType<typeof sourceCatalogSchema.parse>;
 export declare function parseGeneratedCatalog(content: string): ReturnType<typeof sourceCatalogSchema.parse> | undefined;
 export {};

package/dist/src/setup/bootstrap.js

@@ -264,8 +264,7 @@ export async function resolveCurrentPackageSpecifier() {
     }
     throw new Error("Could not resolve the running package version for deterministic registration.");
 }
-export function createGeneratedCatalog(sourceOrSources) {
-    const sources = Array.isArray(sourceOrSources) ? sourceOrSources : [sourceOrSources];
+export function createGeneratedCatalog(sources) {
     const parsedSources = sources.map((source) => sourceDefinitionSchema.parse(source));
     return sourceCatalogSchema.parse({
         generatedBy: {

package/dist/src/tools/configure_index.js

@@ -27,8 +27,7 @@ export async function executeConfigureIndex(inputValue, options) {
     // only happens if the catalog is still the one that was read, so Kibana is never called under a lock.
     const catalog = options.config.catalog ?? fileCatalogOf(options.config, options.stateRoot);
     const existingContent = await catalog.read();
-    // Sources without a catalog at the persisted location were loaded from somewhere else, such as
-    // the static fallback catalog: starting from an empty catalog would silently drop them.
+    // A disappeared catalog must not silently discard sources already loaded into memory.
     if (existingContent === undefined && options.config.sources.length > 0) {
         throw new Error(`Source catalog '${catalog.location}' does not exist although sources are configured. Refusing to replace them with a new managed catalog.`);
     }

package/dist/src/transports/http.js

@@ -41,7 +41,7 @@ async function listen(resolved, startupConfiguration) {
         throw new Error("A profile header requires named profiles: use saved profiles, a store in the configuration file, or the {profile} placeholder in KIBANA_SOURCE_CATALOG_PATH.");
     }
     if (!resolved.profileHeader && !registry.hasDefault) {
-        throw new Error("The HTTP transport needs a profile header, or a default profile named with --profile or KIBANA_PROFILE to serve every caller the same catalog. The legacy 'configure' tool is available over stdio only.");
+        throw new Error("The HTTP transport needs a profile header, or a default profile named with --profile or KIBANA_PROFILE to serve every caller the same catalog.");
     }
     // Modern and handshake-free legacy calls stay per-request.
     const handler = createMcpHandler((context) => {

package/dist/src/transports/stdio.js

@@ -2,8 +2,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { DEFAULT_PROFILE_NAME, loadStartupConfiguration } from "../config/startup.js";
 import { createApplication } from "../server.js";
 export async function startMcpServer(envInput = process.env) {
-    // stdio serves one global configuration: the default profile, or the legacy 'configure' flow.
-    // It has a single caller, so per-profile catalogs fall back to one well-known profile.
+    // stdio has one caller and serves the configured default profile.
     const { startupConfiguration } = await loadStartupConfiguration(envInput);
     let server;
     let closing;

package/dist/src/types.d.ts

@@ -60,7 +60,6 @@ export interface ResolvedAppConfig extends AppConfig {
     /** Set when the catalog of the profile lives in a catalog store rather than at a plain path. */
     catalog?: CatalogHandle;
     sourceCatalogPath?: string;
-    sourceCatalogOrigin?: "environment" | "profile" | "runtime_default" | "static_default";
 }
 export interface SavedProfile {
     id: string;

package/docs/project/compatibility-matrix.md

@@ -15,9 +15,11 @@ This matrix distinguishes guaranteed support from best-effort behavior. Each cla
 | Fully autonomous plugin install by prompting alone across Codex model variants | Best-effort | Field reports show model-dependent behavior | Manual install from the local marketplace is the supported fallback when the agent cannot complete the UI step itself. |
 | `kibana_internal_search_es` backend | Guaranteed | Verified in tests | Primary search transport. |
 | `elasticsearch_search` backend | Guaranteed | Verified in tests | Direct Elasticsearch-compatible search path. |
-| Schema metadata endpoints | Best-effort | Known 404s in some deployments | `describe_fields` may fail if endpoints are blocked. |
+| Schema metadata endpoints | Best-effort | Known 404s in some deployments | The server can sample fields through the configured search backend on `404`; this fallback is heuristic and `describe_fields` can still fail. |
 | Nested query features | Best-effort | Depends on schema availability | Requires schema metadata for validation. |
 | Connection-only package bootstrap | Guaranteed | Verified through CLI, rollback, packlist, and release-contract tests | Use `npx -y @havesomecode/kibana-mcp-server bootstrap --client codex`; configure an index only after the user names it. |
 | Agent Skill installation | Guaranteed after publication | Repository discovery is verified with the `skills` CLI; skills.sh indexing follows the public branch | Install `kibana-log-investigation` from `Havesomecode/kibana-mcp-server`. |
 
+Saved profiles carry an explicit catalog path. Direct connection startup requires `KIBANA_SOURCE_CATALOG_PATH` or a configuration-file catalog store; no checkout catalog is loaded implicitly. Without a saved connection, startup fails with `No saved Kibana connection is available. Run connection bootstrap first.` Guided `setup` remains supported for hand-authored catalogs.
+
 Upgrade a row from best-effort to guaranteed only after verifying it in CI or in a reproducible environment test and documenting the evidence here.

package/docs/project/distribution-strategy.md

@@ -66,7 +66,7 @@ The release artifact must include:
 The release artifact must exclude:
 
 - tests and fixtures
-- local operator config (`config/sources.json`, `config/sources.runtime.json`)
+- local operator catalogs and saved machine profiles
 - development-only scripts and tooling that do not affect runtime execution
 
 ## Versioning

package/docs/project/release-checklist.md

@@ -10,8 +10,11 @@ updated: 2026-04-09
 
 - CI is green on `master`.
 - `npm run verify` passes locally.
+- Build output must correspond to current source: `npm run build` replaces root `dist/`, and every packed `dist/src/**/*.js` or `dist/src/**/*.d.ts` must have its corresponding `src/**/*.ts` file. `npm run verify:packlist` rejects orphaned outputs from removed modules.
 - The compatibility matrix is up to date (`docs/project/compatibility-matrix.md`).
 - Any new env or config requirements are documented in `README.md` and `INSTALL.md`.
+- Startup requires a connection and an explicit catalog path or store; saved profiles use their stored path. Docs must not advertise a credential-taking MCP setup tool or implicit checkout catalog.
+- Connection-only bootstrap remains the default install flow; guided setup remains supported for explicitly selected hand-authored catalogs.
 - The hosted homepage still matches the supported install paths and support posture.
 - The npm scope and package name (`@havesomecode/kibana-mcp-server`) are owned by the maintainers.
 - Maintainers understand that released versions are tracked in npm, tags, and GitHub Releases, not by the `package.json` version committed in git.

package/docs/project/support-policy.md

@@ -1,7 +1,7 @@
 ---
 title: Support Policy
 status: active
-updated: 2026-04-09
+updated: 2026-10-14
 ---
 
 # Support Policy
@@ -15,8 +15,14 @@ This MCP is designed for operators and AI agents that need read-only access to K
 - Node.js 22+ runtime
 - Repo-local Codex plugin install
 - `kibana_internal_search_es` and `elasticsearch_search` backends
-- Guided machine setup with saved profiles and imported source catalogs
-- Runtime configuration via `configure` plus persisted non-secret source catalogs
+- Connection-only bootstrap with saved profiles and platform credentials
+- Guided machine setup for explicitly selected hand-authored source catalogs
+- Startup with a saved profile, or a complete explicit connection plus `KIBANA_SOURCE_CATALOG_PATH` or a configuration-file catalog store
+- Explicit user-approved source configuration through `configure_index`; no MCP tool accepts connection credentials
+
+## Connection Setup Boundary
+
+Connection setup is an operator step, not an MCP capability. The credential-taking `configure` tool and unconfigured startup are intentionally retired in favor of `bootstrap` plus `configure_index`. Direct environment startup must select a catalog path or store explicitly; the server no longer searches the working directory for one. This does not change the catalog JSON schema or delete existing catalog or profile files.
 
 ## Best-Effort Support
 
@@ -27,14 +33,16 @@ This MCP is designed for operators and AI agents that need read-only access to K
 
 Best-effort means we will investigate issues but cannot guarantee behavior across all deployments.
 
+Startup without a saved connection fails with `No saved Kibana connection is available. Run connection bootstrap first.` Run connection-only bootstrap before reconnecting the MCP client. For saved-profile use, leave direct connection variables unset in the server environment.
+
 ## Known Environment Constraints
 
 - Some Codex model variants are less reliable at completing repo-local plugin installation without a manual Codex UI step. The supported fallback is to install the plugin manually from the local marketplace, then continue with MCP configuration.
-- Some Kibana deployments proxy or block schema metadata endpoints. In those cases, schema-aware features may be unavailable.
+- Some Kibana deployments proxy or block schema metadata endpoints. When all known Kibana data-view or index-pattern metadata endpoints return `404`, the server can sample fields through the configured search backend. Direct Elasticsearch field-capability errors do not use this fallback. Sampling is heuristic, not authoritative; schema-dependent features can still be unavailable.
 - `KIBANA_BASE_URL` must be the Kibana base prefix, not a full search endpoint such as `/internal/search/es`.
 - Linux secure storage depends on a Secret Service-compatible keyring being available and unlocked.
-- If you run staging and production side by side, prefer saved machine profiles plus `KIBANA_PROFILE` selection. If you stay on env bootstrap, keep `KIBANA_SOURCE_CATALOG_PATH` distinct per entry so runtime-persisted sources do not overwrite each other.
-- Credentials are not persisted to repo-local files or tracked config. Guided setup stores them in the platform credential store.
+- If you run staging and production side by side, prefer saved machine profiles plus `KIBANA_PROFILE` selection. For direct environment startup, name `KIBANA_SOURCE_CATALOG_PATH` explicitly and keep it distinct per entry so managed sources from different environments do not mix.
+- Credentials are not persisted to repo-local files or tracked config. Bootstrap and guided setup store them in the platform credential store.
 
 ## Security Reporting
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@havesomecode/kibana-mcp-server",
-  "version": "1.4.1",
+  "version": "2.0.0",
   "license": "MIT",
   "description": "Read-only MCP server for Kibana-backed log investigation and schema-aware querying",
   "homepage": "https://havesomecode.github.io/kibana-mcp-server/",
@@ -62,7 +62,7 @@
     "node": ">=22.0.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/build-plugin.mjs",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node scripts/build-plugin.mjs",
     "check:types": "tsc --noEmit -p tsconfig.json",
     "lint": "biome lint .",
     "format": "biome format . --write",

package/plugins/kibana-log-investigation/dist/mcp_entry.mjs

@@ -28758,16 +28758,8 @@ function isMissingFileError3(error48) {
 }
 
 // src/config/environment.ts
-var DEFAULT_RUNTIME_SOURCE_CATALOG_PATH = "config/sources.runtime.json";
-var DEFAULT_STATIC_SOURCE_CATALOG_PATH = "config/sources.json";
 var PROFILE_NAME_ENV = "KIBANA_PROFILE";
 var PROFILE_PLACEHOLDER = "{profile}";
-var NoSavedProfileError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "NoSavedProfileError";
-  }
-};
 var bootstrapEnvSchema = external_exports.object({
   KIBANA_BASE_URL: external_exports.url(),
   KIBANA_USERNAME: external_exports.string().min(1),
@@ -28858,28 +28850,19 @@ function buildKibanaConfig(env) {
     timeoutMs: env.KIBANA_TIMEOUT_MS ?? 1e4
   };
 }
-function resolveSourceCatalogPath(envInput = process.env) {
-  const explicitPath = envInput.KIBANA_SOURCE_CATALOG_PATH?.trim();
-  if (explicitPath) {
-    return explicitPath;
-  }
-  return DEFAULT_RUNTIME_SOURCE_CATALOG_PATH;
-}
 async function loadConfigFromEnvironment(envInput = process.env, dependencies = {}) {
   const overrides = startupOverrideSchema.parse(envInput);
   const readFileImpl = dependencies.readFile ?? readFile4;
   const kibana = readBootstrapConnection(envInput);
   if (kibana) {
-    const preferredPath = resolveSourceCatalogPath(envInput);
-    const sourceCatalog2 = await loadSourceCatalog(
-      preferredPath === DEFAULT_RUNTIME_SOURCE_CATALOG_PATH ? [preferredPath, DEFAULT_STATIC_SOURCE_CATALOG_PATH] : [preferredPath],
-      readFileImpl
-    );
+    const sourceCatalogPath2 = overrides.KIBANA_SOURCE_CATALOG_PATH?.trim();
+    if (!sourceCatalogPath2) {
+      throw new Error("KIBANA_SOURCE_CATALOG_PATH is required for an environment connection.");
+    }
     return {
       kibana,
-      sources: sourceCatalogSchema.parse(sourceCatalog2.value).sources,
-      sourceCatalogPath: preferredPath,
-      sourceCatalogOrigin: sourceCatalog2.loadedFrom === DEFAULT_STATIC_SOURCE_CATALOG_PATH ? "static_default" : preferredPath === DEFAULT_RUNTIME_SOURCE_CATALOG_PATH ? "runtime_default" : "environment"
+      sources: await loadSourceCatalog(sourceCatalogPath2, readFileImpl),
+      sourceCatalogPath: sourceCatalogPath2
     };
   }
   const profileStore = dependencies.profileStore ?? new ProfileStore();
@@ -28889,11 +28872,8 @@ async function loadConfigFromEnvironment(envInput = process.env, dependencies =
     exactName: dependencies.exactProfileName
   }) : await profileStore.getDefaultProfile();
   if (!profile) {
-    if (!requestedProfileName) {
-      throw new NoSavedProfileError("No saved Kibana profile is available.");
-    }
     throw new Error(
-      requestedProfileName ? `Saved Kibana profile '${requestedProfileName}' was not found.` : "No saved Kibana profile is available."
+      requestedProfileName ? `Saved Kibana profile '${requestedProfileName}' was not found.` : "No saved Kibana connection is available. Run connection bootstrap first."
     );
   }
   const savedSecret = await secretStore.load(profile.id).catch((error48) => {
@@ -28905,7 +28885,6 @@ async function loadConfigFromEnvironment(envInput = process.env, dependencies =
     throw error48;
   });
   const sourceCatalogPath = overrides.KIBANA_SOURCE_CATALOG_PATH?.trim() || profile.sourceCatalogPath;
-  const sourceCatalog = await loadSourceCatalog([sourceCatalogPath], readFileImpl);
   return {
     kibana: {
       baseUrl: profile.baseUrl.replace(/\/+$/, ""),
@@ -28913,10 +28892,9 @@ async function loadConfigFromEnvironment(envInput = process.env, dependencies =
       password: savedSecret.password,
       timeoutMs: parseTimeoutOverride(overrides.KIBANA_TIMEOUT_MS) ?? profile.timeoutMs
     },
-    sources: sourceCatalogSchema.parse(sourceCatalog.value).sources,
+    sources: await loadSourceCatalog(sourceCatalogPath, readFileImpl),
     profileName: profile.name,
-    sourceCatalogPath,
-    sourceCatalogOrigin: overrides.KIBANA_SOURCE_CATALOG_PATH?.trim() ? "environment" : "profile"
+    sourceCatalogPath
   };
 }
 function readBootstrapConnection(envInput = process.env) {
@@ -28928,15 +28906,6 @@ function readBootstrapConnection(envInput = process.env) {
   }
   return hasBootstrapConfig(overrides) ? buildKibanaConfig(bootstrapEnvSchema.parse(overrides)) : void 0;
 }
-async function persistSourceCatalog(sources, options = {}) {
-  const sourceCatalogPath = options.sourceCatalogPath ?? resolveSourceCatalogPath(options.envInput);
-  await writeTextAtomically(
-    sourceCatalogPath,
-    `${JSON.stringify(options.catalog ?? { sources }, null, 2)}
-`
-  );
-  return sourceCatalogPath;
-}
 function hasBootstrapConfig(envInput) {
   return Boolean(
     envInput.KIBANA_BASE_URL?.trim() && envInput.KIBANA_USERNAME?.trim() && envInput.KIBANA_PASSWORD?.trim()
@@ -28960,26 +28929,8 @@ function parseTimeoutOverride(value) {
   }
   return numericValue;
 }
-async function loadSourceCatalog(candidatePaths, readFileImpl) {
-  let sourceCatalogRaw;
-  let loadedFrom = candidatePaths[0];
-  let lastError;
-  for (const candidatePath of candidatePaths) {
-    try {
-      sourceCatalogRaw = await readFileImpl(candidatePath, "utf8");
-      loadedFrom = candidatePath;
-      break;
-    } catch (error48) {
-      lastError = error48;
-    }
-  }
-  if (!sourceCatalogRaw) {
-    throw lastError instanceof Error ? lastError : new Error("Source catalog could not be loaded");
-  }
-  return {
-    loadedFrom,
-    value: JSON.parse(sourceCatalogRaw)
-  };
+async function loadSourceCatalog(path, readFileImpl) {
+  return sourceCatalogSchema.parse(JSON.parse(await readFileImpl(path, "utf8"))).sources;
 }
 
 // src/config/config_file.ts
@@ -29097,17 +29048,10 @@ async function resolveConfiguration(envInput, dependencies, customStore) {
     { KIBANA_TIMEOUT_MS: envInput.KIBANA_TIMEOUT_MS, [PROFILE_NAME_ENV]: profileName },
     { ...dependencies, exactProfileName: true }
   );
-  try {
-    return {
-      defaultConfig: await loadConfigFromEnvironment(envInput, dependencies),
-      loadProfileConfig
-    };
-  } catch (error48) {
-    if (error48 instanceof NoSavedProfileError) {
-      return {};
-    }
-    throw error48;
-  }
+  return {
+    defaultConfig: await loadConfigFromEnvironment(envInput, dependencies),
+    loadProfileConfig
+  };
 }
 
 // src/kibana/client.ts
@@ -30003,6 +29947,9 @@ var ProfileRuntimeRegistry = class {
   refreshes = /* @__PURE__ */ new WeakMap();
   defaultRuntime;
   constructor(options = {}) {
+    if (!options.defaultConfig && !options.loadProfileConfig) {
+      throw new Error("No saved Kibana connection is available. Run connection bootstrap first.");
+    }
     this.kibanaClientFactory = options.kibanaClientFactory ?? ((config2) => new KibanaClient(config2));
     this.loadProfileConfig = options.loadProfileConfig;
     this.maxProfiles = options.maxProfiles ?? DEFAULT_MAX_PROFILES;
@@ -30016,24 +29963,13 @@ var ProfileRuntimeRegistry = class {
   get supportsNamedProfiles() {
     return this.loadProfileConfig !== void 0;
   }
-  /** False only for a server started without any configuration, waiting for the legacy 'configure' tool. */
-  get isConfigured() {
-    return this.hasDefault || this.supportsNamedProfiles;
-  }
-  getDefault() {
-    return this.defaultRuntime;
-  }
-  setDefault(config2) {
-    this.defaultRuntime = this.createRuntime(config2);
-    return this.defaultRuntime;
-  }
   async resolve(profileName) {
     if (profileName === void 0) {
       if (this.defaultRuntime) {
         return this.refresh(this.defaultRuntime);
       }
       throw new Error(
-        this.loadProfileConfig ? "No profile was supplied for this call and no default profile is configured." : "Server is not configured. Call the 'configure' tool first."
+        "No profile was supplied for this call and no default profile is configured."
       );
     }
     const key = normalizeProfileName(profileName);
@@ -30129,59 +30065,6 @@ var ProfileRuntimeRegistry = class {
   }
 };
 
-// src/tools/configure.ts
-var configureInputSchema = external_exports.object({
-  kibana: external_exports.object({
-    baseUrl: external_exports.url(),
-    username: external_exports.string().min(1),
-    password: external_exports.string().min(1),
-    timeoutMs: external_exports.number().int().positive().max(12e4).default(1e4)
-  }),
-  sources: external_exports.array(sourceDefinitionSchema).min(1)
-});
-var configureOutputSchema = external_exports.object({
-  configured: external_exports.literal(true),
-  persisted: external_exports.literal(true),
-  source_catalog_path: external_exports.string(),
-  source_count: external_exports.number().int().positive(),
-  source_ids: external_exports.array(external_exports.string()),
-  base_url: external_exports.string()
-});
-async function executeConfigure(input, options = {}) {
-  const nextConfig = {
-    kibana: {
-      baseUrl: input.kibana.baseUrl.replace(/\/+$/, ""),
-      username: input.kibana.username,
-      password: input.kibana.password,
-      timeoutMs: input.kibana.timeoutMs
-    },
-    sources: input.sources
-  };
-  const sourceCatalogPath = await persistSourceCatalog(input.sources, options);
-  return {
-    nextConfig,
-    result: {
-      configured: true,
-      persisted: true,
-      source_catalog_path: sourceCatalogPath,
-      source_count: input.sources.length,
-      source_ids: input.sources.map((source) => source.id),
-      base_url: nextConfig.kibana.baseUrl
-    }
-  };
-}
-function createConfigureCallToolResult(result) {
-  return {
-    content: [
-      {
-        type: "text",
-        text: `Configured Kibana connection for ${result.base_url} with ${result.source_count} sources. Source catalog persisted to ${result.source_catalog_path}.`
-      }
-    ],
-    structuredContent: result
-  };
-}
-
 // src/setup/bootstrap.ts
 import { createHash as createHash5 } from "node:crypto";
 function buildGeneratedSource(rawIndexes, sourceName, sourceId) {
@@ -30253,8 +30136,7 @@ function chooseGeneratedSourceFields(fields, explicitTimeField) {
   ].filter((name) => byName.has(name));
   return { timeField, defaultTextFields, evidenceFields };
 }
-function createGeneratedCatalog(sourceOrSources) {
-  const sources = Array.isArray(sourceOrSources) ? sourceOrSources : [sourceOrSources];
+function createGeneratedCatalog(sources) {
   const parsedSources = sources.map((source) => sourceDefinitionSchema.parse(source));
   return sourceCatalogSchema.parse({
     generatedBy: {
@@ -31855,23 +31737,7 @@ function createApplication(initialConfig, dependencies) {
       );
     }
   }
-  const configureHandler = async (input) => {
-    const current = registry2.getDefault()?.config;
-    const { nextConfig, result } = await executeConfigure(configureInputSchema.parse(input), {
-      sourceCatalogPath: current?.sourceCatalogPath
-    });
-    registry2.setDefault({
-      ...nextConfig,
-      sourceCatalogPath: result.source_catalog_path,
-      profileName: current?.profileName,
-      sourceCatalogOrigin: current?.sourceCatalogOrigin
-    });
-    return result;
-  };
   const configureIndexHandler = async (input, callerSignal) => {
-    if (!registry2.isConfigured) {
-      throw new Error("No saved Kibana connection is available. Run connection bootstrap first.");
-    }
     const configureIndexFn = dependencies?.configureIndexFn ?? executeConfigureIndex;
     return withProfile(
       (runtime) => withKibanaToolDeadline(callerSignal, async (signal) => {
@@ -31920,31 +31786,19 @@ function createApplication(initialConfig, dependencies) {
       })
     )
   );
-  if (!registry2.isConfigured) {
-    server.registerTool(
-      "configure",
-      {
-        description: "Advanced legacy setup for a server started without a saved profile. Replaces the Kibana connection and full source catalog.",
-        inputSchema: configureInputSchema,
-        outputSchema: configureOutputSchema
-      },
-      async (input) => createConfigureCallToolResult(await configureHandler(input))
-    );
-  } else {
-    server.registerTool(
-      "configure_index",
-      {
-        description: "Configure exactly one Kibana index or index pattern after the user has explicitly named it. Never guess, list, scan, or auto-select indexes before calling this tool.",
-        inputSchema: configureIndexInputSchema,
-        outputSchema: configureIndexOutputSchema
-      },
-      async (input, context) => withKibanaRequestDiagnostics(
-        async () => createConfigureIndexCallToolResult(
-          await configureIndexHandler(input, context.mcpReq.signal)
-        )
+  server.registerTool(
+    "configure_index",
+    {
+      description: "Configure exactly one Kibana index or index pattern after the user has explicitly named it. Never guess, list, scan, or auto-select indexes before calling this tool.",
+      inputSchema: configureIndexInputSchema,
+      outputSchema: configureIndexOutputSchema
+    },
+    async (input, context) => withKibanaRequestDiagnostics(
+      async () => createConfigureIndexCallToolResult(
+        await configureIndexHandler(input, context.mcpReq.signal)
       )
-    );
-  }
+    )
+  );
   server.registerTool(
     "describe_fields",
     {
@@ -31992,7 +31846,6 @@ function createApplication(initialConfig, dependencies) {
   return {
     server,
     handlers: {
-      configure: configureHandler,
       configure_index: configureIndexHandler,
       describe_fields: describeFieldsHandler,
       discover: discoverHandler,

package/plugins/kibana-log-investigation/skills/install-and-configure/SKILL.md

@@ -38,7 +38,7 @@ npm run build
 node dist/src/bin/kibana-mcp-server.js bootstrap --client none
 ```
 
-7. Confirm bootstrap reports an empty source catalog. It must not inspect or configure indexes.
+7. Confirm first-time bootstrap reports an empty source catalog. It must not inspect or configure indexes. Remove `KIBANA_BASE_URL`, `KIBANA_USERNAME`, and `KIBANA_PASSWORD` from the plugin process environment before reconnecting so startup uses the saved profile. In Bash: `unset KIBANA_BASE_URL KIBANA_USERNAME KIBANA_PASSWORD`; in PowerShell: `Remove-Item Env:KIBANA_BASE_URL, Env:KIBANA_USERNAME, Env:KIBANA_PASSWORD -ErrorAction SilentlyContinue`.
 8. In a fresh Codex session, call `discover`. When it reports no sources, ask the operator which exact index or index pattern to configure.
 9. Only after the operator answers, call `configure_index` with exactly that value. Then run `discover` again.
 

package/skills/kibana-log-investigation/SKILL.md

@@ -57,7 +57,7 @@ If you are not running in Codex and the tools of this server (`discover`, `confi
 - in Claude Code, by installing the plugin: `/plugin marketplace add Havesomecode/kibana-mcp-server`, then `/plugin install kibana-log-investigation@kibana-mcp-server`;
 - in any other agent, by declaring the stdio command `npx -y @havesomecode/kibana-mcp-server serve` in its MCP configuration.
 
-With `--client none`, a server that was already running when bootstrap completed still has no connection. Ask the operator to reconnect the MCP server or start a new session before calling its tools.
+With `--client none`, reconnect the MCP server or start a new session after bootstrap. A server without a configured connection fails at startup; it does not wait for an MCP tool to supply credentials.
 
 ### What bootstrap does
 
@@ -120,6 +120,8 @@ To select an existing non-default profile:
 npx -y @havesomecode/kibana-mcp-server serve --profile prod
 ```
 
+For saved-profile startup, do not pass `KIBANA_BASE_URL`, `KIBANA_USERNAME`, or `KIBANA_PASSWORD` to the server process. Supplying all three selects direct environment startup, which requires an explicit `KIBANA_SOURCE_CATALOG_PATH` or a configuration-file catalog store. Saved profiles already carry their catalog path; no checkout catalog is loaded implicitly. Guided `setup` remains available when the operator explicitly wants to import a hand-authored catalog.
+
 ## Failure rules
 
 - Never silently import the bundled example catalog.
@@ -128,7 +130,7 @@ npx -y @havesomecode/kibana-mcp-server serve --profile prod
 - Never add `--replace` merely to make a failed install pass. It intentionally replaces an existing catalog with an empty managed catalog.
 - Never overwrite a conflicting MCP client registration.
 - Never write or edit an MCP client configuration file to register the server; only bootstrap in Codex, a plugin, or the operator does that.
-- Never use the legacy `configure` tool to supply credentials. If it is the only setup tool offered, the server has no saved connection: run bootstrap, then have the server reconnected.
+- If startup fails with `No saved Kibana connection is available. Run connection bootstrap first.`, run connection-only bootstrap, then reconnect the server. No MCP tool accepts connection credentials.
 - Never expose a password in logs, summaries, shell history, generated catalogs, or MCP client configuration.
 - If URL, username, or password is unavailable, report the exact missing prerequisite rather than inventing it.
 

package/dist/src/tools/configure.d.ts

@@ -1,59 +0,0 @@
-import type { CallToolResult } from "@modelcontextprotocol/server";
-import { z } from "zod";
-import type { AppConfig } from "../types.js";
-export declare const configureInputSchema: z.ZodObject<{
-    kibana: z.ZodObject<{
-        baseUrl: z.ZodURL;
-        username: z.ZodString;
-        password: z.ZodString;
-        timeoutMs: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>;
-    sources: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        tags: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        timeField: z.ZodString;
-        backend: z.ZodObject<{
-            kind: z.ZodEnum<{
-                elasticsearch_search: "elasticsearch_search";
-                kibana_internal_search_es: "kibana_internal_search_es";
-            }>;
-            path: z.ZodString;
-            index: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        }, z.core.$strip>;
-        schema: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodEnum<{
-                elasticsearch_field_caps: "elasticsearch_field_caps";
-                kibana_data_views_fields: "kibana_data_views_fields";
-                kibana_index_patterns_fields: "kibana_index_patterns_fields";
-            }>;
-            path: z.ZodOptional<z.ZodString>;
-            index: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        }, z.core.$strip>>;
-        fieldHints: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-            type: z.ZodOptional<z.ZodString>;
-            description: z.ZodOptional<z.ZodString>;
-            aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        }, z.core.$strip>>>;
-        defaultTextFields: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        evidenceFields: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const configureOutputSchema: z.ZodObject<{
-    configured: z.ZodLiteral<true>;
-    persisted: z.ZodLiteral<true>;
-    source_catalog_path: z.ZodString;
-    source_count: z.ZodNumber;
-    source_ids: z.ZodArray<z.ZodString>;
-    base_url: z.ZodString;
-}, z.core.$strip>;
-export declare function executeConfigure(input: z.infer<typeof configureInputSchema>, options?: {
-    envInput?: NodeJS.ProcessEnv;
-    sourceCatalogPath?: string;
-}): Promise<{
-    nextConfig: AppConfig;
-    result: z.infer<typeof configureOutputSchema>;
-}>;
-export declare function createConfigureCallToolResult(result: z.infer<typeof configureOutputSchema>): CallToolResult;

package/dist/src/tools/configure.js

@@ -1,53 +0,0 @@
-import { z } from "zod";
-import { persistSourceCatalog, sourceDefinitionSchema } from "../config/environment.js";
-export const configureInputSchema = z.object({
-    kibana: z.object({
-        baseUrl: z.url(),
-        username: z.string().min(1),
-        password: z.string().min(1),
-        timeoutMs: z.number().int().positive().max(120000).default(10000),
-    }),
-    sources: z.array(sourceDefinitionSchema).min(1),
-});
-export const configureOutputSchema = z.object({
-    configured: z.literal(true),
-    persisted: z.literal(true),
-    source_catalog_path: z.string(),
-    source_count: z.number().int().positive(),
-    source_ids: z.array(z.string()),
-    base_url: z.string(),
-});
-export async function executeConfigure(input, options = {}) {
-    const nextConfig = {
-        kibana: {
-            baseUrl: input.kibana.baseUrl.replace(/\/+$/, ""),
-            username: input.kibana.username,
-            password: input.kibana.password,
-            timeoutMs: input.kibana.timeoutMs,
-        },
-        sources: input.sources,
-    };
-    const sourceCatalogPath = await persistSourceCatalog(input.sources, options);
-    return {
-        nextConfig,
-        result: {
-            configured: true,
-            persisted: true,
-            source_catalog_path: sourceCatalogPath,
-            source_count: input.sources.length,
-            source_ids: input.sources.map((source) => source.id),
-            base_url: nextConfig.kibana.baseUrl,
-        },
-    };
-}
-export function createConfigureCallToolResult(result) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: `Configured Kibana connection for ${result.base_url} with ${result.source_count} sources. Source catalog persisted to ${result.source_catalog_path}.`,
-            },
-        ],
-        structuredContent: result,
-    };
-}