Elasticsearch vs Aegis
A side-by-side look at the Elasticsearch and Aegis MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Elasticsearch for security work as a local process; choose Aegis for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Elasticsearch when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You have the keys it needs:
ES_URL, ES_API_KEY, ES_USERNAME, ES_PASSWORD, ES_CA_CERT, NODE_TLS_REJECT_UNAUTHORIZED, MCP_TRANSPORT, MCP_HTTP_PORT. - You want tools like
list_indices, get_mappings, es_search.
Choose Aegis when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 57/100 · Good | 53/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | Not declared |
| Pricing | Not declared | Not declared |
| Required env vars | ES_URLES_API_KEYES_USERNAMEES_PASSWORDES_CA_CERTNODE_TLS_REJECT_UNAUTHORIZEDMCP_TRANSPORTMCP_HTTP_PORT | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 8 | 14 |
| Directory activity | 3 views 0 installs 0 upvotes | 3 views 0 installs 0 upvotes |
| Tools | 8 | Not listed |
| Full listing | View Elasticsearch | View Aegis |
Tools & capabilities
Elasticsearch tools 8
list_indicesList indices with pattern filter, health filter, sorting and token-aware summaryget_mappingsGet field mappings with flat/tree/raw modes, field filtering and multi-index comparees_searchFull Query DSL search with auto-highlight, plus harness field validation / auto-fixlookup_fieldsFind the right field names: ECS vocabulary intersected with the index's real fieldsexecute_es_apiExecute any ES REST endpoint directly (GET/POST/PUT/DELETE/HEAD)get_shardsShard info with health analysis, problem detection and recommendationslist_data_streamsList and analyze Data Streams with ILM info and backing index detailsesql_queryExecute ES\
Aegis tools
No tool names declared yet. Check the project README from the listing page.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Elasticsearch
{
"mcpServers": {
"elasticsearch": {
"command": "npx",
"args": [
"-y",
"@tocharianou/elasticsearch-mcp"
],
"env": {
"ES_URL": "YOUR_ES_URL_HERE",
"ES_API_KEY": "YOUR_ES_API_KEY_HERE",
"ES_USERNAME": "YOUR_ES_USERNAME_HERE",
"ES_PASSWORD": "YOUR_ES_PASSWORD_HERE",
"ES_CA_CERT": "YOUR_ES_CA_CERT_HERE",
"NODE_TLS_REJECT_UNAUTHORIZED": "YOUR_NODE_TLS_REJECT_UNAUTHORIZED_HERE",
"MCP_TRANSPORT": "YOUR_MCP_TRANSPORT_HERE",
"MCP_HTTP_PORT": "YOUR_MCP_HTTP_PORT_HERE"
}
}
}
}
Aegis
{
"mcpServers": {
"getaegis-aegis": {
"command": "npx",
"args": [
"-y",
"@getaegis/cli"
]
}
}
}
Frequently asked questions
Elasticsearch is categorized under Security and uses a local stdio subprocess. Aegis belongs to Security and uses a local stdio subprocess. Pick Elasticsearch for security work and Aegis for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Elasticsearch has no declared pricing — check the project's own site. Aegis has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add elasticsearch and getaegis-aegis as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Elasticsearch has a quality signal of 57/100 (Good) with 3 views, 0 installs and 8 GitHub stars. Aegis has 53/100 (Good) with 3 views, 0 installs and 14 GitHub stars.