Tracked packageView full profile for mcp-server-elasticsearch →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-server-elasticsearchHEAD

Item: mcp-server-elasticsearch
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 6:39:23 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

3.4/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-server-elasticsearch

VersionHEAD

SourceGITHUB

LicenseApache-2.0

Publisherelastic

Package age1y 1m

Stars650

Downloads/wk—

Dependencies0

Homepagehttps://www.elastic.co/elasticsearch

Repositoryhttps://github.com/elastic/mcp-server-elasticsearch

Findings

6 of 6 findings

high (2)

medium (4)

6 findings

high (2)

AIVSS 3.4CVSS 5.8

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

Evidence

Test connectivity to your Elasticsearch cluster from the container:

```bash
docker exec <container-id> curl -k -u <username>:<password> <ES_URL>
```

Or with an API key:

Remediation

Drop the verify-disable flag. If the peer presents a private CA: - Python: pass `verify="/path/to/ca.pem"` or trust the system store - Node: `new https.Agent({ ca: fs.readFileSync("ca.pem") })` - Go: load the CA via `x509.NewCertPool().AppendCertsFromPEM(...)` and set `tls.Config.RootCAs` Self-signed certificates: import the cert into the OS trust chain rather than disabling verification per-call.

Report false positive →

AIVSS 3.4CVSS 5.8

Evidence

Or with an API key:

```bash
docker exec <container-id> curl -k -H "Authorization: ApiKey <api-key>" <ES_URL>
```

A successful response indicates the container can reach your Elasticsearch cluster.

Remediation

Report false positive →

medium (4)

AIVSS 3.2CVSS 4.4

Container base image uses the floating :latest tag. This provides no reproducibility — the image content can change under you, and there is no signature to verify.

Evidence

RUN cargo build --release

#--------------------------------------------------------------------------------------------------

FROM cgr.dev/chainguard/wolfi-base:latest

COPY --from=builder /app/target/release/elasticsearch-core-mcp-server /usr/local/bin/elasticsearch-core-mcp-server

Remediation

Pin the base image by digest (e.g. python@sha256:...) or at minimum an exact semver tag (e.g. python:3.12.4-slim-bookworm). Never use :latest in production Dockerfiles.

Report false positive →

AIVSS 3.2CVSS 4.4

Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.

Evidence

# Copyright Elasticsearch B.V. and contributors
# SPDX-License-Identifier: Apache-2.0

# To create a multi-arch image, run:
# docker buildx build --platform linux/amd64,linux/arm64 --tag elasticsearch-core-mcp-server .

FROM rust:1.89@sha256:c50cd6e20c46b0b36730b5eb27289744e4bb8f32abc90d8c64ca09decf4f55ba AS builder

WORKDIR /app

COPY Cargo.toml Cargo.lock ./

# Cache dependencies
RUN mkdir -p ./src/bin && \
    echo "pub fn main() {}" > ./src/bin/elasticsearch-core-mcp-server.rs && \
    cargo

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Report false positive →

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

with:
          vault-instance: "ci-prod"
      - name: Add comment
        uses: actions/github-script@v7
        with:
          github-token: ${{ steps.fetch-token.outputs.token }}
          script: |

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

args: "--locked --release"
          working-directory: ${{ github.workspace }}/checkout-tag
      - name: Upload binaries to release
        uses: svenstaro/upload-release-action@v2
        with:
          tag: ${{ steps.version-tag.outputs.ref }}
          file: checkout-tag/target/${{ matrix.target.target }}/release/elasticsearch-core-mcp-server${{ matrix.target.ext }}

Remediation

Report false positive →

LLM summary— mcp-server-elasticsearch:HEAD

This package earns a B grade with a safety score of 86/100 but carries moderate security concerns, including 2 high-severity issues and 4 medium-severity issues centered on insecure container images and server configuration weaknesses. The AIVSS score of 3.4/10 indicates notable vulnerabilities that should be addressed before production deployment. You should review the specific container image and configuration issues identified in the detailed findings before deciding to install.

Signal scores

CVE check100

Static100

Publisher identity50

Permissions60

Supply chain68

Typosquat100

Package health85

Community82

Injection risks100

Secrets & exfil100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 6
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 12d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-server-elasticsearch
Version: HEAD
License: Apache-2.0
Publisher: elastic
Verified: No
Account age: 12y 2m
Added: 1y 1m ago
Versions: 650
Homepage: https://www.elastic.co/elasticsearch
Repository: https://github.com/elastic/mcp-server-elasticsearch
Ecosystem: GitHub
Stars: 650
Forks: 140
Open issues: 17
Dependencies: 0

elasticsearchmcpmcp-servervector-database

AIVSS Score

3.4/ 10Low

Internal score: 86/100

Severity breakdown

Scan Details

Total findings6

Affected tools0 / 1

Scanned12d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfast7e38b4b0a2667669f8d9

Want deeper analysis?

Fast scan found 6 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

6 of 6 findings

high (2)

medium (4)

6 findings

high (2)

AIVSS 3.4CVSS 5.8

Evidence

Test connectivity to your Elasticsearch cluster from the container:

```bash
docker exec <container-id> curl -k -u <username>:<password> <ES_URL>
```

Or with an API key:

Remediation

Report false positive →

AIVSS 3.4CVSS 5.8

Evidence

Or with an API key:

```bash
docker exec <container-id> curl -k -H "Authorization: ApiKey <api-key>" <ES_URL>
```

A successful response indicates the container can reach your Elasticsearch cluster.

Remediation

Report false positive →

medium (4)

AIVSS 3.2CVSS 4.4

Container base image uses the floating :latest tag. This provides no reproducibility — the image content can change under you, and there is no signature to verify.

Evidence

RUN cargo build --release

#--------------------------------------------------------------------------------------------------

FROM cgr.dev/chainguard/wolfi-base:latest

COPY --from=builder /app/target/release/elasticsearch-core-mcp-server /usr/local/bin/elasticsearch-core-mcp-server

Remediation

Pin the base image by digest (e.g. python@sha256:...) or at minimum an exact semver tag (e.g. python:3.12.4-slim-bookworm). Never use :latest in production Dockerfiles.

Report false positive →

AIVSS 3.2CVSS 4.4

Evidence

# Copyright Elasticsearch B.V. and contributors
# SPDX-License-Identifier: Apache-2.0

# To create a multi-arch image, run:
# docker buildx build --platform linux/amd64,linux/arm64 --tag elasticsearch-core-mcp-server .

FROM rust:1.89@sha256:c50cd6e20c46b0b36730b5eb27289744e4bb8f32abc90d8c64ca09decf4f55ba AS builder

WORKDIR /app

COPY Cargo.toml Cargo.lock ./

# Cache dependencies
RUN mkdir -p ./src/bin && \
    echo "pub fn main() {}" > ./src/bin/elasticsearch-core-mcp-server.rs && \
    cargo

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

with:
          vault-instance: "ci-prod"
      - name: Add comment
        uses: actions/github-script@v7
        with:
          github-token: ${{ steps.fetch-token.outputs.token }}
          script: |

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

args: "--locked --release"
          working-directory: ${{ github.workspace }}/checkout-tag
      - name: Upload binaries to release
        uses: svenstaro/upload-release-action@v2
        with:
          tag: ${{ steps.version-tag.outputs.ref }}
          file: checkout-tag/target/${{ matrix.target.target }}/release/elasticsearch-core-mcp-server${{ matrix.target.ext }}

Remediation

Report false positive →

211	Test connectivity to your Elasticsearch cluster from the container:
212
213	```bash
214	docker exec <container-id> curl -k -u <username>:<password> <ES_URL>
215	```
216
217	Or with an API key:

217	Or with an API key:
218
219	```bash
220	docker exec <container-id> curl -k -H "Authorization: ApiKey <api-key>" <ES_URL>
221	```
222
223	A successful response indicates the container can reach your Elasticsearch cluster.

20	RUN cargo build --release
21
22	#--------------------------------------------------------------------------------------------------
23
24	FROM cgr.dev/chainguard/wolfi-base:latest
25
26	COPY --from=builder /app/target/release/elasticsearch-core-mcp-server /usr/local/bin/elasticsearch-core-mcp-server

1	# Copyright Elasticsearch B.V. and contributors
2	# SPDX-License-Identifier: Apache-2.0
3
4	# To create a multi-arch image, run:
5	# docker buildx build --platform linux/amd64,linux/arm64 --tag elasticsearch-core-mcp-server .
6
7	FROM rust:1.89@sha256:c50cd6e20c46b0b36730b5eb27289744e4bb8f32abc90d8c64ca09decf4f55ba AS builder
8
9	WORKDIR /app
10
11	COPY Cargo.toml Cargo.lock ./
12
13	# Cache dependencies
14	RUN mkdir -p ./src/bin && \
15	echo "pub fn main() {}" > ./src/bin/elasticsearch-core-mcp-server.rs && \
16	cargo

15	with:
16	vault-instance: "ci-prod"
17	- name: Add comment
18	uses: actions/github-script@v7
19	with:
20	github-token: ${{ steps.fetch-token.outputs.token }}
21	script: \|

78	args: "--locked --release"
79	working-directory: ${{ github.workspace }}/checkout-tag
80	- name: Upload binaries to release
81	uses: svenstaro/upload-release-action@v2
82	with:
83	tag: ${{ steps.version-tag.outputs.ref }}
84	file: checkout-tag/target/${{ matrix.target.target }}/release/elasticsearch-core-mcp-server${{ matrix.target.ext }}