Elastic announced MCP Apps for Elastic, delivering first-of-their-kind agent-native UI experiences for security and observability workflows across third-party coding tools and chat clients.
The new MCP Apps enable teams to investigate threats, diagnose system behavior, and act on data directly within the AI tools they already use, without switching tools or stitching together separate systems.
Built on the Model Context Protocol (MCP) apps spec, the open standard co-authored by Anthropic and OpenAI, these apps allow AI assistants to return fully interactive user interfaces rendered directly within environments such as Claude, VS Code, GitHub Copilot, Goose, Postman, and MCPJam.
Most AI integrations today stop at conversational text. That works for simple queries, but breaks down for workflows that are inherently visual and interactive, including alert triage, investigation graphs, dashboards, and distributed traces. Elastic’s MCP Apps close that gap by supporting security and observability workflows in a live AI-native interface that users can explore, filter, and act on, allowing teams to manage threat detection or system diagnosis without leaving the conversation.
“The MCP App for Elastic Security bridges the gap between automated detection and manual hunting,” said Mandy Andress, CISO of Elastic. “By bringing our security data directly into a single interface within Claude Desktop, we surfaced 'silent' threats in under an hour, risks that didn't trigger standard alerts but required immediate action. It's a force multiplier for our analysts."
“Our customers are increasingly working inside AI-native environments,” said Ken Exner, chief product officer at Elastic. “With our MCP Apps, Elastic meets them there by bringing security, observability, and search workflows into the AI tools that they are using so that teams can investigate threats and diagnose systems without switching tools. The answer is no longer a summary, it’s the workflow itself.”
While early MCP App adopters have focused on productivity tools like Amplitude, Asana, Figma, and Slack, the Elastic Security MCP App enables analysts to triage alerts, run ES|QL queries, investigate threats, and manage cases through interactive views rendered directly in the conversation. Workflows such as alert lists, process trees, and investigation graphs remain fully interactive, allowing analysts to move from question to action without tab switching or hand-offs.
The MCP App for Security provides core tasks for analysts, including:
- Alert triage: severity grouping, AI verdicts, process trees, and one-click case creation
- Attack discovery: correlated attack chains with MITRE ATT&CK mapping, risk scoring, and bulk case creation
- Threat hunting: an ES|QL workbench with auto-executed queries, clickable entities, and an investigation graph
The Elastic Observability MCP App enables teams to explore distributed traces, inspect service dependencies, and diagnose system health through interactive views rendered directly in the conversation, helping engineers move from detection to root cause analysis without switching tools.
The MCP App for Observability provides, end-to-end Kubernetes & APM incident investigation, including:
- Cluster & service health rollup: overall health badges, degraded services with reasons, top pod memory consumers, ML anomaly severity breakdown, and service throughput — all oriented in a single adaptive inline view
- Anomaly detection & dependency mapping: ML-powered anomaly explanations with actual vs. typical values and time-series context, plus interactive service topology graphs with per-edge call volume and latency, and node failure blast radius diagrams showing full-outage versus degraded deployments with rescheduling feasibility
- Live monitoring & alerting: ES|QL-backed observe mode for one-shot metric queries, live threshold watching, and ML anomaly triggers, alongside persistent Kibana alert rule creation and management directly from the conversation
Elastic also provides MCP Apps for search and data exploration. The Search MCP App enables users to explore data and build dashboards through natural language, with results rendered as interactive visualizations that can be edited and exported.
The MCP App for Search, includes:
- Dashboard creation: build dashboards from natural language with panels automatically generated from your data
- Data exploration: query and analyze data using ES|QL with results rendered inline
- Interactive editing: refine, rearrange, and export dashboards directly from the conversation
Elastic MCP Apps for Security, Observability, and Search are available now in public preview, with support across platforms including Claude, Claude Desktop, VS Code, GitHub Copilot, Goose, Postman, and MCPJam.
The Latest
As AI adoption accelerates, operational complexity — not model intelligence — is becoming the primary barrier to reliable AI at scale, according to the State of AI Engineering 2026 from Datadog ... The report highlights a compounding complexity challenge as AI systems scale ... Around 5% of AI model requests fail in production, with nearly 60% of those failures caused by capacity limits ...
For years, production operations teams have treated alert fatigue as a quality-of-life problem: something that makes on-call rotations miserable but isn't considered a direct contributor to outages. That framing doesn't capture how these systems fail, and we now have data to show why. More importantly, it's now clear alert fatigue is a symptom of a deeper issue: production systems have outgrown the current operational approaches ...
I was on a customer call last fall when an enterprise architect said something I haven't been able to shake. Her team had just spent four months trying to swap one AI vendor for another. The original plan said three weeks. "We didn't switch vendors," she told me. "We rebuilt half our integrations and discovered what we'd actually been depending on." Most enterprise leaders don't expect that to be the experience ...
Ask any senior SRE or platform engineer what keeps them up at night, and the answer probably isn't the monitoring tool — it's the data feeding it. The proliferation of APM, observability, and AIOps platforms has created a telemetry sprawl problem that most teams manage reactively rather than architect proactively. Metrics are going to one platform. Traces routed somewhere else. Logs duplicated across multiple backends because nobody wants to be caught without them when something breaks. Every redundant stream costs money ...
80% of respondents agree that the IT role is shifting from operators to orchestrators, according to the 2026 IT Trends Report: The Human Side of Autonomous IT from SolarWinds ...
40% of organizations deploying AI will implement dedicated AI observability tools by 2028 to monitor model performance, bias and outputs, according to Gartner ...
Until AI-powered engineering tools have live visibility of how code behaves at runtime, they cannot be trusted to autonomously ensure reliable systems, according to the State of AI-Powered Engineering Report 2026 report from Lightrun. The report reveals that a major volume of manual work is required when AI-generated code is deployed: 43% of AI-generated code requires manual debugging in production, even after passing QA or staging tests. Furthermore, an average of three manual redeploy cycles are required to verify a single AI-suggested code fix in production ...
Many organizations describe AI as strategic, but they do not manage it strategically. When AI plans are disconnected from strategy, detached from organizational learning, and protected from serious assumptions testing, the problem is no longer technical immaturity; it is a failure of management discipline ... Executives too often tell organizations to "use AI" before they define what AI is supposed to change. The problem deepens in organizations where strategy isn't well articulated in the first place ...
Across the enterprise technology landscape, a quiet crisis is playing out. Organizations have run hundreds, sometimes thousands, of generative AI pilots. Leadership has celebrated the proof of concept (POCs) ... Industry experience points to a sobering reality: only 5-10% of AI POCs that progress to the pilot stage successfully reach scaled production. The remaining 90% fail because the enterprise environment around them was never ready to absorb them, not the AI models ...
Today's modern systems are not what they once were. Organizations now rely on distributed systems, event-driven workflows, hybrid and multi-cloud environments and continuous delivery pipelines. While each adds flexibility, it also introduces new, often invisible failures. Development speed is no longer the primary bottleneck of innovation. Reliability is ...