ecs-mcp

ecs-mcp

ecs-mcp is a Model Context Protocol (MCP) server that enables LLMs to query metadata about Elastic Common Schema (ECS).

Features

• Loads ECS field definitions from the official ecs_flat.yml file
• Fetches from GitHub by default — no local ECS repo required; downloads ecs_flat.yml from the elastic/ecs repository
• Optional local file: use a local ecs_flat.yml path instead of GitHub
• Builds a queryable SQLite database with ECS field metadata
• Exposes read-only database access to LLMs through the Model Context Protocol
• Enables AI assistants to answer detailed questions about ECS fields

Usage

Default: fetch ECS from GitHub

With no extra arguments, the server fetches the ECS definition from GitHub (https://raw.githubusercontent.com/elastic/ecs/main/generated/ecs/ecs_flat.yml) and uses it to build the database. No local ECS repo or file is required.

With go run

{
  "mcpServers": {
    "ecs": {
      "command": "go",
      "args": [
        "run",
        "github.com/taylor-swanson/ecs-mcp@main"
      ]
    }
  }
}

Local install

Install the binary:

go install github.com/taylor-swanson/ecs-mcp

Then use the binary path (e.g. from which ecs-mcp):

{
  "mcpServers": {
    "ecs": {
      "command": "/Users/<USERNAME>/go/bin/ecs-mcp"
    }
  }
}

Optional: use a local ECS file

To use a local ecs_flat.yml instead of fetching from GitHub:

{
  "mcpServers": {
    "ecs": {
      "command": "/Users/<USERNAME>/go/bin/ecs-mcp",
      "args": ["-ecs-file", "/path/to/ecs/generated/ecs/ecs_flat.yml"]
    }
  }
}

Optional: choose a different Git ref (branch or tag)

When fetching from GitHub, you can pin to a branch or tag with -git-ref:

{
  "mcpServers": {
    "ecs": {
      "command": "/Users/<USERNAME>/go/bin/ecs-mcp",
      "args": ["-git-ref", "v9.3.0"]
    }
  }
}

Command-line arguments

Database schema

The SQLite database contains information about ECS fields from the flat definition, including:

• Fields: Metadata about each field (name, type, description)

License

This project is licensed under the Apache License 2.0 — see the LICENSE.txt file for details.