Menu
Use Elastic Agent Builder and Agent Builder MCP from the IDE (define tools, test, connect Cursor/Claude)
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | agent-builder-mcp |
| description | Use Elastic Agent Builder and Agent Builder MCP from the IDE (define tools, test, connect Cursor/Claude) |
Use this skill when the user wants to create or use custom tools with Elastic Agent Builder, or connect their IDE to Agent Builder’s MCP endpoint.
create_agent_builder_tool with name, description, and optional input_schema. The output is a tool definition to create in Agent Builder (UI or API).list_agent_builder_tools with the Agent Builder endpoint (or set AGENT_BUILDER_ENDPOINT).test_agent_builder_tool with tool name and sample arguments.get_agent_builder_mcp_config with the Agent Builder MCP URL (e.g. https://your-kibana/api/agent_builder/mcp) and transport (e.g. streamable_http). Add the returned JSON to the user’s MCP config (Cursor Settings → MCP, or Claude Code config) so the IDE uses Agent Builder’s MCP server.test_agent_builder_tool with sample input before relying on them in production.Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.