Hosted OpenSearch MCP quickstart
Logit.io hosts a read-only OpenSearch MCP server (opens in a new tab) for your Logs and OpenSearch stacks. Connect Cursor or Claude Desktop over HTTPS without running MCP locally.
Public URL:
@mcp.endpointAddressRelated product pages: Hosted OpenSearch MCP (opens in a new tab), Hosted OpenSearch (opens in a new tab). New accounts can start with a 14-day trial (opens in a new tab).
Available on Log Management and Custom plans. MCP uses a dedicated API key, separate from your OpenSearch HTTP API key on {stack-id}-es.logit.io.
When signed in with MCP enabled on your selected stack, examples auto-fill @mcp.endpointAddress, @mcp.username, @mcp.apiKey, and @mcp.base64encodedAuthString. If placeholders remain, enable MCP under stack Settings → Access, then refresh docs.
MCP is not a substitute for the full OpenSearch REST API. For programmatic write access or stack-key automation, use Connect to Your Cluster. For role-scoped human/CI API access, use OpenSearch API (user credentials).
Prerequisites
- A Logit.io account (opens in a new tab) on a Log Management or Custom plan.
- A Logs or OpenSearch stack with data you can search.
- Permission to enable MCP on the stack (stack administrator or account owner/admin).
- An AI client that supports remote MCP over HTTPS with custom headers (Cursor or Claude Desktop).
1. Enable on a stack
- Sign in to the Logit.io Dashboard (opens in a new tab).
- Open the stack Settings page (Overview).
- In Access, find OpenSearch MCP.
- Select Enable.
Logit.io provisions {stack-id}-mcp.logit.io and generates a dedicated MCP API key.
Disable from the same Access card to remove the public MCP route for that stack. Enable separately on each stack you want clients to reach.
2. Copy connection details
Open Settings → Endpoints. The OpenSearch MCP (read-only) section shows:
| Field | Value |
|---|---|
| MCP URL | @mcp.endpointAddress |
| Username | @mcp.username |
| API Key | Dedicated MCP key (not the OpenSearch -es key) — @mcp.apiKey when signed in |
| Example config | JSON ready to paste into Cursor or Claude Desktop |
Rotate the MCP API key from the Endpoints page when you need to invalidate a previous key. Do not reuse your OpenSearch -es stack API key for MCP.
3. Connect Cursor
- Copy the example MCP config from Settings → Endpoints, or use the auto-filled example below when signed in.
- In Cursor, open Settings → MCP (or edit your MCP config file, for example
.cursor/mcp.json). - Add a server entry, or merge the
logit-opensearchblock into an existingmcpServersobject. - Save, then confirm the server connects and tools are listed.
{
"mcpServers": {
"logit-opensearch": {
"url": "@mcp.endpointAddress",
"headers": {
"Authorization": "Basic @mcp.base64encodedAuthString"
}
}
}
}The Endpoints page also provides a ready-to-copy block with the correctly encoded Authorization header. Prefer that over encoding credentials by hand.
4. Connect Claude Desktop
Claude Desktop uses the same JSON shape. Paste the config from Settings → Endpoints (or the example above when signed in) into Claude's MCP server settings, then restart Claude Desktop if your client version requires it. Confirm the Logit.io server appears and tools are listed.
If your Claude build does not support remote HTTPS MCP with custom headers yet, use Cursor for now, or check Claude's MCP docs for the transport your version supports.
5. First successful query
Once tools are listed:
- Ask the client to list indexes on the connected stack.
- Pick an index name from the response.
- Ask it to search that index for something you expect in the data — for example a recent
timeout,5xx, or service name.
You should see tool calls against the stack and either matching hits or an empty result set. Either way, the connection is working.
Hosted MCP is read-only. Write tools are not available. For writes and admin automation, use the OpenSearch REST API or the Developer API.
Limitations
| Topic | Behaviour |
|---|---|
| Write operations | Not available — MCP is always read-only |
| Credentials | Dedicated {stack-id}-mcp username + MCP API key; do not reuse the -es stack API key |
| Plan | Log Management and Custom |
| Scope | One MCP endpoint per stack; enable separately on each stack you need |
Troubleshooting
| Symptom | What to check |
|---|---|
| 401 Unauthorized | Using the MCP username (@mcp.username) and MCP API key from Endpoints? Key recently rotated? Accidentally using the -es stack key? |
| 404 / connection failed | MCP enabled on the stack? URL exact (@mcp.endpointAddress)? DNS may take a short time after enable. |
| Client cannot list tools | Confirm the client supports remote MCP over HTTPS with custom headers; re-paste the dashboard config; restart the client after saving. |
| Tools listed but queries fail | Confirm the stack has indexes and data; list indexes first, then search a known index name. |
| Expected write tool missing | By design — hosted MCP does not expose write tools. |
| Docs still show placeholders | Select a stack with MCP enabled under Settings → Access, then refresh. |
Next steps
- Connect to Your Cluster — stack API key on
-es - OpenSearch API (user credentials) — role-scoped REST API
- Search APIs
- Managed Stack Limitations
- Hosted OpenSearch (opens in a new tab) — managed OpenSearch overview
- Start a trial (opens in a new tab) — 14 days, no credit card