Tools in Elastic Agent Builder

Agents use tools to search, retrieve, and take actions on your behalf.

Tools can be thought of as functions: modular, reusable actions that agents can call to interact with your Elasticsearch data. Skills are higher-level capabilities that coordinate tools into domain-specific workflows. To learn more, refer to Skills.

Tools enable agents to work with Elasticsearch data. When an agent receives a natural language query, it does the following:

  1. Analyzes the semantic intent of the request
  2. Selects appropriate tools from its available toolset
  3. Maps the request parameters to tool input parameters
  4. Executes the tools in sequence as needed
  5. Processes the structured output data

Each tool is an atomic operation with a defined signature. Tools accept typed parameters and return structured results in a format the agent can parse, transform, and incorporate into its response generation.

Note

Tool execution and result processing consume tokens. To understand how usage is calculated, refer to Token usage in Elastic Agent Builder.

Elastic Agent Builder ships with a comprehensive set of built-in tools that provide core capabilities for working with your Elasticsearch data. These tools are ready to use. They cannot be modified or deleted.

Built-in tools serve as building blocks for more complex interactions and provide the foundation for agent capabilities.

For the complete list, refer to Built-in tools reference.

Every agent also has HTTP API tools for calling Elasticsearch and Kibana APIs. These tools don't appear on the Tools page.

Note

Some built-in skills also include inline tools that are only available while that skill is active and are not listed in the tools reference. For details, refer to Built-in skills reference.

You can extend the built-in tool catalog with your own custom tool definitions. To learn how to create and manage custom tools, refer to Custom tools.

You can view, organize, and manage tools from the Tools page in Kibana or programmatically using the Tools API.

Access the Tools page from Manage components at the bottom of the left sidebar, or from Customize > Tools > Manage all tools on an agent's page.

Access the Tools page from the key actions menu in the Agent Chat UI.

The Tools page lists each tool by ID and description. Use the search bar or filter by labels to find specific tools. Built-in tools are marked with a lock icon (🔒).

Tools landing page showing the list of available tools with their descriptions and actions

The Tools page also includes a Manage MCP dropdown (for MCP server configuration and bulk imports) and a Manage agents link for quick navigation to the global agents list.

Custom tools can be modified or removed as needed:

  1. From the Tools page, find the tool you want to modify.
  2. Select the edit icon to update the tool or the delete icon to remove it.
  3. For updates, modify the tool properties and save your changes.
Note

Built-in tools cannot be modified or deleted.

For a quick overview of how to work programmatically with tools, refer to Tools API.

Direct tool calls through the Tools API are not subject to Elastic Agent Builder human-in-the-loop confirmation.

For the complete API reference, refer to the Kibana API reference.

Tools can also be accessed through the Model Context Protocol (MCP) server, which provides a standardized interface for external clients to use Agent Builder tools.

On the Tools page, open the Manage MCP dropdown to access:

  • Copy MCP Server URL: Copy the current space's MCP server URL to configure external clients.
  • Bulk import MCP tools: Import multiple tools from an MCP server at once.
  • Documentation: Open the MCP documentation.
Manage MCP dropdown showing Copy MCP Server URL, Bulk import MCP tools, and Documentation options

If you connect with OAuth, use the MCP server URL shown in your OAuth client's details instead.

To copy the MCP server URL, open the MCP Server dropdown on the Tools page (Elastic Stack 9.2) or the Manage MCP dropdown (Elastic Stack 9.3), then select Copy MCP Server URL.

Important

Copy MCP Server URL doesn't include the space ID. Refer to the known issue.

For detailed MCP server configuration, refer to MCP server.