{
  "workflow": {
    "id": 5273,
    "name": "🛠️ Elastic Security Tool MCP Server 💪 all 14 operations",
    "views": 270,
    "recentViews": 0,
    "totalViews": 270,
    "createdAt": "2025-06-25T00:02:14.719Z",
    "description": "Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator?\n\n[Join the community](https://www.skool.com/beyond-nodes-automation-lab-2006/about)\n\nComplete MCP server exposing all Elastic Security Tool operations to AI agents. Zero configuration needed - all 14 operations pre-built.\n\n## ⚡ Quick Setup\n\n1. **Import** this workflow into your n8n instance\n2. **Activate** the workflow to start your MCP server\n3. **Copy** the webhook URL from the MCP trigger node\n4. **Connect** AI agents using the MCP URL\n\n## 🔧 How it Works\n\n• **MCP Trigger**: Serves as your server endpoint for AI agent requests\n• **Tool Nodes**: Pre-configured for every Elastic Security Tool operation\n• **AI Expressions**: Automatically populate parameters via `$fromAI()` placeholders\n• **Native Integration**: Uses official n8n Elastic Security Tool tool with full error handling\n\n## 📋 Available Operations (14 total)\n\nEvery possible Elastic Security Tool operation is included:\n\n### 🔧 Case (6 operations)\n\n• **Create a case**\n• **Delete a case**\n• **Get a case**\n• **Get many cases**\n• **Get the status of a case**\n• **Update a case**\n\n### 🔧 Casecomment (5 operations)\n\n• **Add a comment to a case**\n• **Get a case comment**\n• **Get many case comments**\n• **Remove a comment from a case**\n• **Update a comment from a case**\n\n### 🔧 Casetag (2 operations)\n\n• **Add a tag to a case**\n• **Remove a tag from a case**\n\n### 🔧 Connector (1 operations)\n\n• **Create a connector**\n\n## 🤖 AI Integration\n\n**Parameter Handling**: AI agents automatically provide values for:\n• Resource IDs and identifiers\n• Search queries and filters\n• Content and data payloads\n• Configuration options\n\n**Response Format**: Native Elastic Security Tool API responses with full data structure\n\n**Error Handling**: Built-in n8n error management and retry logic\n\n## 💡 Usage Examples\n\nConnect this MCP server to any AI agent or workflow:\n\n• **Claude Desktop**: Add MCP server URL to configuration\n• **Custom AI Apps**: Use MCP URL as tool endpoint\n• **Other n8n Workflows**: Call MCP tools from any workflow\n• **API Integration**: Direct HTTP calls to MCP endpoints\n\n## ✨ Benefits\n\n• **Complete Coverage**: Every Elastic Security Tool operation available\n• **Zero Setup**: No parameter mapping or configuration needed\n• **AI-Ready**: Built-in `$fromAI()` expressions for all parameters\n• **Production Ready**: Native n8n error handling and logging\n• **Extensible**: Easily modify or add custom logic\n\n> 🆓 **[Free for community use](https://github.com/Cfomodz/community-use)!** Ready to deploy in under 2 minutes.",
    "workflow": {
      "id": "dFReuElL2jc30U30",
      "meta": null,
      "name": "Elastic Security Tool MCP Server",
      "tags": [],
      "nodes": [
        {
          "id": "1b0b689c-17f5-4977-b86f-a90daedd772d",
          "name": "Workflow Overview 0",
          "type": "n8n-nodes-base.stickyNote",
          "position": [
            -1460,
            -120
          ],
          "parameters": {
            "content": ""
          },
          "typeVersion": 1
        },
        {
          "id": "64989c15-3897-4859-8b0f-5762fdaf83cb",
          "name": "Elastic Security Tool MCP Server",
          "type": "@n8n/n8n-nodes-langchain.mcpTrigger",
          "position": [
            -420,
            -120
          ],
          "webhookId": "c9275187-da72-4758-a63d-35bcff0ec77b",
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "0e16069f-2dc4-42f8-9855-3ff9146ad953",
          "name": "Create a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -800,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "e48eb579-d2e8-4090-b4b4-2728e77fa91a",
          "name": "Delete a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -580,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "6fd50cad-007d-4337-8ae9-c6ca78a39450",
          "name": "Get a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -360,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "7534fe88-8241-40ec-810c-87c0825b6914",
          "name": "Get many cases",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -140,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "5af9f3cd-fd95-4b13-b9b4-28b8d5731d6d",
          "name": "Get the status of a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            80,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "3cc61d64-4c3d-4d1d-9b7c-a583fae80d01",
          "name": "Update a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            300,
            140
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "cf296e2a-42d4-4de5-b8f7-4172c98c123e",
          "name": "Sticky Note 1",
          "type": "n8n-nodes-base.stickyNote",
          "position": [
            -1000,
            120
          ],
          "parameters": {
            "content": ""
          },
          "typeVersion": 1
        },
        {
          "id": "f7811ca0-1b6e-463f-abcd-e726745ce07d",
          "name": "Add a comment to a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -800,
            380
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "3778af46-cc85-4275-bea8-bcc032ea455f",
          "name": "Get a case comment",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -580,
            380
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "98c14244-0e87-4557-b11a-7b6e780c6769",
          "name": "Get many case comments",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -360,
            380
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "69a31bc4-19a9-4282-948f-c7d65e097580",
          "name": "Remove a comment from a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -140,
            380
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "a9f394ae-a4f8-440e-b309-1bc386a5399e",
          "name": "Update a comment from a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            80,
            380
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "bac4b9d6-2e1a-4eaf-b53b-f8d47a426ac6",
          "name": "Sticky Note 2",
          "type": "n8n-nodes-base.stickyNote",
          "position": [
            -1000,
            360
          ],
          "parameters": {
            "content": ""
          },
          "typeVersion": 1
        },
        {
          "id": "15e7f9e4-d13a-49b3-a3d2-18fbcfed0236",
          "name": "Add a tag to a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -800,
            620
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "64837681-76a4-4dd8-8166-925a521c2d25",
          "name": "Remove a tag from a case",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -580,
            620
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "3c3fa1e3-959a-4246-a5f3-b9fe6936ce26",
          "name": "Sticky Note 3",
          "type": "n8n-nodes-base.stickyNote",
          "position": [
            -1000,
            600
          ],
          "parameters": {
            "content": ""
          },
          "typeVersion": 1
        },
        {
          "id": "b002f6c8-fe33-4565-844e-125a00fba7ef",
          "name": "Create a connector",
          "type": "n8n-nodes-base.elasticSecurityTool",
          "position": [
            -800,
            -100
          ],
          "parameters": {},
          "typeVersion": 1
        },
        {
          "id": "e746bf71-bb84-4835-9ccd-59012efafb95",
          "name": "Sticky Note 4",
          "type": "n8n-nodes-base.stickyNote",
          "position": [
            -1000,
            -120
          ],
          "parameters": {
            "content": ""
          },
          "typeVersion": 1
        }
      ],
      "active": false,
      "shared": [
        {
          "role": "workflow:owner",
          "project": {
            "id": "G5fce9xGuBAsWBXe",
            "icon": null,
            "name": "David Ashby <david.ashby.lds@gmail.com>",
            "type": "personal",
            "createdAt": "2025-06-04T02:55:02.013Z",
            "updatedAt": "2025-06-04T02:56:01.361Z",
            "projectRelations": [
              {
                "role": "project:personalOwner",
                "user": {
                  "id": "715c1c00-cb48-4712-9a32-f1f4b6db2b30",
                  "role": "global:owner",
                  "email": "david.ashby.lds@gmail.com",
                  "disabled": false,
                  "lastName": "Ashby",
                  "settings": {
                    "npsSurvey": {
                      "responded": true,
                      "lastShownAt": 1749357655581
                    },
                    "userActivated": true,
                    "userActivatedAt": 1749075994495,
                    "easyAIWorkflowOnboarded": true,
                    "firstSuccessfulWorkflowId": "3N3vVikZb3MckFYm"
                  },
                  "createdAt": "2025-06-04T02:55:01.745Z",
                  "firstName": "David",
                  "isPending": false,
                  "updatedAt": "2025-06-08T04:40:58.399Z",
                  "mfaEnabled": false,
                  "personalizationAnswers": {
                    "version": "v4",
                    "personalization_survey_n8n_version": "1.95.3",
                    "personalization_survey_submitted_at": "2025-06-04T02:56:07.075Z"
                  }
                },
                "userId": "715c1c00-cb48-4712-9a32-f1f4b6db2b30",
                "createdAt": "2025-06-04T02:55:02.013Z",
                "projectId": "G5fce9xGuBAsWBXe",
                "updatedAt": "2025-06-04T02:55:02.013Z"
              }
            ]
          },
          "createdAt": "2025-06-25T00:00:27.162Z",
          "projectId": "G5fce9xGuBAsWBXe",
          "updatedAt": "2025-06-25T00:00:27.162Z",
          "workflowId": "dFReuElL2jc30U30"
        }
      ],
      "pinData": {},
      "settings": {
        "timezone": "America/New_York"
      },
      "createdAt": "2025-06-25T00:00:27.161Z",
      "updatedAt": "2025-06-25T00:01:46.000Z",
      "versionId": "7caa2666-d3f8-412b-8bd7-520690f20e00",
      "isArchived": false,
      "staticData": null,
      "connections": {
        "Get a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Create a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Delete a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Update a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Get many cases": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Create a connector": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Get a case comment": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Add a tag to a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Get many case comments": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Add a comment to a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Get the status of a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Remove a tag from a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Remove a comment from a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        },
        "Update a comment from a case": {
          "ai_tool": [
            [
              {
                "node": "Elastic Security Tool MCP Server",
                "type": "ai_tool",
                "index": 0
              }
            ]
          ]
        }
      },
      "triggerCount": 0
    },
    "lastUpdatedBy": 29,
    "workflowInfo": {
      "nodeCount": 20,
      "nodeTypes": {
        "n8n-nodes-base.stickyNote": {
          "count": 5
        },
        "n8n-nodes-base.elasticSecurityTool": {
          "count": 14
        },
        "@n8n/n8n-nodes-langchain.mcpTrigger": {
          "count": 1
        }
      }
    },
    "status": "published",
    "user": {
      "name": "David Ashby",
      "username": "cfomodz",
      "bio": "Unlimited Access to my paid workflows 👇 For the cost of one a month",
      "verified": true,
      "links": [
        "https://www.skool.com/n8n-automation-lab"
      ],
      "avatar": "https://gravatar.com/avatar/0118796cfdab829a3307d407dfeeb01a3952eb402584a45a211e4ef7d15edbbf?r=pg&d=retro&size=200"
    },
    "nodes": [
      {
        "id": 565,
        "icon": "fa:sticky-note",
        "name": "n8n-nodes-base.stickyNote",
        "codex": {
          "data": {
            "alias": [
              "Comments",
              "Notes",
              "Sticky"
            ],
            "categories": [
              "Core Nodes"
            ],
            "nodeVersion": "1.0",
            "codexVersion": "1.0",
            "subcategories": {
              "Core Nodes": [
                "Helpers"
              ]
            }
          }
        },
        "group": "[\"input\"]",
        "defaults": {
          "name": "Sticky Note",
          "color": "#FFD233"
        },
        "iconData": {
          "icon": "sticky-note",
          "type": "icon"
        },
        "displayName": "Sticky Note",
        "typeVersion": 1,
        "nodeCategories": [
          {
            "id": 9,
            "name": "Core Nodes"
          }
        ]
      },
      {
        "id": 1293,
        "icon": "file:../mcp.svg",
        "name": "@n8n/n8n-nodes-langchain.mcpTrigger",
        "codex": {
          "data": {
            "alias": [
              "Model Context Protocol",
              "MCP Server"
            ],
            "resources": {
              "primaryDocumentation": [
                {
                  "url": "https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger/"
                }
              ]
            },
            "categories": [
              "AI",
              "Core Nodes",
              "Langchain"
            ],
            "subcategories": {
              "AI": [
                "Root Nodes",
                "Model Context Protocol"
              ],
              "Core Nodes": [
                "Other Trigger Nodes"
              ]
            }
          }
        },
        "group": "[\"trigger\"]",
        "defaults": {
          "name": "MCP Server Trigger"
        },
        "iconData": {
          "type": "file",
          "fileBuffer": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTgwIiBoZWlnaHQ9IjE4MCIgdmlld0JveD0iMCAwIDE5NSAxOTUiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+Cgk8ZyBzdHJva2U9IiMwMDAiIHN0cm9rZS13aWR0aD0iMTIiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCI+CgkJPHBhdGggZD0iTTI1IDk3Ljg1MjhMOTIuODgyMyAyOS45NzA2QzEwMi4yNTUgMjAuNTk4IDExNy40NTEgMjAuNTk4IDEyNi44MjMgMjkuOTcwNlYyOS45NzA2QzEzNi4xOTYgMzkuMzQzMSAxMzYuMTk2IDU0LjUzOTEgMTI2LjgyMyA2My45MTE3TDc1LjU1ODEgMTE1LjE3NyIvPgoJCTxwYXRoIGQ9Ik03Ni4yNjUzIDExNC40N0wxMjYuODIzIDYzLjkxMTdDMTM2LjE5NiA1NC41MzkxIDE1MS4zOTIgNTQuNTM5MSAxNjAuNzY1IDYzLjkxMTdMMTYxLjExOCA2NC4yNjUyQzE3MC40OTEgNzMuNjM3OCAxNzAuNDkxIDg4LjgzMzggMTYxLjExOCA5OC4yMDYzTDk5LjcyNDggMTU5LjZDOTYuNjAwNiAxNjIuNzI0IDk2LjYwMDYgMTY3Ljc4OSA5OS43MjQ4IDE3MC45MTNMMTEyLjMzMSAxODMuNTIiLz4KCQk8cGF0aCBkPSJNMTA5Ljg1MyA0Ni45NDExTDU5LjY0ODIgOTcuMTQ1N0M1MC4yNzU3IDEwNi41MTggNTAuMjc1NyAxMjEuNzE0IDU5LjY0ODIgMTMxLjA4N1YxMzEuMDg3QzY5LjAyMDggMTQwLjQ1OSA4NC4yMTY4IDE0MC40NTkgOTMuNTg5NCAxMzEuMDg3TDE0My43OTQgODAuODgyMiIvPgoJPC9nPgo8L3N2Zz4K"
        },
        "displayName": "MCP Server Trigger",
        "typeVersion": 2,
        "nodeCategories": [
          {
            "id": 9,
            "name": "Core Nodes"
          },
          {
            "id": 25,
            "name": "AI"
          },
          {
            "id": 26,
            "name": "Langchain"
          }
        ]
      }
    ],
    "categories": [
      {
        "id": 29,
        "name": "SecOps"
      },
      {
        "id": 48,
        "name": "AI RAG"
      }
    ],
    "image": []
  }
}