elastic/mcp-server-elasticsearch

AI review

The extension itself is a legitimate Elasticsearch MCP server with no hidden instructions or data exfiltration mechanisms. The only finding is a remote code execution risk in the contributing documentation, which suggests running a curl-piped-to-shell command for local development setup.

• medium Remote code execution risk in contributing guide — docs/CONTRIBUTING.md line 38 contains `curl -fsSL https://elastic.co/start-local | sh`, which downloads and executes a script directly from the internet. While this is a common convenience pattern for Elastic's official start-local tool, it violates security best practices and could be exploited if the URL is compromised or redirected. Developers following these instructions may unknowingly execute malicious code.

Model: deepseek-chat

Static findings