{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:27:53.457Z",
  "record_id": "VXI-EXT-TOOL-TRUST-ELASTIC-01-v1",
  "record_kind": "external_reference",
  "title": "Elastic MCP: Space scope and shared identity",
  "system": "Elastic Agent Builder MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can an agent assume a shared search connector isolates each user's permissions and project data?",
  "near_questions": [
    "Does a shared search API key isolate each user's permissions?",
    "Which Kibana space does an Elastic MCP connection use?",
    "Can Elastic MCP search linked projects?",
    "Is Elastic MCP OAuth available for every deployment type?",
    "Do Elastic API keys and OAuth use the same identity model?",
    "What privileges does an Elastic Agent Builder key need?",
    "Should an Elastic MCP key be restricted to specific indices?",
    "Does the Elastic MCP catalog include workflow tools?",
    "Is Elastic's MCP server the same as its external-tool connector?",
    "What should be checked before sharing an Elastic connector?",
    "What does a saved Elastic access review preserve?",
    "Does this profile inspect my cross-project search settings?"
  ],
  "supported_claims": [
    {
      "claim": "Elastic distinguishes shared API-key identity from per-user OAuth connections, with OAuth documented for Serverless projects. MCP access also depends on the Kibana space in the endpoint and its cross-project search scope. Restrict keys to intended indices and application privileges; a successful connection is not proof of per-user isolation or single-project coverage.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "Elastic distinguishes shared API-key identity from per-user OAuth connections, with OAuth documented for Serverless projects. MCP access also depends on the Kibana space in the endpoint and its cross-project search scope. Restrict keys to intended indices and application privileges; a successful connection is not proof of per-user isolation or single-project coverage.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-DATADOG-01-v1",
    "VXI-EXT-TOOL-TRUST-GRAFANA-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Elastic Agent Builder MCP identity and space scope",
    "source_url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-ELASTIC-01-v1",
    "candidate_record_sha256": "9d8a6cde22159b27350b95485231e2f3f18c947b6ab8ff0f3f7155efc31e16de",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Elastic distinguishes shared API-key identity from per-user OAuth connections, with OAuth documented for Serverless projects. MCP access also depends on the Kibana space in the endpoint and its cross-project search scope. Restrict keys to intended indices and application privileges; a successful connection is not proof of per-user isolation or single-project coverage.",
    "required_buyer_context": "Elastic Agent Builder acting as an MCP server for external clients; not its connector for calling external MCP servers. Deployment type, space, linked-project scope, API-key grants, workflow actions and client retention.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Elastic Agent Builder MCP",
      "variant": "Elastic Agent Builder acting as an MCP server for external clients; not its connector for calling external MCP servers."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Elastic publishes Agent Builder; the chosen Stack deployment or Serverless project determines the operating environment.",
        "source_ids": [
          "elastic-main"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Expose Agent Builder tools and search/query capabilities to external clients.",
        "source_ids": [
          "elastic-main"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Queries use authorized data and the space's configured cross-project search scope.",
        "source_ids": [
          "elastic-main",
          "elastic-auth"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "review_inference",
        "statement": "Workflow tools are included, so review configured actions before treating the full catalog as read-only.",
        "source_ids": [
          "elastic-main"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "API keys work for Stack and Serverless; OAuth is documented for Serverless projects.",
        "source_ids": [
          "elastic-main"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Shared keys use one identity. Keys require application privileges and should be restricted to intended indices.",
        "source_ids": [
          "elastic-main",
          "elastic-auth"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Retrieved search data is returned to the external host; selected model recipients remain a separate question.",
        "source_ids": [
          "elastic-main"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "A shared key mistaken for per-user isolation, default space used unintentionally, or linked projects widening search.",
        "source_ids": [
          "elastic-main",
          "elastic-auth"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Deployment type, space, linked-project scope, API-key grants, workflow actions and client retention.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Resolve identity, space and data scope before retrieval; do not claim user isolation for a shared key.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "elastic-main",
        "url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server",
        "final_url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server",
        "title": "Elastic Agent Builder MCP identity and space scope",
        "checked_on": "2026-10-11",
        "sha256": "705a445ad3c5cdb2d5bb8f8b949cda30b5be9223fce4363045d6e4a30e0f841b",
        "bytes": 215599
      },
      {
        "source_id": "elastic-auth",
        "url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server-api-keys",
        "final_url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server-api-keys",
        "title": "Elastic MCP API key restrictions",
        "checked_on": "2026-10-11",
        "sha256": "19259091ebbc493641deb9534b46d4f2df82c7eab4697b8060a84f1363c11c87",
        "bytes": 216668
      },
      {
        "source_id": "elastic-keys",
        "url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/api-keys",
        "final_url": "https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/api-keys",
        "title": "Elastic Agent Builder key privileges",
        "checked_on": "2026-10-11",
        "sha256": "db6dcf5e41f24913f95e245d89966c8a69d08b3a02d6d06c0e8dc79eaeabec5d",
        "bytes": 239696
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Retain the identity, index and space-scope assumptions behind an enterprise-search connector review.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Recheck API-key grants, endpoint space, linked-project search scope and workflow tools after configuration changes."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#elastic-mcp-space-key-trust",
  "machine_readable_record": "/varexis-index/records/elastic-mcp-space-key-trust.json"
}