Elastic Cloud Serverless agent skills for Claude Code, Cursor and RevampKey

5 ready-made playbooks that teach an AI agent how to do real Elastic Cloud Serverless work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Elastic Cloud Serverless

Connect Elastic Cloud Serverless once and all 5 skills install themselves and stay up to date. Mac, Windows and Linux.

All 5 Elastic Cloud Serverless skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing21 Elastic Cloud Serverless tools

Use Elastic Cloud Serverless through the Agent Builder MCP server

Connects your AI assistant to Elastic Agent Builder tools, confirms the space and authentication path first, and asks for your explicit approval before any workflow runs or resumes.

Use it when

You connect Elastic Cloud Serverless to Claude Desktop or Cursor and want to know it is set up right.
An answer looks empty or wrong and you suspect the wrong Kibana space or identity.
You want to query data safely without starting workflows you have not reviewed.

Tools it uses

platform_core_list_indices
platform_core_index_explorer
platform_core_get_index_mapping
platform_core_search
platform_core_get_document_by_id
platform_core_generate_esql
platform_core_execute_esql
platform_workflows_get_workflow
platform_workflows_get_examples
platform_workflows_get_step_definitions
platform_workflows_get_trigger_definitions
platform_workflows_get_connectors
platform_core_generate_workflow
platform_workflows_validate_workflow
platform_core_list_workflow_executions
platform_core_get_workflow_execution_status
platform_core_execute_workflow
platform_workflows_workflow_execute_step
platform_core_resume_workflow_execution
platform_core_product_documentation
platform_core_list_inference_endpoints

Example

Connect to my Elastic Cloud Serverless space and tell me which tool I should use to find the 20 most recent error logs.

You are connected to the default space using an API key. For recent errors I would start by reading the index mapping, then run a bounded search for the last 24 hours and return 20 results. I will not start any workflow without your yes.

Use in RevampKeyRead the full skill →

Asks before writing4 Elastic Cloud Serverless tools

Answer analytical questions with ES|QL

Writes, runs and iterates on ES|QL queries against your Elastic data, checking field types first and reporting the answer with its query and caveats. It asks before running anything that would change data.

Use it when

You need a count, average or top-N over indexed events.
A query returned nothing or an error and you want it diagnosed.
You want a trend over time with the time window stated clearly.

Tools it uses

platform_core_get_index_mapping
platform_core_list_indices
platform_core_generate_esql
platform_core_execute_esql

Example

How many failed logins did we have per day last week, and which day was highest?

Last week had 1,284 failed logins across 7 days. The highest day was Tuesday with 311. I checked that the timestamp and outcome fields are mapped correctly and cross-checked the total with an unfiltered count. Time buckets are in UTC; the query is shown below for rerunning.

Use in RevampKeyRead the full skill →

Read-only5 Elastic Cloud Serverless tools

Search and investigate data in Elastic Cloud Serverless

Finds the indices, fields and documents that answer a question in your Elastic Cloud Serverless project, using read-only searches and checked evidence. It never changes data.

Use it when

You want to know which index holds a particular kind of record
A count or search returns nothing and you need to know why
You need to fetch and verify specific documents behind a finding

Tools it uses

platform_core_index_explorer
platform_core_list_indices
platform_core_get_index_mapping
platform_core_search
platform_core_get_document_by_id

Example

Where are our failed checkout events stored, and how many were there last Tuesday?

Failed checkout events are in the checkout-events index, field status with value failed. Last Tuesday's window returned 214 documents, and I fetched three of them to confirm the status and timestamp match.

Use in RevampKeyRead the full skill →

Read-only8 Elastic Cloud Serverless tools

Design and validate Elastic Workflows with AI

Drafts an Elastic Workflow from your intent, checks every step against the platform's real definitions, validates it, and explains what it will do. It does not save or run anything without your explicit yes.

Use it when

You want to automate a recurring check or data task in Elastic.
You have a workflow idea and want it reviewed before it runs.
You want to know what an existing workflow's design would do.

Tools it uses

platform_workflows_get_trigger_definitions
platform_workflows_get_step_definitions
platform_workflows_get_connectors
platform_workflows_get_examples
platform_workflows_get_workflow
platform_core_list_workflow_executions
platform_core_generate_workflow
platform_workflows_validate_workflow

Example

Draft a workflow that checks for new error logs every hour and posts a summary to our team connector. Validate it and tell me what it would do.

Drafted a three-step workflow triggered on a schedule: query the logs index for errors in the last hour, count them, and post a summary to the team connector. Validation returned no errors and one warning about an unbounded result size, which I kept with a limit. It has not been saved or run; say the word if you want it created.

Use in RevampKeyRead the full skill →

Asks before writing7 Elastic Cloud Serverless tools

Operate Elastic Workflows with AI

Finds recent workflow executions on Elastic Cloud Serverless, explains why a run failed or is paused, and runs or resumes it only after you approve.

Use it when

A scheduled workflow failed overnight and you need to know which step broke
A workflow run has been paused and you want to resume it once the input arrived
You want to re-test one step after fixing an external credential

Tools it uses

platform_workflows_get_workflow
platform_core_list_workflow_executions
platform_workflows_get_trigger_definitions
platform_core_get_workflow_execution_status
platform_core_resume_workflow_execution
platform_workflows_workflow_execute_step
platform_core_execute_workflow

Example

Why did the nightly sync workflow fail last night, and can you re-run just the step that broke?

In the default space, the nightly sync workflow has 4 failed runs in the last 24 hours. The latest failure stopped at the 'send summary' step with a 401 from the mail connector, so the credential is the likely cause rather than the workflow logic. I can run that single step again to test the fixed credential, but it sends an email, so I need your explicit yes first.

Use in RevampKeyRead the full skill →

Get all 5 without copying a file

RevampKey adds the skills when you connect Elastic Cloud Serverless, updates them for you and removes them when you disconnect.

Download RevampKey

How Elastic Cloud Serverless skills work

Connect Elastic Cloud Serverless
The Elastic Cloud Serverless MCP server gives the agent its tools.
Ask in plain words
“How many failed logins did we have per day last week, and which day was highest?” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Elastic Cloud Serverless skills

In RevampKey the skills install themselves when you connect Elastic Cloud Serverless. In other tools each skill is one folder with a SKILL.md file, and you also need the Elastic Cloud Serverless MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Elastic Cloud Serverless. All 5 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “How many failed logins did we have per day last week, and which day was highest?”
Download RevampKeyConnect Elastic Cloud Serverless · 1 click
Get RevampKey to connect Elastic Cloud Serverless
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Elastic Cloud Serverless is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials esql-analysis search-and-investigate-data workflow-authoring workflow-operations; do curl -fsSL --create-dirs -o .claude/skills/elastic-cloud-serverless-$s/SKILL.md https://revampkey.com/marketplace/elastic-cloud-serverless/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Elastic Cloud Serverless MCP server in Claude Code.

Run this in your project folder to add all 5 skills:

for s in essentials esql-analysis search-and-investigate-data workflow-authoring workflow-operations; do
  curl -fsSL --create-dirs -o .claude/skills/elastic-cloud-serverless-$s/SKILL.md https://revampkey.com/marketplace/elastic-cloud-serverless/skills/$s/SKILL.md
done

Ask in plain language, for example “How many failed logins did we have per day last week, and which day was highest?”

Into the shared .agents/skills folder

Connect the Elastic Cloud Serverless MCP server in Cursor.

Run this in your project folder to add all 5 skills:

for s in essentials esql-analysis search-and-investigate-data workflow-authoring workflow-operations; do
  curl -fsSL --create-dirs -o .agents/skills/elastic-cloud-serverless-$s/SKILL.md https://revampkey.com/marketplace/elastic-cloud-serverless/skills/$s/SKILL.md
done

Ask in plain language, for example “How many failed logins did we have per day last week, and which day was highest?”

Into the shared .agents/skills folder

Connect the Elastic Cloud Serverless MCP server in Codex.

Run this in your project folder to add all 5 skills:

for s in essentials esql-analysis search-and-investigate-data workflow-authoring workflow-operations; do
  curl -fsSL --create-dirs -o .agents/skills/elastic-cloud-serverless-$s/SKILL.md https://revampkey.com/marketplace/elastic-cloud-serverless/skills/$s/SKILL.md
done

Ask in plain language, for example “How many failed logins did we have per day last week, and which day was highest?”

Into the shared .agents/skills folder

Connect the Elastic Cloud Serverless MCP server in VS Code.

Run this in your project folder to add all 5 skills:

for s in essentials esql-analysis search-and-investigate-data workflow-authoring workflow-operations; do
  curl -fsSL --create-dirs -o .agents/skills/elastic-cloud-serverless-$s/SKILL.md https://revampkey.com/marketplace/elastic-cloud-serverless/skills/$s/SKILL.md
done

Ask in plain language, for example “How many failed logins did we have per day last week, and which day was highest?”

RevampKey or copy the files?

In RevampKey

One click when you connect Elastic Cloud Serverless
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Elastic Cloud Serverless MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Elastic Cloud Serverless skills FAQ

What is a Elastic Cloud Serverless agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Elastic Cloud Serverless skill describes one job, which Elastic Cloud Serverless tools to use in which order, what to check first and when to stop and ask you.

Do the Elastic Cloud Serverless skills change anything on their own?

2 of the 5 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Elastic Cloud Serverless.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Elastic Cloud Serverless; elsewhere you copy the folders into your project or skills directory.

Do I need the Elastic Cloud Serverless MCP server too?

Yes. The skills tell the agent how to do the work; the Elastic Cloud Serverless MCP server gives it the tools to do it. The Elastic Cloud Serverless MCP setup guide covers every client.

Elastic Cloud Serverless MCP server setup · This page as Markdown

Put Elastic Cloud Serverless’s best workflows in your agent

Download RevampKey, connect Elastic Cloud Serverless and ask your first question in about a minute.

Download RevampKey Connect Elastic Cloud Serverless · 1 click

All 5 Elastic Cloud Serverless skills

Use Elastic Cloud Serverless through the Agent Builder MCP server

Use it when

Tools it uses

Answer analytical questions with ES|QL

Use it when

Tools it uses

Search and investigate data in Elastic Cloud Serverless

Use it when

Tools it uses

Design and validate Elastic Workflows with AI

Use it when

Tools it uses

Operate Elastic Workflows with AI

Use it when

Tools it uses

Get all 5 without copying a file

How Elastic Cloud Serverless skills work

How to install Elastic Cloud Serverless skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Elastic Cloud Serverless skills FAQ

Put Elastic Cloud Serverless’s best workflows in your agent

Skills for related tools