Splunk MCP Server

The Splunk MCP Server is the official Model Context Protocol implementation maintained by Cisco DevNet (Splunk) and distributed as a Splunk app on Splunkbase (App ID 7931). Unlike typical stdio-based MCP servers, it runs as an HTTP/SSE endpoint hosted directly inside your Splunk instance on the management port (default 8089) at /services/mcp, so all access stays within your existing Splunk security boundary.

The server gives AI agents a standardized way to interact with Splunk Enterprise and Splunk Cloud deployments. Capabilities include running raw SPL searches, generating SPL from natural language via Splunk's AI Assistant, listing and inspecting indexes, retrieving instance metadata, and reading saved searches and other knowledge objects. All tool calls are gated by Splunk's existing role-based access control through new MCP capabilities (mcp_tool_admin, mcp_tool_execute) configured in authorize.conf.

Notable features include token-based bearer authentication, audit logging, input validation, guardrails against destructive operations, and support for Splunk versions 8.0 through 10.2. As of v1.0.1 (February 2026) the app is published as a Splunk Supported Beta.

Tools

Prerequisites

• Splunk Enterprise or Splunk Cloud Platform, version 8.0 to 10.2
• Admin access to install a Splunkbase app and edit authorize.conf / mcp.conf
• A Splunk auth token for the user that will call the MCP server

Install the Splunk app

Install Splunkbase app ID 7931 ("Splunk MCP Server") on your Splunk instance. The MCP endpoint will be served at https://<SPLUNK_HOST>:8089/services/mcp.

Configure RBAC

Grant MCP capabilities to a role in authorize.conf:

[role_mcp_user]
mcp_tool_admin = enabled
mcp_tool_execute = enabled

The sc_admin role manages MCP settings. For self-signed certs, set ssl_verify = false in mcp.conf.

Claude Desktop / Claude Code

{
  "mcpServers": {
    "splunk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<SPLUNK_HOST>:8089/services/mcp",
        "--header",
        "Authorization: Bearer <YOUR_TOKEN>"
      ],
      "env": { "NODE_TLS_REJECT_UNAUTHORIZED": "0" }
    }
  }
}

Cursor IDE

{
  "mcpServers": {
    "splunk-mcp-server": {
      "url": "https://<SPLUNK_HOST>:8089/services/mcp",
      "headers": { "Authorization": "Bearer <YOUR_TOKEN>" }
    }
  }
}

Replace <SPLUNK_HOST> with your Splunk management host and <YOUR_TOKEN> with a Splunk bearer token. Drop NODE_TLS_REJECT_UNAUTHORIZED if you use a publicly trusted certificate.

• Let an AI assistant translate plain English questions like "errors in the last hour by host" into valid SPL and run them against production indexes.
• Triage security alerts by asking an agent to search relevant indexes, summarize findings, and propose follow-up SPL queries.
• Inventory and audit a Splunk deployment by listing indexes, getting index sizing or retention metadata, and enumerating saved searches.
• Build agent workflows that pull saved-search results into reports or other systems while respecting Splunk RBAC.
• Help SOC analysts and SREs iterate on SPL faster by generating, refining, and executing queries through a chat interface.

• "Generate an SPL query that finds failed SSH logins grouped by source IP in the last 24 hours, then run it."
• "List all indexes on this Splunk instance and show retention and event count for the security index."
• "Show me the saved searches owned by the SOC app and summarize what each one does."
• "Search the web index for 5xx responses in the last hour and break them down by URL."
• "What version of Splunk am I connected to and which indexes are available?"

• Official implementation maintained by Cisco DevNet (Splunk) and distributed through Splunkbase.
• Runs inside your Splunk instance with native RBAC, audit logging, and bearer-token auth, so no extra middleware is required.
• Includes AI-powered natural-language-to-SPL generation via Splunk's built-in AI Assistant.
• Works with both Splunk Enterprise and Splunk Cloud Platform across versions 8.0 to 10.2.

• Currently published as a Supported Beta, so behavior and tool surface may still change.
• Tool set is focused on read and search workflows; there is no broad write/admin coverage of Splunk objects.
• Self-signed Splunk certs commonly require disabling TLS verification on the client, which is not ideal for production.

• deslicer/mcp-for-splunk: community MCP server for Splunk Enterprise.
• livehybrid/splunk-mcp: community MCP implementation focused on Cursor and Claude integration.
• splunk/splunk-mcp-server2: unofficial Splunk-authored Python/TypeScript MCP with stdio, SSE, and Docker transports.