MCP for Splunk: open-source Splunk MCP server

An open-source Splunk MCP server (Model Context Protocol) that lets AI assistants and agents search, explore and manage Splunk Enterprise and Splunk Cloud Platform.

Python integrations: see the package namespace migration guide.

mcp-for-splunk exposes Splunk's REST API as MCP tools, resources and prompts. Any MCP-compatible client, such as Cursor, Claude Desktop, VS Code or your own agent, can run SPL, discover indexes and sourcetypes, read configuration, manage saved searches, alerts, dashboards and KV Store, and look up Splunk and CIM documentation. It runs over stdio or Streamable HTTP. In HTTP mode, each request can carry its own Splunk credentials in headers, so one server can serve several users or Splunk environments.

• 📖 Setup guide and tools reference: deslicer.ai/docs/integrations/splunk-mcp
• ⚖️ How it compares with Splunk's own MCP Server app: deslicer.ai/compare/splunk-mcp-server
• 📦 PyPI: mcp-server-for-splunk · ITSI companion: mcp-itsi-server

Looking for Splunk's vendor-supported MCP server? That's the Splunk MCP Server app on Splunkbase (app 7931), which runs inside Splunk at /services/mcp. This project is a separate, community-maintained server that runs outside Splunk and talks to the management port (8089).

Contents

• Quickstart
• Configuration
• Connect a client
• Tools
• Resources and prompts
• ITSI MCP server
• Run with Docker
• Optional: Sentry and OpenTelemetry
• Contributing
• License

Quickstart

Requirements: Python 3.11+ (Python 3.10 is no longer supported), uv or pip, and a Splunk Enterprise or Splunk Cloud Platform instance with REST API (port 8089) access. Docker is optional.

Option A: install from PyPI

pip install mcp-server-for-splunk          # or: uv tool install mcp-server-for-splunk

export SPLUNK_HOST=your-splunk.example.com
export SPLUNK_PORT=8089
export SPLUNK_TOKEN=<splunk-bearer-token>  # or SPLUNK_USERNAME + SPLUNK_PASSWORD

mcp-server --transport stdio               # for desktop clients that spawn the server
mcp-server                                 # Streamable HTTP on http://localhost:8001/mcp/

The installed mcp-server command accepts --transport {http,stdio}, --host and --port. The HTTP port defaults to MCP_SERVER_PORT or 8001.

Option B: run from a source checkout

git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk
cp env.example .env                        # then edit the Splunk settings

./scripts/smart-install.sh --dry-run       # macOS/Linux: preview missing prerequisites
./scripts/smart-install.sh                 # install them (Python, uv, Git, Node)

uv run mcp-server --local --detached       # start the server (checkout default port 8003)
uv run mcp-server --test                   # verify; add --detailed for tools/resources
uv run mcp-server --stop                   # stop this project's services

On Windows, use the same uv run mcp-server … commands from PowerShell (see scripts/build_and_run.ps1 and the Windows guide). In a checkout, mcp-server asks whether to run the full Docker stack or a local process. The local endpoint is http://localhost:8003/mcp/.

Configuration

Copy env.example to .env. The main variables:

For stdio clients, you can also pass MCP_SPLUNK_HOST, MCP_SPLUNK_PORT, MCP_SPLUNK_USERNAME, MCP_SPLUNK_PASSWORD, MCP_SPLUNK_TOKEN, MCP_SPLUNK_SCHEME and MCP_SPLUNK_VERIFY_SSL in the client's env block.

Connect a client

stdio (Cursor, Claude Desktop, VS Code and similar)

{
  "mcpServers": {
    "splunk": {
      "command": "mcp-server",
      "args": ["--transport", "stdio"],
      "env": {
        "MCP_SPLUNK_HOST": "your-splunk.example.com",
        "MCP_SPLUNK_PORT": "8089",
        "MCP_SPLUNK_TOKEN": "<splunk-bearer-token>",
        "MCP_SPLUNK_VERIFY_SSL": "true"
      }
    }
  }
}

Streamable HTTP with per-request credentials

Start the server once, then let each client send its own Splunk target in headers:

{
  "mcpServers": {
    "splunk-http": {
      "url": "http://localhost:8001/mcp/",
      "headers": {
        "X-Splunk-Host": "your-splunk.example.com",
        "X-Splunk-Port": "8089",
        "X-Splunk-Scheme": "https",
        "X-Splunk-Token": "<splunk-bearer-token>",
        "X-Splunk-Verify-SSL": "true"
      }
    }
  }
}

Supported headers: X-Splunk-Host, X-Splunk-Port, X-Splunk-Scheme, X-Splunk-Token, X-Splunk-Username, X-Splunk-Password, X-Splunk-Session-Token, X-Splunk-Verify-SSL, X-Splunk-Web-Url, X-Splunk-Web-Port, X-Splunk-Web-Locale, X-MCP-Toolsets. Sessionless mode is the default. Send a stable X-Session-ID if you want config cached across requests. See HTTP client connection modes. If you run from a checkout, use port 8003.

Tools

The core server registers these tools (source: src/mcp_server_for_splunk/tools/). Tools that write to Splunk are marked ✏️. Your Splunk role's permissions still apply.

Workflow JSON definitions are for discovery, validation and external orchestration. The built-in workflow_runner was removed with the move to FastMCP 4 / MCP SDK v2. See the workflows guide and the tools reference.

Resources and prompts

• Resources: Splunk documentation (splunk-docs://…, including SPL reference, troubleshooting and admin topics), configuration specs (splunk-spec://{config}), CIM data models, Dashboard Studio docs and embedded docs. See docs/reference/resources.md.
• Prompts: mcp_overview, workflow_creation_guide, tool_usage_guide.
• llms.txt: a guide for LLMs on using this server.

ITSI MCP server

A server for Splunk IT Service Intelligence lives in mcp_itsi/ and is published as mcp-itsi-server. Run it as a plugin of this server (pip install "mcp-server-for-splunk[itsi]", enabled per client with X-MCP-Toolsets: splunk,itsi or MCP_DEFAULT_TOOLSETS) or standalone (pip install mcp-itsi-server). It uses the same X-Splunk-* headers. See the ITSI getting started guide.

Run with Docker

docker-compose.yml runs the MCP server behind Traefik on http://localhost:8003/mcp, together with the MCP Inspector. docker-compose-splunk.yml adds a Splunk container (so1) for local testing; bring your own Splunk license if you need one. See the deployment guide.

Optional: Sentry and OpenTelemetry

• pip install "mcp-server-for-splunk[sentry]" and set SENTRY_DSN. See Sentry monitoring.
• pip install "mcp-server-for-splunk[otel]" and set OTEL_EXPORTER_OTLP_ENDPOINT. See OpenTelemetry tracing.

Contributing

uv run generate-tool     # scaffold a new tool
uv run validate-tools    # validate tool implementations

See CONTRIBUTING.md, contrib/README.md, AGENTS.md, the Code of Conduct, the Security policy and Governance. Questions and bugs go to GitHub Issues.

About

Maintained by Deslicer. Deslicer uses this server in its product, where it's documented at deslicer.ai/docs/integrations/splunk-mcp. Splunk is a trademark of Splunk LLC; this project is not affiliated with or endorsed by Splunk.

License

Apache 2.0