Splunk MCP (Model Context Protocol) Tool

A FastMCP-based tool for interacting with Splunk Enterprise/Cloud through natural language. This tool provides a set of capabilities for searching Splunk data, managing KV stores, and accessing Splunk resources through an intuitive interface.

Operating Modes

The tool operates in three modes:

1. SSE Mode (Default)

   • Server-Sent Events based communication
   • Real-time bidirectional interaction
   • Suitable for web-based MCP clients
   • Default mode when no arguments provided
   • Access via /sse endpoint

2. API Mode

   • RESTful API endpoints
   • Access via /api/v1 endpoint prefix
   • Start with python splunk_mcp.py api

3. STDIO Mode

   • Standard input/output based communication
   • Compatible with Claude Desktop and other MCP clients
   • Ideal for direct integration with AI assistants
   • Start with python splunk_mcp.py stdio

Features

• Splunk Search: Execute Splunk searches with natural language queries
• Index Management: List and inspect Splunk indexes
• User Management: View and manage Splunk users
• KV Store Operations: Create, list, and manage KV store collections
• Async Support: Built with async/await patterns for better performance
• Detailed Logging: Comprehensive logging with emoji indicators for better visibility
• SSL Configuration: Flexible SSL verification options for different security requirements
• Enhanced Debugging: Detailed connection and error logging for troubleshooting
• Comprehensive Testing: Unit tests covering all major functionality
• Error Handling: Robust error handling with appropriate status codes
• SSE Compliance: Fully compliant with MCP SSE specification

Available MCP Tools

The following tools are available via the MCP interface:

Tools Management

• list_tools
  • Lists all available MCP tools with their descriptions and parameters

Health Check

• health_check
  • Returns a list of available Splunk apps to verify connectivity
• ping
  • Simple ping endpoint to verify MCP server is alive

User Management

• current_user
  • Returns information about the currently authenticated user
• list_users
  • Returns a list of all users and their roles

Index Management

• list_indexes
  • Returns a list of all accessible Splunk indexes
• get_index_info
  • Returns detailed information about a specific index
  • Parameters: index_name (string)
• indexes_and_sourcetypes
  • Returns a comprehensive list of indexes and their sourcetypes

Search

• search_splunk
  • Executes a Splunk search query
  • Parameters:
    • search_query (string): Splunk search string
    • earliest_time (string, optional): Start time for search window
    • latest_time (string, optional): End time for search window
    • max_results (integer, optional): Maximum number of results to return
• list_saved_searches
  • Returns a list of saved searches in the Splunk instance

KV Store

• list_kvstore_collections
  • Lists all KV store collections
• create_kvstore_collection
  • Creates a new KV store collection
  • Parameters: collection_name (string)
• delete_kvstore_collection
  • Deletes an existing KV store collection
  • Parameters: collection_name (string)

SSE Endpoints

When running in SSE mode, the following endpoints are available:

• /sse: Returns SSE connection information in text/event-stream format

  • Provides metadata about the SSE connection
  • Includes URL for the messages endpoint
  • Provides protocol and capability information

• /sse/messages: The main SSE stream endpoint

  • Streams system events like heartbeats
  • Maintains persistent connection
  • Sends properly formatted SSE events

• /sse/health: Health check endpoint for SSE mode

  • Returns status and version information in SSE format

Error Handling

The MCP implementation includes consistent error handling:

• Invalid search com

... View full README on GitHub