MCP for Splunk: open-source Splunk MCP server
An open-source Splunk MCP server (Model Context Protocol) that lets AI assistants and agents search, explore and manage Splunk Enterprise and Splunk Cloud Platform.
Python integrations: see the package namespace migration guide.
mcp-for-splunk exposes Splunk's REST API as MCP tools, resources and prompts. Any MCP-compatible client, such as Cursor, Claude Desktop, VS Code or your own agent, can run SPL, discover indexes and sourcetypes, read configuration, manage saved searches, alerts, dashboards and KV Store, and look up Splunk and CIM documentation. It runs over stdio or Streamable HTTP. In HTTP mode, each request can carry its own Splunk credentials in headers, so one server can serve several users or Splunk environments.
Looking for Splunk's vendor-supported MCP server? That's the Splunk MCP Server app on Splunkbase (app 7931), which runs inside Splunk at /services/mcp. This project is a separate, community-maintained server that runs outside Splunk and talks to the management port (8089).
Contents
Quickstart
Requirements: Python 3.11+ (Python 3.10 is no longer supported), uv or pip, and a Splunk Enterprise or Splunk Cloud Platform instance with REST API (port 8089) access. Docker is optional.
Option A: install from PyPI
pip install mcp-server-for-splunk # or: uv tool install mcp-server-for-splunk
export SPLUNK_HOST=your-splunk.example.com
export SPLUNK_PORT=8089
export SPLUNK_TOKEN=<splunk-bearer-token> # or SPLUNK_USERNAME + SPLUNK_PASSWORD
mcp-server --transport stdio # for desktop clients that spawn the server
mcp-server # Streamable HTTP on http://localhost:8001/mcp/
The installed mcp-server command accepts --transport {http,stdio}, --host and --port. The HTTP port defaults to MCP_SERVER_PORT or 8001.
Option B: run from a source checkout
git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk
cp env.example .env # then edit the Splunk settings
./scripts/smart-install.sh --dry-run # macOS/Linux: preview missing prerequisites
./scripts/smart-install.sh # install them (Python, uv, Git, Node)
uv run mcp-server --local --detached # start the server (checkout default port 8003)
uv run mcp-server --test # verify; add --detailed for tools/resources
uv run mcp-server --stop # stop this project's services
On Windows, use the same uv run mcp-server … commands from PowerShell (see scripts/build_and_run.ps1 and the Windows guide). In a checkout, mcp-server asks whether to run the full Docker stack or a local process. The local endpoint is http://localhost:8003/mcp/.
Configuration
Copy env.example to .env. The main variables:
| Variable | Purpose | Default |
|---|
SPLUNK_HOST, SPLUNK_PORT | Splunk management endpoint | 8089 port |
SPLUNK_SCHEME | https or http | |
SPLUNK_TOKEN | Bearer token; takes precedence over username/password | |
SPLUNK_USERNAME, SPLUNK_PASSWORD | Basic credentials | |
SPLUNK_SESSION_TOKEN | Existing splunkd session token (advanced) | |
SPLUNK_VERIFY_SSL | TLS verification. The client defaults to true when this is unset. env.example sets false for local labs with self-signed certs | true when unset |
SPLUNK_WEB_URL / SPLUNK_WEB_PORT / SPLUNK_WEB_LOCALE | Used to build links to dashboards and jobs | |
MCP_SERVER_HOST, MCP_SERVER_PORT | HTTP bind address | 0.0.0.0, 8001 (installed) / 8003 (checkout) |
MCP_STATELESS_HTTP, MCP_JSON_RESPONSE | Stateless HTTP and JSON responses for wider client compatibility | true in env.example |
MCP_DEFAULT_TOOLSETS | Toolsets for clients that send no X-MCP-Toolsets header (splunk, splunk,itsi, all) | splunk |
MCP_SEARCH_WAIT_SECONDS | How long run_splunk_search / run_oneshot_search wait before returning | 15 |
MCP_AUTH_DISABLED, MCP_AUTH_PROVIDER | Inbound MCP authentication | |
MCP_LOG_LEVEL | Log level | INFO |
For stdio clients, you can also pass MCP_SPLUNK_HOST, MCP_SPLUNK_PORT, MCP_SPLUNK_USERNAME, MCP_SPLUNK_PASSWORD, MCP_SPLUNK_TOKEN, MCP_SPLUNK_SCHEME and MCP_SPLUNK_VERIFY_SSL in the client's env block.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
