list_toolsLABSCO SUMMARY
No longer maintained — the author recommends Splunk's own MCP server.
The author says the project will no longer receive updates and points at the first-party Splunk MCP Server on Splunkbase, which the author says has grown past what this covers. What is here still works as written — search, index and KV store tools over SSE, REST or stdio — but it will not get fixes, so treat it as a reference or a stopgap rather than something to build on.
What it is
A FastMCP-based Python server over Splunk Enterprise or Splunk Cloud: searches, index and user inspection, and KV store operations. The author has stopped maintaining the project and points at the first-party Splunk MCP Server on Splunkbase.
What you get
- Splunk searches run from a query, with earliest and latest bounds and a result cap
- Indexes listed, with the detail behind any one of them
- The indexes-and-sourcetypes pairing, for working out where data actually lives
- Saved searches listed, so existing SPL can be reused rather than rewritten
- Users listed, and the identity the connection is authenticating as
- KV store collections listed and created
- A health check and a tool listing, for confirming the connection before relying on it
- Three transports from one entry point: SSE by default, a REST API under /api/v1, and stdio for desktop clients
Requirements
Python, and credentials for a Splunk Enterprise or Cloud instance; SSL verification is configurable for self-signed setups. Start python splunk_mcp.py stdio for desktop MCP clients, api for the REST mode, or pass nothing for SSE on /sse.
Setup effort
Build from source — git clone https://github.com/livehybrid/splunk-mcp.git
USE CASES
01
Running a Splunk search from the conversation
Send the query with earliest and latest bounds and a result cap, and read the events back.
02
Working out where the data you want lives
List the indexes, then read the index-and-sourcetype pairing before writing a search.
03
Checking the connection before trusting an answer
Run the health check, read back which user the connection is authenticating as, and list what the server exposes.
04
Reusing what the team already wrote
List the saved searches on the instance instead of rewriting SPL from memory.
05
Setting up a lookup collection
List the KV store collections and create the one you need.
13 tools
Listed in project docs. Your client may show a different list.
health_checkpingcurrent_userlist_userslist_indexesget_index_infoindexes_and_sourcetypessearch_splunklist_saved_searcheslist_kvstore_collectionscreate_kvstore_collectiondelete_kvstore_collectionBEFORE YOU INSTALL
What to know first
Tools you get
13 tools named in the project's documentation. The only writes are create_kvstore_collection and delete_kvstore_collection; the User Management tools only read. The author says the project will no longer receive updates.
Requires
Python 3.10 or later
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
TERMINAL
git clone https://github.com/livehybrid/splunk-mcp.git
cd splunk-mcp
uv syncSet the connection variables in the environment the server runs in: SPLUNK_HOST, SPLUNK_PORT (default 8089), and either SPLUNK_USERNAME with SPLUNK_PASSWORD or SPLUNK_TOKEN, which is used instead of username and password when set. SPLUNK_SCHEME (default https) and VERIFY_SSL (default true) are optional; the repository's .env.example lists them.
TERMINAL
uv run python splunk_mcp.py stdioThat is the stdio mode desktop MCP clients use. The README publishes no client block, so add it in your client's own format, started from this folder with the variables above. Without the stdio argument it starts in SSE mode (the default); with api it serves the REST API.
