The repository is read-only and points at the first-party Splunk MCP Server on Splunkbase, which the author says has grown past what this covers. What is here still works as written — search, index and KV store tools over SSE, REST or stdio — but it will not get fixes, so treat it as a reference or a stopgap rather than something to build on.
A FastMCP-based Python server over Splunk Enterprise or Splunk Cloud: searches, index and user inspection, and KV store operations. The repository is archived and read-only, and its author points at the first-party Splunk MCP Server on Splunkbase.
- Splunk searches run from a query, with earliest and latest bounds and a result cap
- Indexes listed, with the detail behind any one of them
- The indexes-and-sourcetypes pairing, for working out where data actually lives
- Saved searches listed, so existing SPL can be reused rather than rewritten
- Users listed, and the identity the connection is authenticating as
- KV store collections listed and created
- A health check and a tool listing, for confirming the connection before relying on it
- Three transports from one entry point: SSE by default, a REST API under /api/v1, and stdio for desktop clients
Python, and credentials for a Splunk Enterprise or Cloud instance; SSL verification is configurable for self-signed setups. Start `python splunk_mcp.py stdio` for desktop MCP clients, `api` for the REST mode, or pass nothing for SSE on `/sse`.