Splunk MCP

What it does

The Splunk MCP server is Splunk's own Model Context Protocol server for the Splunk platform. It ships as the Splunk MCP Server app on Splunkbase (app 7931, built by Splunk LLC and marked Splunk Supported) and installs on your search head or search head cluster. Once installed, AI clients such as Claude Code and Cursor can run SPL searches, list indexes and metadata, read knowledge objects and alerts, and, with Splunk AI Assistant installed, generate or explain SPL. It works with Splunk Enterprise and Splunk Cloud Platform, and clients connect over Streamable HTTP.

The current release is version 2.0.0 from September 2026, which added six alert tools. Splunkbase lists compatibility with Splunk versions 9.3 through 10.6.

Tools it exposes

Splunk namespaces tools by source: splunk_ for core platform tools, saia_ for Splunk AI Assistant tools and o11y_ for Splunk Observability tools.

• Search: splunk_run_query runs SPL and, from version 1.3, SPL2 with an @spl2 prefix. From version 1.3 it also supports the read-only rest SPL command, so an agent can read Splunk REST endpoints such as users, roles, licenses and inputs through one tool (POST and DELETE are blocked). splunk_run_saved_search runs existing saved searches by name, with optional token values and time range overrides.
• Environment: splunk_get_info, splunk_get_indexes, splunk_get_index_info, splunk_get_metadata (hosts, sources, sourcetypes), splunk_get_kv_store_collections
• Users: splunk_get_user_info, splunk_get_user_list
• Knowledge objects: splunk_get_knowledge_objects for saved searches, alerts, field extractions, lookups, macros, data models, dashboards (views and panels), apps and MLTK models
• Alerts (new in 2.0): splunk_list_alerts, splunk_get_alert_details, splunk_list_fired_alerts, splunk_get_fired_alert_details, splunk_get_alert_throttle, splunk_list_active_throttles
• Splunk AI Assistant (optional): saia_generate_spl, saia_explain_spl, saia_optimize_spl, saia_ask_splunk_question, and saia_find_data_source, which needs Agent Mode and Splunk Enterprise 10.1 or later
• Splunk Observability (through the MCP Gateway): APM services, environments, errors, latency, dependencies and traces, detector alerts and incidents, metric names and metadata, and SignalFlow generation and execution

Admins can also add custom tools from the app's Create Tool screen and turn any tool on or off for the whole deployment.

Setup

1. Admin install. Turn on token authentication (and REST API access on Splunk Cloud Platform), install the Splunk MCP Server app from Splunkbase on the search head, and add the mcp_tool_execute capability to the roles that need access. mcp_tool_admin grants tool management and token creation. From version 1.3, admins can map specific roles to specific tools.

2. Token method (any client that supports Streamable HTTP). Create an encrypted token in the MCP Server app and copy the endpoint and sample configuration it shows. Splunk's sample uses the mcp-remote proxy, which needs Node.js:

{
  "mcpServers": {
    "splunk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<MCP_SERVER_ENDPOINT>",
        "--header",
        "Authorization: Bearer <YOUR_ENCRYPTED_TOKEN>"
      ]
    }
  }
}

Encrypted tokens only work for MCP, not for direct Splunk API calls, and the token is shown only once.

3. OAuth method (Splunk Cloud Platform only). From app version 1.2.1 on Splunk Cloud Platform 10.3.2512.11 or later, an admin creates a Splunk OAuth client with a redirect URI, and users sign in through the browser instead of storing a token. For Claude Code (version 2.1.114 or newer), Splunk documents:

claude mcp add --transport http \
  --callback-port <callback-port> \
  --client-id <client-id> \
  --client-secret \
  splunk-mcp <mcp-endpoint>

You then set "scopes": "openid offline_access" in the splunk-mcp entry of ~/.claude.json, run /mcp and sign in. For Cursor, the redirect URI is cursor://anysphere.cursor-mcp/oauth/callback and the config holds the endpoint, client ID, client secret and the same two scopes. If you use Claude Code with Splunk, it also fits our list of the best MCP servers for Claude Code.

Splunk's OAuth compatibility table marks Claude Code and Cursor as compatible, Claude Desktop as dependent on configuration, and Claude.ai custom connectors, VS Code and Codex as not compatible with its OAuth flow. A Codex compatibility gap is also listed as a known issue in version 2.0.

Permissions and safety

• Guardrails on search. splunk_run_query is meant for quick, safe searches. It can refuse commands Splunk deems unsafe or destructive and fails a guardrail when a search runs longer than one minute or returns more than 1,000 events. Admins can edit the allowed SPL command list.
• Server-side tool control. Disabled tools never load in any client, which Splunk recommends for sensitive tools such as splunk_get_user_info.
• Rate limits. Admins can set a global limit and per-tool limits on a fixed one-minute window. None are set by default, and counting is per node, not across the cluster.
• Workload management. From version 1.3 you can send splunk_run_query to a workload pool so agent searches run as detached jobs.
• Key rotation. One key pair signs all encrypted tokens, so "Invalidate Keys" cuts off every MCP token at once.
• Usage tracking. A Dashboard tab shows how MCP tools consume Splunk Virtual Compute.

Limits

• Splunk Observability tools need the MCP Gateway, which Splunk lists as available only to Splunk Cloud customers in select regions.
• OAuth is for Splunk Cloud Platform customers only. Splunk Enterprise users connect with encrypted tokens.
• Moving from app version 0.2.6 to 1.0.0 was a breaking change that required new encrypted tokens, and the older cloud-hosted endpoint on *.api.scs.splunk.com has a documented migration path to the app.

Who it is for

SREs, security analysts and platform teams who already run Splunk and want an agent to answer questions from logs, check alert state or draft SPL without leaving their editor. Compare it with the Datadog MCP server if you are weighing observability platforms.

Pricing

As of October 2026, the Splunk MCP Server app is distributed on Splunkbase under the Splunk General Terms, and the Splunkbase page lists no separate price. You need a Splunk Enterprise or Splunk Cloud Platform deployment. The saia_ tools need Splunk AI Assistant, and the Observability tools need Splunk Observability.

Alternatives

• Datadog MCP server for Datadog logs, metrics, traces and incidents.
• Grafana MCP server for Grafana dashboards, metrics and alerts.
• Elasticsearch MCP server if your logs live in Elasticsearch.

What we could not verify

• The official MCP Registry did not respond on 2026-10-23, so we could not confirm a registry entry.
• Splunk's release notes give September 2, 2026 for version 2.0.0, while Splunkbase shows September 3, 2026.
• Splunk does not publish the app's source code on GitHub. The CiscoDevNet/Splunk-MCP-Server-official repository only mirrors an older README (version 1.0.1), so we do not treat it as the source.

Sources

• About MCP Server for Splunk platform: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/about-mcp-server-for-splunk-platform
• Set up the Splunk MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/set-up-the-splunk-mcp-server
• Connecting to the MCP Server and settings: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/connecting-to-the-mcp-server-and-settings
• MCP Server tools: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/mcp-server-tools
• OAuth for MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/oauth-for-mcp-server
• Connect Claude to Splunk MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/connect-claude-to-splunk-mcp-server
• Connect Cursor to Splunk MCP Server: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/connect-cursor-to-splunk-mcp-server
• MCP Server rate limiting: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/mcp-server-rate-limiting
• MCP Server release notes: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/mcp-server-release-notes
• MCP Server REST command support: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/mcp-server-rest-command-support
• Run Saved Search: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/run-saved-search
• MCP Server telemetry dashboard: https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/2.0/mcp-server-telemetry-dashboard
• Splunkbase app 7931: https://splunkbase.splunk.com/app/7931