MCP Server for Splunk
Related Servers
Alternatives to MCP Server for Splunk
No user-submitted related servers found.
Related Servers
- AlicenseBqualityDmaintenanceEnables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.311Apache 2.0
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Splunk Enterprise and Splunk Cloud instances through standardized MCP interface. Supports executing SPL queries, managing indexes and saved searches, listing applications, and retrieving server information with flexible authentication options.-
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to search, manage, and analyze data in Splunk instances through the Model Context Protocol. Supports SPL queries, index management, alerts, dashboards, and more.55 PyPI1Apache 2.0
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.MIT
- FlicenseAqualityBmaintenanceEnables AI agents to investigate Splunk exports or live queries using deterministic detectors and an iterative analysis loop, all running locally without data leaving the machine.7-
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol server providing 25 tools for search, alerting, KV Store management, and index administration in Splunk Enterprise and Cloud, enabling LLM-powered interaction.MIT
TDQS
Scored across 57 tools
There are large clusters of near-overlapping tools, especially around documentation (discover_splunk_docs, list_available_topics, get_splunk_documentation, list_admin_topics/get_admin_guide, list_troubleshooting_topics/get_troubleshooting_guide) and workflow management (list_workflows, workflow_builder, workflow_requirements, get_executed_workflows). Search execution also has three similar entry points (run_splunk_search, run_oneshot_search, execute_saved_search), making tool selection error-prone.
Most tools follow a clear list/get/create/update/delete/run prefix pattern with snake_case, so the overall convention is predictable. Minor deviations like 'me', 'workflow_builder', 'workflow_requirements', 'sentry_test', and 'user_agent_info' break the verb_noun pattern but are a small minority.
With 57 tools, this server is far beyond the 16-25 heavy range and crosses the 50+ extreme threshold. The sheer number makes discovery and selection difficult, especially when many tools serve documentation or workflow meta-purposes rather than core Splunk operations.
Search, saved search, and alert lifecycles are well covered, but other claimed areas are incomplete: dashboards can be created/list/retrieved but not deleted, KV store collections can be created/list/read but not written to or deleted, and lookups, indexes, and users are mostly read-only. These gaps will cause agent dead ends in administrative workflows.