No user-submitted related servers found.
Scored across 100 tools
The tool set has many overlapping areas: synchronous, async, streaming, exported, previewed, and saved-search execution tools all coexist, as do composite diagnostics and their granular component tools. Descriptions and predictable names help, but an agent can easily choose the wrong search, alert, report, or investigation tool among the roughly 100 options.
Almost every tool uses the splunk_ prefix and snake_case, with mostly verb_noun patterns such as splunk_get_saved_search, splunk_create_index, and splunk_detect_brute_force. Minor deviations appear in noun-oriented names like splunk_search_status and splunk_index_stats, and some overloaded verbs like manage are broader than others.
A total of 100 tools is an extreme mismatch for a single MCP surface, far beyond the typical 3-15 well-scoped range. Although Splunk is a broad platform, exposing nearly every operation as a separate tool creates a high cognitive and selection burden.
Coverage is unusually broad: search lifecycle, saved searches, alerts, indexes, dashboards, users, roles, apps, ingestion diagnostics, security investigations, performance, and audit are all represented. Some lifecycle gaps remain, such as creating or modifying inputs/configuration, installing apps, and lookup or data model management, but most core workflows are covered.