Skip to main content
Glama
nks1097

Splunk Enterprise MCP Server

by nks1097

splunk_delete_dashboard

Deletes a Splunk dashboard by name, optionally within an app namespace, requiring write mode and explicit human confirmation.

Instructions

Delete a dashboard (requires write mode and human confirmation).

Args: name: Name of dashboard to delete. app: Optional app namespace. confirm: Confirmation flag.

Input Schema

NameRequiredDescriptionDefault
appNo
nameYes
confirmNo

Output Schema

NameRequiredDescriptionDefault
dataNoOutput payload or results
errorNoError message if execution failed
successNoWhether the tool execution succeeded
metadataNoExecution timing, pagination and environment details
warningsNoOperational warnings or notices
request_idNoCorrelation ID for audit trail and observability

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does disclose two meaningful traits: write mode is required and human confirmation is expected. What it omits matters for a destructive tool — that the deletion is irreversible, what happens if the name does not exist, and whether the delete is scoped to the app namespace or global. Partial disclosure for a destructive operation lands at 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The operative sentence comes first and is followed by a compact, scannable Args list with no filler or marketing language. Minor redundancy in restating parameter names that are already in the schema, but nothing is bloated. Front-loading the destructive nature before the parameters is the right structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the parameter list is fully enumerated. For a three-parameter destructive tool with no annotations, though, the description leaves out irreversibility, error behavior on a missing name, and app-scope semantics — gaps an agent would need filled before calling confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it partly does via an Args block describing all three parameters. But the semantics are thin: "confirmation flag" restates the parameter name without saying it must be true for the call to succeed, and "optional app namespace" does not explain the default scope when omitted. Helpful but not sufficient given zero schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a specific verb and resource ("Delete a dashboard") that unambiguously separates it from siblings like splunk_create_dashboard, splunk_update_dashboard, and splunk_get_dashboard. It also front-loads the two preconditions in the same sentence rather than burying them. It stops short of a 5 because it never names the sibling tool a caller might confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Requires write mode and human confirmation" implicitly tells the agent this is only appropriate for an authenticated, user-sanctioned removal — a real usage constraint. However, there is no explicit guidance on when to delete versus archive or rename via splunk_update_dashboard, and no statement about what to do if the target is the wrong dashboard. Usage is implied, not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools