Skip to main content
Glama
nks1097

Splunk Enterprise MCP Server

by nks1097

splunk_list_forwarders

Lists connected Universal and Heavy Forwarders in the indexing pipeline to verify which forwarders are reporting data.

Instructions

List connected Universal and Heavy Forwarders observed in the indexing pipeline.

Args: count: Maximum number of forwarders.

Input Schema

NameRequiredDescriptionDefault
countNo

Output Schema

NameRequiredDescriptionDefault
dataNoOutput payload or results
errorNoError message if execution failed
successNoWhether the tool execution succeeded
metadataNoExecution timing, pagination and environment details
warningsNoOperational warnings or notices
request_idNoCorrelation ID for audit trail and observability

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. 'List' implies a read-only operation, and 'connected' plus 'observed in the indexing pipeline' narrows the scope, but it does not state required permissions, whether disconnected forwarders are excluded, or pagination behavior beyond the optional count limit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences plus a compact Args line, with the core purpose front-loaded and no redundant phrasing. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one optional parameter and an output schema, the description covers the core purpose and parameter meaning adequately. However, with no annotations and no usage guidance relative to the many sibling forwarder/status tools, it leaves some context for correct tool selection unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate for the single 'count' parameter. It does so by defining count as 'Maximum number of forwarders,' which clarifies that it is a result limit rather than an offset or filter; it omits the default of 100, but that is already present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('Universal and Heavy Forwarders') and scopes it to forwarders 'observed in the indexing pipeline.' It distinguishes the tool from status/connectivity siblings implicitly by focusing on inventory, though it does not name those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as splunk_get_forwarder_status or splunk_check_forwarder_connectivity. The description gives no when-not conditions or prerequisites, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools