Skip to main content
Glama
nks1097

Splunk Enterprise MCP Server

by nks1097

splunk_validate_configuration

Audit and validate a Splunk configuration file to detect syntax errors and duplicate stanzas before deployment.

Instructions

Audit and validate a configuration file for syntax errors or stanza duplicates.

Args: conf_file: Configuration file name (e.g. 'props', 'transforms', 'inputs').

Input Schema

NameRequiredDescriptionDefault
conf_fileNoprops

Output Schema

NameRequiredDescriptionDefault
dataNoOutput payload or results
errorNoError message if execution failed
successNoWhether the tool execution succeeded
metadataNoExecution timing, pagination and environment details
warningsNoOperational warnings or notices
request_idNoCorrelation ID for audit trail and observability

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. 'Audit and validate' implies a read-only check, which is useful, but it doesn't say whether the operation touches the live file, which app/context it reads from, how it behaves when the file is missing, or how errors are surfaced. An output schema exists, so return shape is covered elsewhere.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded single purpose sentence followed by a compact Args block; nothing is wasted. The Args formatting is slightly ceremonial for a single parameter but not harmful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Return values are covered by the output schema, but the description leaves gaps around app/namespace scoping and permission requirements for a validation tool in a large sibling set. Adequate, not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema only supplies a default of 'props', so the description adds real value by naming the param and giving concrete examples ('props', 'transforms', 'inputs'). It still doesn't state whether arbitrary/custom conf names are accepted or what the valid universe is.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Audit and validate a configuration file') and even names the failure modes it checks for (syntax errors, stanza duplicates). It is distinguishable from the read-oriented siblings splunk_get_configuration and splunk_list_configurations, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intent (pre-flight validation of a conf file) is implied by 'audit and validate', but there is no explicit when-to-use, when-not-to-use, or pointer to the neighbouring get/list configuration tools. An agent must infer the workflow context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools