Splunk MCP

The MCP Server for Splunk Platform is Splunk's own connector between an MCP client and a Splunk Cloud or Enterprise deployment. It lets an assistant run Search Processing Language queries over a chosen time range and read the results back as structured data, instead of exporting a dashboard or writing a one-off script against the REST API. Beyond running searches, the server helps an agent work out what to search in the first place. It can list indexes and sourcetypes, describe the fields available in them, and look up saved searches, reports and other knowledge objects already defined in the deployment. Authentication uses a Splunk token, so results are scoped to the permissions of that account: an agent cannot read an index the user could not open in Splunk itself. It is distributed through Splunkbase and runs against the live platform rather than a copy of the data. The audience is SOC analysts, SREs and platform teams who already work in SPL. Typical uses include triaging an alert by asking for the matching events, drafting and refining a search without memorizing syntax, and confirming which indexes or sourcetypes carry a given field before writing a detection rule.