Splunk MCP Server: Setup, Tokens and Which Tools to Allow (Nov 2026)

The Splunk MCP server is Splunk's official app (Splunkbase 7931). Install it on a search head, and Claude, Cursor or any MCP client can run SPL searches and read indexes and alerts, with each person using their own encrypted token.

TrustedMCP grades it A. Every check gets full marks except maintenance, which is one band lower because the app is closed source. The current version is 2.1.0, released October 23, 2026. Splunkbase lists it as "Splunk Supported" for Splunk Enterprise and Splunk Cloud.

Don't confuse it with splunk/splunk-mcp-server2 on GitHub. That repo calls itself "Unofficial" and hasn't been updated since June 2025.

Splunk MCP tools: what the server can do

The built-in tools all start with splunk_. Splunk turns them on by default.

• Search: splunk_run_query runs an SPL search (SPL2 too, with an @spl2 prefix, since 1.3.0). splunk_run_saved_search runs a saved search.
• Find your data: splunk_get_indexes, splunk_get_index_info, splunk_get_metadata, splunk_get_sourcetypes, splunk_get_kv_store_collections, splunk_get_knowledge_objects and splunk_get_info.
• Users: splunk_get_user_info and splunk_get_user_list.
• Alerts: list alerts and fired alerts, read their details and results, check throttles and alert actions, and find "silent" alerts that stopped firing. Fired-alert results, alert-action status and silent alerts arrived in 2.1.0.

Two more groups need other Splunk products. The saia_ tools (write, explain and tune SPL) need Splunk AI Assistant. The o11y_ tools read APM, metrics and alerts from Splunk Observability Cloud.

Splunk adds guardrails to splunk_run_query. A search that runs longer than a minute or returns more than 1,000 events can fail. Searches with commands Splunk deems unsafe or destructive might not run. The rest command is read-only: it can reach only Splunk's own /services/ paths, and POST and DELETE are blocked.

Connect Claude Code, Cursor or Claude Desktop

All clients use streamable HTTP over HTTPS. After you create a token, the app shows the endpoint URL: your Splunk Web address on port 443. Older setups that use the /services/mcp path on the management port (8089 by default) keep working if that port is reachable.

With an encrypted token (any client)

This is Splunk's own config. It works in Claude Desktop's claude_desktop_config.json and any client that reads the same format. The mcp-remote npm package acts as a local bridge and adds your token to each request.

{
  "mcpServers": {
    "splunk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<MCP_SERVER_ENDPOINT>",
        "--header",
        "Authorization: Bearer <YOUR_ENCRYPTED_TOKEN>"
      ]
    }
  }
}

Splunk's docs also show a second version with "NODE_TLS_REJECT_UNAUTHORIZED": "0" for self-signed test certificates. That setting turns off certificate checks for the whole bridge. Don't keep it: Splunk itself says "Do not use self-signed certificates in production environments."

With OAuth (Splunk Cloud)

OAuth sign-in is for Splunk Cloud customers on MCP Server 1.2 or later. Your admin creates an OAuth client in Splunk and gives you a client ID, a client secret and the callback port. Splunk's command for Claude Code:

claude mcp add --transport http \
  --callback-port <callback-port> \
  --client-id <client-id> \
  --client-secret \
  splunk-mcp <mcp-endpoint>

--client-secret with no value makes Claude Code ask for the secret, so it doesn't land in your shell history. Claude Code has no flag for scopes, so add "scopes": "openid offline_access" to the server's oauth block in ~/.claude.json. Without it you get "Query argument scope is required."

For Cursor, Splunk's docs give this entry for mcp.json:

"splunk-mcp-server": {
  "url": "<MCP endpoint>",
  "auth": {
    "CLIENT_ID": "<Client ID>",
    "CLIENT_SECRET": "<Client Secret>",
    "scopes": ["openid", "offline_access"]
  }
}

Splunk lists Claude Code and Cursor as working with OAuth, and Claude.ai, VS Code and Codex as not compatible. Codex needs dynamic client registration, which Splunk's OAuth doesn't support. For Claude Desktop, use the token config above.

More on client setup: Claude Code MCP setup and streamable HTTP.

How Splunk MCP tokens work

Since 2.1.0, people can create and manage their own tokens. Here is what Splunk's docs say about them:

• They only work for MCP. Tokens are encrypted, and Splunk says they "cannot be used for direct Splunk API calls."
• They expire. You pick 30, 60, 90 or 120 days, or a custom period.
• You can cut one off at once. "Deleting the token immediately invalidates it." People manage their own tokens; admins can manage anyone's.
• There's a cap. A non-admin can hold up to three tokens.
• They act as you. Searches run under your Splunk session, so the agent sees the indexes and data your roles can see, and nothing more.

Our advice: one token per client or agent, with the shortest expiry you can live with. Then one leaked token is one small problem, and your Splunk logs show which agent did what. MCP audit logs covers what else to record.

Which roles and tools to allow

Because tools act as the person who connects, the safest setup starts with a role built for agent use. These are our suggestions, not Splunk defaults:

Who	Capabilities	Tools to map to the role
Agent or analyst role	mcp_tool_execute, mcp_edit_tokens_own, edit_tokens_own, plus search access to only the indexes it needs	the "find your data" tools and splunk_run_query
Alert triage role	the same	add the alert tools
Admins only	mcp_tool_admin	user tools, custom tools, settings and everyone's tokens

Three things to know when you map tools:

• An empty role list means everyone. If you save a tool with no roles, every user with mcp_tool_execute can use it.
• Admins can't be limited per tool. Roles with mcp_tool_admin get every tool, so never connect an agent as an admin.
• Results leave Splunk. Whatever a tool returns goes into the model's context, and from there to your AI provider. Keep indexes with secrets or personal data out of the agent's role.

Admins can also set the tool timeout, the default row limit, a global rate limit and which custom SPL commands may run. A rate limit is cheap insurance against an agent stuck in a loop. For the wider picture, see MCP security best practices and prompt injection.

Three past advisories, all fixed

Splunk has published three advisories for the app. Each fix shipped before the advisory came out.

CVE	Severity	What it was	Fixed in	Published
CVE-2026-20205	High	Users with _internal index access or mcp_tool_admin could read other users' session and authorization tokens in clear text	1.0.3	2026-04-15
CVE-2026-76404	Critical	A user with the admin role could run commands on the server's operating system	1.2.1	2026-08-19
CVE-2026-76286	Medium	A custom API tool could send the token of the user who ran it to the URL set for that tool	1.2.1	2026-10-07

Run 1.2.1 or later; 2.1.0 is current. Two of the three needed admin-level access, which is one more reason to keep admin roles away from agents. The third is a reason to review every custom API tool before you turn it on.

Why it grades A

• Sign-in: full marks. Tokens are per person, work only for MCP, expire and can be revoked. Tools need a capability, and admins can limit each one by role.
• Maintenance: one band lower. Splunk shipped at least ten dated releases in 2026, but the app is closed source, so we can't check its code or commits.
• Advisories: full marks. All three were fixed before they were published.
• Transport: full marks. HTTPS only, with search guardrails on the server.

How the checks work: how TrustedMCP scores servers. The full record is on the Splunk MCP Server listing.

Want an agent that works with your Splunk data your way, or an MCP server for an internal system? Tell us what you're building.

Frequently asked questions

What is the Splunk MCP server?

It's Splunk's own app that adds an MCP endpoint to Splunk Enterprise or Splunk Cloud. AI clients connect to it to run SPL searches and read indexes, metadata and alerts, using each person's own token and Splunk roles.

Is the Splunk MCP server on GitHub?

No. The official app ships only through Splunkbase (app 7931) under the Splunk General Terms, and its code isn't public. splunk/splunk-mcp-server2 on GitHub is a separate project that calls itself "Unofficial" and was last updated in June 2025.

Does the Splunk MCP server work with Splunk Cloud?

Yes. Splunkbase lists Splunk Enterprise and Splunk Cloud, versions 9.3 through 10.7. On Splunk Cloud you also need to allowlist the IP address your client connects from. OAuth sign-in is only available on Splunk Cloud.

Does the Splunk MCP server support OAuth?

Yes, on Splunk Cloud with MCP Server 1.2 or later. It uses the OAuth 2.1 authorization code flow with PKCE. It doesn't support dynamic client registration, so an admin has to create the OAuth client first. Limit the scopes to openid offline_access.

What tools does the Splunk MCP server have?

The built-in tools all start with splunk_: splunk_run_query and splunk_run_saved_search for searches, index and metadata tools such as splunk_get_indexes, user tools, and alert tools. saia_ tools need Splunk AI Assistant, and o11y_ tools need Splunk Observability Cloud. Admins can limit each tool by role.

Can the agent change or delete data in Splunk?

The built-in Splunk tools search and read. Splunk's guardrails stop some unsafe or destructive commands, and rest calls are read-only. Splunk doesn't mark every tool as read-only, though. Treat saved searches and custom tools as able to do whatever they were built to do, and keep tool approval on in your client.