Splunk MCP Server
Search and manage Splunk from Pi, Claude Code, and Codex using MCP.
Connection
Install uv, then run one of these Bash examples. Replace localhost with your Splunk hostname.
Token:
export SPLUNK_HOST=localhost
read -rsp 'Splunk token: ' SPLUNK_TOKEN; echo
export SPLUNK_TOKEN
Create a token in Splunk Web: Settings → Tokens → New Token.
Or username/password:
export SPLUNK_HOST=localhost
unset SPLUNK_TOKEN
export SPLUNK_USERNAME=your-username
read -rsp 'Splunk password: ' SPLUNK_PASSWORD; echo
export SPLUNK_PASSWORD
Launch your client from the same terminal. Restart it if it is already running.
Installation
Pi
pi mcp add splunk -- uvx mcp-server-splunk@latest
pi mcp list
pi
Claude Code
claude mcp add --transport stdio --scope user splunk -- uvx mcp-server-splunk@latest
claude mcp list
claude
Codex
Add to ~/.codex/config.toml:
[mcp_servers.splunk]
command = "uvx"
args = ["mcp-server-splunk@latest"]
env_vars = [
"SPLUNK_HOST", "SPLUNK_PORT", "SPLUNK_SCHEME",
"SPLUNK_TOKEN", "SPLUNK_USERNAME", "SPLUNK_PASSWORD",
]
codex mcp list
codex
Configuration
| Variable | Default | Purpose |
|---|---|---|
SPLUNK_HOST |
localhost |
Splunk hostname, without scheme or port |
SPLUNK_PORT |
8089 |
Management API port |
SPLUNK_SCHEME |
https |
http or https |
SPLUNK_TOKEN |
— | Authentication token |
SPLUNK_USERNAME |
— | Username when not using a token |
SPLUNK_PASSWORD |
— | Password when not using a token |
Use a token or username/password. A token takes precedence if both are set. The server does not load .env files automatically.
Tools
91 tools cover searches, indexes, alerts, saved searches, dashboards, lookups, macros, KV Store, inputs, users, roles, apps, and server administration. See tool definitions for parameters and behavior.
Some tools modify or delete Splunk resources. Use an account with only the permissions you need.
Development
With connection variables set as above:
git clone https://github.com/pahar0/mcp-server-splunk.git
cd mcp-server-splunk
uv sync
uv run mcp-server-splunk
License
1 maintainer
Metadata
1 maintainer
Release files for mcp-server-splunk 0.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| mcp_server_splunk-0.3.0.tar.gz | 31.4 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| mcp_server_splunk-0.3.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 57.7 kB
Release files / mcp_server_splunk-0.3.0.tar.gz
| Download URL | mcp_server_splunk-0.3.0.tar.gz |
|---|---|
| Size | 31.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8e319cbdbd9715e6687ba22e39cb06ef0c8531f58b79f2f1b1b4a32cfc2342ef
|
|
BLAKE2b-256 checksum How to use checksums |
1ada9c51ebfcf120bc96c8376e73d85afa528edb55b2877fb21bcdf7b9f40dad
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / mcp_server_splunk-0.3.0-py3-none-any.whl
| Download URL | mcp_server_splunk-0.3.0-py3-none-any.whl |
|---|---|
| Size | 26.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
805189baf2c52aa1aa3e562e51d80d75c6aa3aa11d5df55c3627cc217c57d9cf
|
|
BLAKE2b-256 checksum How to use checksums |
f56906e83a410611452ea211f4a3e48bf1d5f63f418a51f6204d0c76cb54ed6a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for mcp-server-splunk 0.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for mcp_server_splunk-0.3.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
