MCP or Not?

Draft: research not yet reviewed. Hidden from search engines and production.

OfficialClaude connector: not verified

Splunk MCP server & Claude connector

Does Splunk have an official MCP server or Claude connector?

Official

As of October 2026, Splunk publishes an official MCP Server for the Splunk platform, documented on help.splunk.com. It runs inside your Splunk Cloud or Enterprise deployment, so the endpoint is yours, and it signs in with OAuth. Splunk's docs list tools that look read-only, and its tool permissions are admin-controlled. No Claude connector was confirmed.

Last checked

Verdict and evidence

What we checked
MCP Server for Splunk platform
Published by
Splunk (official)
Runs
Hosted (remote)
Sign-in
OAuth sign-in
Stage
unknown
Plan
Splunk Cloud Platform (2.0 preinstalled on Cloud 10.6 for eligible customers per Splunk's blog) or Splunk Enterprise via the Splunkbase app. Some saia_ tools need Splunk AI Assistant. Details vary by version.

Evidence

What an AI can do in Splunk

Read

  • List indexessplunk_get_indexes
  • Get index infosplunk_get_index_info
  • List users and rolessplunk_get_user_list
  • Retrieve knowledge objectssplunk_get_knowledge_objects
  • List alertssplunk_list_alerts
  • Generate SPL from natural languagesaia_generate_spl

Run

  • Run SPL or SPL2 searchessplunk_run_query
  • Run a saved search (beta)splunk_run_saved_search

From the publisher’s documentation for the version we checked. Not every tool is listed.

Setup

Claude Code

Placeholders come from your Splunk admin. Paste the client secret when prompted, then sign in via /mcp. To set OAuth scopes (openid offline_access) edit ~/.claude.json since the CLI has no scopes option.

claude mcp add --transport http \
  --callback-port <callback-port> \
  --client-id <client-id> \
  --client-secret \
  splunk-mcp <mcp-endpoint>
Source

Safety check

  • Pass

    Publisher verified

    Documentation on help.splunk.com and an announcement on splunk.com; the server is a Splunk app that runs inside your own Splunk deployment.

  • Pass

    Auth model

    Browser OAuth sign-in per user; scopes openid offline_access; no static credential in client config. Admins issue the client ID, secret and endpoint. Tools run as the calling user so index and knowledge-object permissions apply.

  • Unknown

    Write and delete access

    Docs tool reference lists 33 tools that appear read-only, but it does not explicitly say so; splunk_run_query runs searches with guardrails against unsafe commands, and admins can register custom tools (BYOT) that could do more.

  • Unknown

    Tool-description injection scan

    Only the docs pages were read. Live tool descriptions from a deployed server were not inspected.

  • Unknown

    Repo maintenance

    Distributed as a Splunkbase app, not a public repo. The github.com/splunk/splunk-mcp-server2 repo describes itself as Unofficial and was last pushed 2025-06-16, so it was not used.

FAQ

Does Splunk have an official MCP server?

Yes. Splunk documents an MCP Server for the Splunk platform on help.splunk.com, for Splunk Cloud Platform and Splunk Enterprise.

Is Splunk a Claude connector?

Not confirmed. No Splunk listing was found in Anthropic's directory. Splunk documents connecting Claude Code with OAuth.

Is there a public endpoint URL?

No. The endpoint is specific to your Splunk deployment and your administrator provides it.

Can it change my Splunk data?

Splunk's tool reference lists tools that read, search and explain. Admins control which roles can use each tool.

Which Splunk versions are supported?

It varies by MCP Server version. Splunk's blog says 2.0 comes preinstalled on Splunk Cloud 10.6 for eligible customers; check the docs for Enterprise.

Last reviewed .

Get your badge

Work at Splunk? Show that your MCP server is independently checked. The badge reflects this page: it updates when we re-check, and it links readers to the evidence.

MCP or Not: Official · Checked Oct 2026

Markdown (README)

[![MCP or Not: Official · Checked Oct 2026](https://mcpornot.com/badge/splunk.svg)](https://mcpornot.com/splunk)

HTML

<a href="https://mcpornot.com/splunk"><img src="https://mcpornot.com/badge/splunk.svg" alt="MCP or Not: Official · Checked Oct 2026" height="20"></a>

Compare Splunk

Something changed?

Vendors ship MCP updates often. If Splunk launched, changed or retired a server, tell us and we will re-check it against primary sources. Submit a correction.

New official MCP servers, weekly

One short email when vendors ship, change or retire an official server or Claude connector. Checked against primary sources, like every verdict here.