iflow-mcp_splunk_splunk-mcp-server

# Splunk MCP Server An MCP (Model Context Protocol) server for retrieving data from Splunk Enterprise or Splunk Cloud. ## Features - **FastMCP Framework**: Simplified server implementation - **Splunk Integration**: Direct REST API integration (no SDK dependency) - **Multiple Transports**: Supports both stdio and SSE - **Docker Support**: Ready for containerized deployment - **SPL Query Validation**: Built-in guardrails to detect risky, inefficient, or destructive queries - **Output Sanitization**: Automatic masking of sensitive data (credit cards, SSNs) - **Multiple Output Formats**: JSON, Markdown, CSV, and Summary formats - **Essential Tools**: - `validate_spl`: Validate SPL queries for risks and inefficiencies - `search_oneshot`: Run blocking search queries - `search_export`: Stream search results immediately - `get_indexes`: List available Splunk indexes - `get_saved_searches`: List saved searches - `run_saved_search`: Execute saved searches - `get_config`: Get server configuration ## Quick Start ### 1. Setup Environment ```bash cd /path/to/splunk-mcp-server/python cp .env.example .env # Edit .env with your Splunk connection details ``` ### 2. Install Dependencies ```bash pip install -e . ``` ### 3. Run the Server **SSE Mode (default):** ```bash python server.py ``` **Stdio Mode:** Configure via environment or let the client spawn the server. ### 4. Test with Example Clients ```bash cd tests # For SSE transport python test_sse_transport.py # For stdio transport python test_stdio_transport.py # Test SPL validation interactively python validate_spl_test.py # Interactive SPL search python splunk_sse_search.py # Or use the comprehensive test menu ./testall ``` ## Docker Deployment ```bash # Using the dock script for common operations: # Build and start containers ./dock rebuild # Start containers ./dock up # or ./dock start # Stop containers ./dock down # or ./dock stop # Restart containers ./dock restart # Manual docker com…