{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_vtb9uen3vmyg","handle":"iflow-mcp-splunk-splunk-mcp-server","url":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server","links":{"self":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server/record.json","html":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server","markdown":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server/record.md","api":"https://wellknown.network/api/v1/agents/iflow-mcp-splunk-splunk-mcp-server","status":"https://wellknown.network/api/v1/agents/iflow-mcp-splunk-splunk-mcp-server/status","claim":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server/claim.json","badge":"https://wellknown.network/agents/iflow-mcp-splunk-splunk-mcp-server/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/iflow-mcp-splunk-splunk-mcp-server/history","tools":"https://wellknown.network/api/v1/agents/iflow-mcp-splunk-splunk-mcp-server/tools"},"ard":{"identifier":"urn:air::server:iflow-mcp-splunk-splunk-mcp-server","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"iflow-mcp_splunk_splunk-mcp-server","summary":"MCP server for retrieving data from Splunk","description":"# Splunk MCP Server\n\nAn MCP (Model Context Protocol) server for retrieving data from Splunk Enterprise or Splunk Cloud.\n\n## Features\n\n- **FastMCP Framework**: Simplified server implementation\n- **Splunk Integration**: Direct REST API integration (no SDK dependency)\n- **Multiple Transports**: Supports both stdio and SSE\n- **Docker Support**: Ready for containerized deployment\n- **SPL Query Validation**: Built-in guardrails to detect risky, inefficient, or destructive queries\n- **Output Sanitization**: Automatic masking of sensitive data (credit cards, SSNs)\n- **Multiple Output Formats**: JSON, Markdown, CSV, and Summary formats\n- **Essential Tools**:\n  - `validate_spl`: Validate SPL queries for risks and inefficiencies\n  - `search_oneshot`: Run blocking search queries\n  - `search_export`: Stream search results immediately\n  - `get_indexes`: List available Splunk indexes\n  - `get_saved_searches`: List saved searches\n  - `run_saved_search`: Execute saved searches\n  - `get_config`: Get server configuration\n\n## Quick Start\n\n### 1. Setup Environment\n\n```bash\ncd /path/to/splunk-mcp-server/python\ncp .env.example .env\n# Edit .env with your Splunk connection details\n```\n\n### 2. Install Dependencies\n\n```bash\npip install -e .\n```\n\n### 3. Run the Server\n\n**SSE Mode (default):**\n```bash\npython server.py\n```\n\n**Stdio Mode:**\nConfigure via environment or let the client spawn the server.\n\n### 4. Test with Example Clients\n\n```bash\ncd tests\n\n# For SSE transport\npython test_sse_transport.py\n\n# For stdio transport\npython test_stdio_transport.py\n\n# Test SPL validation interactively\npython validate_spl_test.py\n\n# Interactive SPL search\npython splunk_sse_search.py\n\n# Or use the comprehensive test menu\n./testall\n```\n\n## Docker Deployment\n\n```bash\n# Using the dock script for common operations:\n\n# Build and start containers\n./dock rebuild\n\n# Start containers\n./dock up   # or ./dock start\n\n# Stop containers\n./dock down # or ./dock stop\n\n# Restart containers\n./dock restart\n\n# Manual docker com…","publisher":null,"homepage":null,"repository":null,"version":"0.1.1","license":null,"protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:iflow-mcp_splunk_splunk-mcp-server","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","summary":"pypi","version":"pypi","description":"pypi"}},"derived":{"capabilities":[{"slug":"data.apis","name":"API Access","confidence":0.871,"provenance":"derived"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.779,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"iflow-mcp_splunk_splunk-mcp-server","registry":"pypi","observedAt":"2026-09-15T20:21:24.100Z","publishedAt":"2026-02-04T04:55:33.356870Z","latestVersion":"0.1.1"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"iflow-mcp_splunk_splunk-mcp-server","url":"https://pypi.org/project/iflow-mcp_splunk_splunk-mcp-server/","firstSeenAt":"2026-09-09T21:24:03.585Z","fetchedAt":"2026-09-15T20:19:46.421Z","normalizedAt":"2026-09-15T20:19:46.421Z"}]},"firstSeenAt":"2026-09-09T21:24:03.585Z","updatedAt":"2026-09-15T20:21:24.100Z"}