Gemini-driven agent that drives the official Splunk MCP Server (Splunkbase App #7931) to answer natural-language questions about Splunk data.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"splunkguard-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# splunkguard-mcp [](https://pypi.org/project/splunkguard-mcp/) [](LICENSE) [](https://splunkbase.splunk.com/app/7931) > A small Gemini-driven agent that drives the **official Splunk MCP Server** ([Splunkbase App #7931](https://splunkbase.splunk.com/app/7931)) to answer natural-language questions about your Splunk data. Ask *"What CI pipelines failed last night and why?"* or *"Are there auth anomalies in the last 24 hours?"* and get back a typed `SplunkInvestigationReport` with root cause, failure category, time range, affected components, and paste-ready SPL recommendations. Extracted from the [SplunkGuard hackathon project](https://github.com/64johnlee/hackathon-pipeline-guard) and packaged so other agents can use the same Splunk-MCP-over-Streamable-HTTP plumbing without dragging in the rest of that codebase. --- ## Why this library exists The Splunk MCP Server App is great but two things tripped us up when integrating it from Python: 1. **Transport mismatch.** App #7931 v1.1.0 uses the **modern MCP Streamable HTTP transport** (per the MCP 2025-06-18 spec), not the older SSE transport. If you reach for `mcp.client.sse.sse_client` (the obvious one), you'll get **HTTP 405 Method Not Allowed** because Splunk's `/services/mcp` only accepts POST. You need `mcp.client.streamable_http.streamablehttp_client`. 2. **Self-signed cert handling.** Local Splunk dev instances use self-signed TLS. The MCP SDK doesn't auto-honor an `ssl.SSLContext` you hand it — you need to inject a custom `httpx_client_factory` into the transport. We wire that for you. This library handles both correctly out of the box. --- ## Install ```bash pip install splunkguard-mcp # once published; for now: pip install git+https://github.com/64johnlee/splunkguard-mcp ``` Python ≥ …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.