{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_5yj9bzkssejy","handle":"splunkguard-mcp","url":"https://wellknown.network/agents/splunkguard-mcp","links":{"self":"https://wellknown.network/agents/splunkguard-mcp/record.json","html":"https://wellknown.network/agents/splunkguard-mcp","markdown":"https://wellknown.network/agents/splunkguard-mcp/record.md","api":"https://wellknown.network/api/v1/agents/splunkguard-mcp","status":"https://wellknown.network/api/v1/agents/splunkguard-mcp/status","claim":"https://wellknown.network/agents/splunkguard-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/splunkguard-mcp/claim.json","badge":"https://wellknown.network/agents/splunkguard-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/splunkguard-mcp/history","tools":"https://wellknown.network/api/v1/agents/splunkguard-mcp/tools"},"ard":{"identifier":"urn:air::server:splunkguard-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"splunkguard-mcp","summary":"Gemini-driven agent that drives the official Splunk MCP Server (Splunkbase App #7931) to answer natural-language questions about Splunk data.","description":"# splunkguard-mcp\n\n[![PyPI](https://img.shields.io/badge/pypi-coming%20soon-lightgrey)](https://pypi.org/project/splunkguard-mcp/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n[![Splunkbase #7931](https://img.shields.io/badge/Splunkbase-%237931-orange)](https://splunkbase.splunk.com/app/7931)\n\n> A small Gemini-driven agent that drives the **official Splunk MCP Server** ([Splunkbase App #7931](https://splunkbase.splunk.com/app/7931)) to answer natural-language questions about your Splunk data.\n\nAsk *\"What CI pipelines failed last night and why?\"* or *\"Are there auth anomalies in the last 24 hours?\"* and get back a typed `SplunkInvestigationReport` with root cause, failure category, time range, affected components, and paste-ready SPL recommendations.\n\nExtracted from the [SplunkGuard hackathon project](https://github.com/64johnlee/hackathon-pipeline-guard) and packaged so other agents can use the same Splunk-MCP-over-Streamable-HTTP plumbing without dragging in the rest of that codebase.\n\n---\n\n## Why this library exists\n\nThe Splunk MCP Server App is great but two things tripped us up when integrating it from Python:\n\n1. **Transport mismatch.** App #7931 v1.1.0 uses the **modern MCP Streamable HTTP transport** (per the MCP 2025-06-18 spec), not the older SSE transport. If you reach for `mcp.client.sse.sse_client` (the obvious one), you'll get **HTTP 405 Method Not Allowed** because Splunk's `/services/mcp` only accepts POST. You need `mcp.client.streamable_http.streamablehttp_client`.\n\n2. **Self-signed cert handling.** Local Splunk dev instances use self-signed TLS. The MCP SDK doesn't auto-honor an `ssl.SSLContext` you hand it — you need to inject a custom `httpx_client_factory` into the transport. We wire that for you.\n\nThis library handles both correctly out of the box.\n\n---\n\n## Install\n\n```bash\npip install splunkguard-mcp        # once published; for now:\npip install git+https://github.com/64johnlee/splunkguard-mcp\n```\n\nPython ≥ …","publisher":null,"homepage":"https://github.com/64johnlee/splunkguard-mcp","repository":"https://github.com/64johnlee/splunkguard-mcp","version":"0.1.0","license":"MIT","protocols":["mcp"],"tags":["agent","gemini","mcp","model-context-protocol","observability","splunk","splunkbase-7931"],"pricing":null,"endpoints":[{"url":"pypi:splunkguard-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":1,"provenance":"declared"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.756,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":0.745,"provenance":"derived"}],"categories":["dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"splunkguard-mcp","registry":"pypi","observedAt":"2026-11-04T01:24:50.521Z","publishedAt":"2026-05-28T01:18:45.189623Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"splunkguard-mcp","url":"https://pypi.org/project/splunkguard-mcp/","firstSeenAt":"2026-09-10T13:19:11.619Z","fetchedAt":"2026-11-04T01:23:17.306Z","normalizedAt":"2026-11-04T01:23:17.306Z"}]},"firstSeenAt":"2026-09-10T13:19:11.619Z","updatedAt":"2026-11-04T01:24:50.521Z"}