# Splunk Mcp

> PoC: Splunk Enterprise + Splunk MCP Server in Docker. Splunk4Rookies (SA-S4R) sample data, multi-agent demo, Marp presenter deck. Cursor, Claude Desktop, or Goose via npx mcp-remote; secrets with 1Password or .env.

- **Type:** MCP server
- **Install:** `agentstack add mcp-dd-splunk-splunk-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [dd-Splunk](https://agentstack.voostack.com/s/dd-splunk)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [dd-Splunk](https://github.com/dd-Splunk)
- **Source:** https://github.com/dd-Splunk/splunk-mcp

## Install

```sh
agentstack add mcp-dd-splunk-splunk-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# splunk-mcp

Local **proof-of-concept**: run **Splunk Enterprise** in Docker with the **Splunk MCP Server** app, and connect **Cursor**, **Claude Desktop**, or **Goose** via **`npx mcp-remote`** (Splunk 1.2 canonical config). Includes **Splunk4Rookies** sample data (**`SA-S4R`**) and an optional **Marp presenter deck** in **`demo-slides/`** ([`make marp-preview`](#splunk4rookies-presenter-deck-marp)). Secrets come from the **1Password CLI** (`op` + `tpl.env`) or a git-ignored **`.env`** (no 1Password required).

## First time here? (Presales / SE demo)

1. Read **[docs/PRESALES.md](docs/PRESALES.md)** end-to-end—it is the **demo runbook** (secrets, time budget, Cursor-first steps, checklist, handoff).
2. Copy **`tpl.env.example` → `tpl.env`** and fix every `op://` path, **or** copy **`.env.example` → `.env`** and fill plain values (see PRESALES **Path A / Path B**).
3. Run **`make up`** (updates Claude, Cursor, and Goose configs), restart clients as needed, then **`make verify-mcp-remote`**.

**Presenting the agentic Buttercup demo?** Install [Marp CLI](https://github.com/marp-team/marp-cli), then **`make marp-preview`** or **`make marp-serve`** — see **[Splunk4Rookies presenter deck (Marp)](#splunk4rookies-presenter-deck-marp)** and [demo-slides/README.md](demo-slides/README.md).

Do not block a live meeting on a cold start: **first `make up` can take many minutes** (pulls, Splunk, Splunkbase apps, init).

## What you get

| Endpoint | Use |
| -------- | --- |
| `https://localhost:8000` | Splunk Web |
| `https://localhost:8089/services/mcp` | Splunk MCP Server (`npx mcp-remote` + token in client config only) |

Splunkbase apps (see **`compose.yml`** for IDs, including **Splunk MCP Server**) install at container start. A one-shot init configures MCP for local dev and creates/updates user **`splunker`** (role **`mcp_user`**, capability **`mcp_tool_execute`). **`make up`** waits for **`splunk-init`**, mints tokens, and updates Claude, Cursor, and Goose (tokens stay out of git).

**Not included in init:** a **`claude_logs`** index or file monitors. Optional ingestion is described in [docs/CONFIGURATION.md](docs/CONFIGURATION.md) if you uncomment the bind mount in `compose.yml`.

**Also in this repo:** **`SA-S4R`** Eventgen traffic, multi-agent Cursor prompts (`.cursor/agents/`), and the **Marp slide deck** — [presenter deck (Marp)](#splunk4rookies-presenter-deck-marp) · [docs/s4r/README.md](docs/s4r/README.md).

## Requirements

- Docker with Compose, **`make`**, `bash`, **`curl`**, **`jq`**
- **Secrets:** 1Password + **`tpl.env`** *or* **`.env`** (see [docs/PRESALES.md](docs/PRESALES.md))
- **Node** / **npm** for `npx mcp-remote` (all MCP clients)
- **Splunkbase** account with download rights (used for `SPLUNK_APPS_URL`)

## Quick commands

```bash
make up                      # start stack, update all MCP clients
make status                  # is Splunk answering?
make update-mcp-client MCP_CLIENT=cursor   # one client
make verify-mcp-remote       # verify all clients + Splunk MCP API (default)
make down                    # stop (no op / .env needed)
```

| Command | Purpose |
| ------- | ------- |
| `make help` | All targets |
| `make up` | Compose up, then **`update-mcp-clients`** |
| `make update-mcp-clients` | Update Claude, Cursor, and Goose configs |
| `make update-mcp-client` | One client (`MCP_CLIENT=claude\|cursor\|goose`) |
| `make verify-mcp-remote` | Config check + Splunk MCP `tools/list` (`MCP_VERIFY_CLIENT=all` default) |
| `make clean` | Destructive: volumes + **`.env`** (prompts; no `op` needed) |

## Splunk4Rookies presenter deck (Marp)

Optional **19-slide** deck for the agentic Buttercup demo (`demo-slides/s4r-demo-slides.md`). Not required to run the Splunk stack.

**Dependencies:** [Marp CLI](https://github.com/marp-team/marp-cli) on `PATH` (`npm install -g @marp-team/marp-cli` or `brew install marp-cli`). Live preview/serve loads **Mermaid** from jsDelivr at view time (network needed unless you use exported HTML). Optional in-editor preview: [Marp for VS Code](https://marketplace.visualstudio.com/items?itemName=marp-team.marp-vscode).

```bash
make marp-preview    # preview window
make marp-serve      # http://localhost:8080/
make marp-html       # export demo-slides/s4r-demo-slides.html
```

Presenter script: [demo-slides/S4R-DEMO.md](demo-slides/S4R-DEMO.md). **Build, theme, Mermaid, troubleshooting:** [demo-slides/README.md](demo-slides/README.md).

## Documentation (by audience)

| Doc | Audience |
| --- | -------- |
| **[docs/PRESALES.md](docs/PRESALES.md)** | **SE / presales: demo prep and flow** |
| **[docs/s4r/README.md](docs/s4r/README.md)** | **Splunk4Rookies workshop hub** |
| **[demo-slides/README.md](demo-slides/README.md)** | **Marp deck** (deps, theme, `make marp-*`) |
| [docs/INSTALLATION.md](docs/INSTALLATION.md) | Detailed install and verification |
| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | Architecture and stack flow |
| [docs/CONFIGURATION.md](docs/CONFIGURATION.md) | `compose.yml`, env files, client configs |
| [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Failures: Splunkbase, ports, token, MCP |
| [docs/README.md](docs/README.md) | Full documentation index |
| [AGENTS.md](AGENTS.md) | Contributors and AI agent rules |

## Security

Local development defaults: self-signed TLS, dev-oriented MCP settings, secrets in `op` / `.env`. Do not expose this stack to untrusted networks as-is. See [docs/SECURITY.md](docs/SECURITY.md).

## CI

Pushes/PRs to **`main`** / **`master`**: [`.github/workflows/ci.yml`](.github/workflows/ci.yml) runs **pre-commit** (shellcheck + markdownlint). One-time setup: `pip install pre-commit && pre-commit install`. Check all files: `pre-commit run --all-files`.

## Repository layout (high level)

```text
splunk-mcp/
├── compose.yml                         # Splunk + one-shot init
├── Makefile
├── tpl.env.example / .env.example     # Tracked; copy to tpl.env or .env (gitignored)
├── scripts/                            # compose-up, setup-splunk, mint-mcp-token, mcp-client
├── SA-S4R/                             # Sample app (Eventgen)
├── demo-slides/                        # Marp presenter deck (see demo-slides/README.md)
└── docs/
```

**Behavior:** `Makefile`, `compose.yml`, `scripts/compose-up.sh`, `scripts/setup-splunk.sh`. License: [LICENSE](LICENSE) (MIT).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [dd-Splunk](https://github.com/dd-Splunk)
- **Source:** [dd-Splunk/splunk-mcp](https://github.com/dd-Splunk/splunk-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-dd-splunk-splunk-mcp
- Seller: https://agentstack.voostack.com/s/dd-splunk
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.