Skip to main content
Glama
EverdredIIDX

Splunkbase MCP Server

by EverdredIIDX

splunkbase-mcp

An MCP server for Splunkbase

Description

This is a Machine Control Protocol (MCP) server that provides programmatic access to Splunkbase functionality. It allows you to search, download, and manage Splunkbase apps through a standardized interface.

Related MCP server: Splunk MCP Server

Installation

Warning: this will store your password on-disk in plaintext. Better methods may come about eventually.

uv run mcp install -v "SPLUNKBASE_USERNAME=my_username" -v "SPLUNKBASE_PASSWORD=my_password" splunkbase-mcp.py

Usage

Sample prompt for Claude:

Please do the following.
1. Search the web to find what Splunk app is responsible for providing field extractions for the WinEventLog sourcetype 
2. Find the app on Splunkbase and grab its numerical app ID 
3. Use the download_app tool to grab the latest version of the app from Splunkbase and place it in /tmp/apps/

Resources

  • app://{app}/info - Get detailed information about a Splunkbase app

  • app://{app}/splunk_versions - Get supported Splunk versions for an app

Available Tools

  • search(query: str) - Search Splunkbase for apps

    • Returns a list of search results

Version Management

  • get_app_latest_version(app: str | int, splunk_version: str, is_cloud: bool = False) - Get the latest compatible version of an app

    • Parameters:

      • app: App name or numeric ID

      • splunk_version: Target Splunk version

      • is_cloud: Whether to check Splunk Cloud compatibility

    • Returns version information dictionary

Download

  • download_app(app: str | int, output_dir: str, version: Optional[str] = None) - Download a specific app version

    • Parameters:

      • app: App name or numeric ID

      • output_dir: Directory to save the downloaded app

      • version: Optional specific version to download (latest if not specified)

    • Returns success message with download details

Dependencies

  • aiosplunkbase >= 0.1.3

  • mcp[cli]

  • aiofiles

  • Python >= 3.11

Available Tools

3 tools
download_appB
Download a specific version of an app. If no version is specified, downloads the latest.

Args:
    app: The name or numeric ID of the Splunkbase app
    output_dir: Directory to save the downloaded app
    version: Optional specific version to download

Returns:
    Success message with download details
ParametersJSON Schema
NameRequiredDescriptionDefault
appYes
output_dirYes
versionNo

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the download action and default behavior for the version parameter, but fails to describe critical aspects such as authentication requirements, rate limits, file formats, error handling, or what happens if the app/version doesn't exist. This leaves significant gaps for a tool that performs downloads.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and concise, with a clear opening sentence followed by bullet points for Args and Returns. Every sentence earns its place by providing essential information without redundancy, making it easy to scan and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of a download operation with no annotations and no output schema, the description is incomplete. It lacks details on behavioral traits (e.g., authentication, errors), doesn't fully explain parameters, and the return value description ('Success message with download details') is vague without an output schema. This makes it inadequate for safe and effective use by an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds basic semantics by explaining that 'app' can be a name or numeric ID and 'version' is optional with a default to latest, which provides context beyond the schema's 0% coverage. However, it doesn't fully compensate for the low coverage—for example, it doesn't clarify the format or constraints for 'output_dir' or provide examples, leaving some parameters inadequately explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('download') and resource ('a specific version of an app'), with the specific verb 'download' and resource 'app' making the purpose unambiguous. However, it doesn't explicitly differentiate from sibling tools like 'get_app_latest_version' or 'search', which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides implied usage guidance by mentioning that 'If no version is specified, downloads the latest,' which suggests when to use the version parameter. However, it lacks explicit guidance on when to use this tool versus alternatives like 'get_app_latest_version' or 'search', and doesn't mention prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_app_latest_versionA
Get the latest compatible version of an app for a specific Splunk version.

Args:
    app: The name or numeric ID of the Splunkbase app
    splunk_version: The Splunk version to check compatibility with
    is_cloud: Whether to check compatibility with Splunk Cloud

Returns:
    Dictionary containing release information
ParametersJSON Schema
NameRequiredDescriptionDefault
appYes
splunk_versionYes
is_cloudNo

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions the tool 'Get[s]' information and returns a 'Dictionary containing release information', but does not disclose behavioral traits such as whether it requires authentication, has rate limits, or how it handles errors. The description is minimal and lacks essential operational details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded, starting with the core purpose followed by structured 'Args' and 'Returns' sections. Every sentence earns its place by providing essential information without redundancy or fluff, making it easy to scan and understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and 3 parameters with 0% schema coverage, the description is incomplete. It covers the basic purpose and parameters but lacks details on return values (only mentions 'Dictionary' vaguely), error handling, or prerequisites. For a tool with this complexity, it should provide more context to be fully helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning by explaining each parameter's purpose: 'app' as 'name or numeric ID', 'splunk_version' for 'compatibility with', and 'is_cloud' for 'check compatibility with Splunk Cloud'. This clarifies semantics beyond the bare schema, though it could provide more detail on formats or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verb ('Get') and resource ('latest compatible version of an app'), and distinguishes it from sibling tools like 'download_app' (which downloads) and 'search' (which searches). It specifies the context of 'for a specific Splunk version' and compatibility checking.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'for a specific Splunk version' and 'check compatibility with Splunk Cloud', but does not explicitly say when to use this tool versus alternatives like 'download_app' or 'search'. It provides context but lacks explicit guidance on exclusions or comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 3 tool updates
    • First observeddownload_app
    • First observedget_app_latest_version
    • First observedsearch

TDQS

B3.3/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: download_app downloads files, get_app_latest_version retrieves version information, and search finds apps. The descriptions reinforce these distinct functions, making misselection unlikely.

Naming Consistency4/5

Two tools follow a consistent verb_noun pattern (download_app, get_app_latest_version), but 'search' deviates by using only a verb without a noun. This minor inconsistency slightly reduces predictability, though the names remain readable and intuitive.

Tool Count3/5

With only 3 tools, the server feels thin for a Splunkbase integration, as it lacks operations like installing apps, managing updates, or accessing app details. While the tools cover basic search and download workflows, the scope is limited and may require agents to work around gaps.

Completeness2/5

The tool set is severely incomplete for a Splunkbase server, missing core operations such as installing downloaded apps, listing installed apps, updating apps, or retrieving detailed app metadata. Agents will face dead ends when trying to perform common Splunkbase management tasks beyond basic search and download.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    A Model Context Protocol server that provides comprehensive control over QuickBase operations, allowing users to manage applications, tables, fields, records, and relationships through MCP tools.
    26
    4
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to interact with Splunk Enterprise and Splunk Cloud instances through standardized MCP interface. Supports executing SPL queries, managing indexes and saved searches, listing applications, and retrieving server information with flexible authentication options.
    -
  • A
    license
    A
    quality
    C
    maintenance
    An MCP server designed for interacting with the Model Context Protocol Registry API to discover and retrieve information about available MCP servers. It provides tools to search, list, and view detailed configurations and version history for servers within the registry.
    4
    MIT
  • F
    license
    B
    quality
    D
    maintenance
    A lightweight, extensible MCP server for Splunk Enterprise that enables secure, async, chat-based interaction with Splunk data via Claude Desktop or any MCP-compatible agent.
    7
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/EverdredIIDX/splunkbase-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server