Splunkbase MCP Server
Provides programmatic access to Splunkbase functionality, allowing users to search for apps, retrieve app information, check compatibility with Splunk versions, and download apps from Splunkbase.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Splunkbase MCP Serversearch for Windows Event Log field extraction apps"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
splunkbase-mcp
An MCP server for Splunkbase
Description
This is a Machine Control Protocol (MCP) server that provides programmatic access to Splunkbase functionality. It allows you to search, download, and manage Splunkbase apps through a standardized interface.
Related MCP server: Splunk MCP Server
Installation
Warning: this will store your password on-disk in plaintext. Better methods may come about eventually.
uv run mcp install -v "SPLUNKBASE_USERNAME=my_username" -v "SPLUNKBASE_PASSWORD=my_password" splunkbase-mcp.pyUsage
Sample prompt for Claude:
Please do the following.
1. Search the web to find what Splunk app is responsible for providing field extractions for the WinEventLog sourcetype
2. Find the app on Splunkbase and grab its numerical app ID
3. Use the download_app tool to grab the latest version of the app from Splunkbase and place it in /tmp/apps/Resources
app://{app}/info- Get detailed information about a Splunkbase appapp://{app}/splunk_versions- Get supported Splunk versions for an app
Available Tools
Search
search(query: str) - Search Splunkbase for apps
Returns a list of search results
Version Management
get_app_latest_version(app: str | int, splunk_version: str, is_cloud: bool = False) - Get the latest compatible version of an app
Parameters:
app: App name or numeric IDsplunk_version: Target Splunk versionis_cloud: Whether to check Splunk Cloud compatibility
Returns version information dictionary
Download
download_app(app: str | int, output_dir: str, version: Optional[str] = None) - Download a specific app version
Parameters:
app: App name or numeric IDoutput_dir: Directory to save the downloaded appversion: Optional specific version to download (latest if not specified)
Returns success message with download details
Dependencies
aiosplunkbase >= 0.1.3
mcp[cli]
aiofiles
Python >= 3.11
Available Tools
3 toolsdownload_appB
Download a specific version of an app. If no version is specified, downloads the latest.
Args:
app: The name or numeric ID of the Splunkbase app
output_dir: Directory to save the downloaded app
version: Optional specific version to download
Returns:
Success message with download details
| Name | Required | Description | Default |
|---|---|---|---|
| app | Yes | ||
| output_dir | Yes | ||
| version | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the download action and default behavior for the version parameter, but fails to describe critical aspects such as authentication requirements, rate limits, file formats, error handling, or what happens if the app/version doesn't exist. This leaves significant gaps for a tool that performs downloads.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and concise, with a clear opening sentence followed by bullet points for Args and Returns. Every sentence earns its place by providing essential information without redundancy, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a download operation with no annotations and no output schema, the description is incomplete. It lacks details on behavioral traits (e.g., authentication, errors), doesn't fully explain parameters, and the return value description ('Success message with download details') is vague without an output schema. This makes it inadequate for safe and effective use by an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds basic semantics by explaining that 'app' can be a name or numeric ID and 'version' is optional with a default to latest, which provides context beyond the schema's 0% coverage. However, it doesn't fully compensate for the low coverage—for example, it doesn't clarify the format or constraints for 'output_dir' or provide examples, leaving some parameters inadequately explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('download') and resource ('a specific version of an app'), with the specific verb 'download' and resource 'app' making the purpose unambiguous. However, it doesn't explicitly differentiate from sibling tools like 'get_app_latest_version' or 'search', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implied usage guidance by mentioning that 'If no version is specified, downloads the latest,' which suggests when to use the version parameter. However, it lacks explicit guidance on when to use this tool versus alternatives like 'get_app_latest_version' or 'search', and doesn't mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_app_latest_versionA
Get the latest compatible version of an app for a specific Splunk version.
Args:
app: The name or numeric ID of the Splunkbase app
splunk_version: The Splunk version to check compatibility with
is_cloud: Whether to check compatibility with Splunk Cloud
Returns:
Dictionary containing release information
| Name | Required | Description | Default |
|---|---|---|---|
| app | Yes | ||
| splunk_version | Yes | ||
| is_cloud | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions the tool 'Get[s]' information and returns a 'Dictionary containing release information', but does not disclose behavioral traits such as whether it requires authentication, has rate limits, or how it handles errors. The description is minimal and lacks essential operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, starting with the core purpose followed by structured 'Args' and 'Returns' sections. Every sentence earns its place by providing essential information without redundancy or fluff, making it easy to scan and understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no output schema, and 3 parameters with 0% schema coverage, the description is incomplete. It covers the basic purpose and parameters but lacks details on return values (only mentions 'Dictionary' vaguely), error handling, or prerequisites. For a tool with this complexity, it should provide more context to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning by explaining each parameter's purpose: 'app' as 'name or numeric ID', 'splunk_version' for 'compatibility with', and 'is_cloud' for 'check compatibility with Splunk Cloud'. This clarifies semantics beyond the bare schema, though it could provide more detail on formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verb ('Get') and resource ('latest compatible version of an app'), and distinguishes it from sibling tools like 'download_app' (which downloads) and 'search' (which searches). It specifies the context of 'for a specific Splunk version' and compatibility checking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'for a specific Splunk version' and 'check compatibility with Splunk Cloud', but does not explicitly say when to use this tool versus alternatives like 'download_app' or 'search'. It provides context but lacks explicit guidance on exclusions or comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchB
Search Splunkbase for apps.
Args:
query: The search query to search Splunkbase for
Returns:
A list of results from the search
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool searches and returns a list of results, but it doesn't cover important traits like whether it's read-only, if it has rate limits, authentication needs, pagination behavior, or error handling. For a search tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with a clear purpose statement followed by brief sections for args and returns. Every sentence earns its place by providing essential information without redundancy. However, minor improvements in structure (e.g., bullet points) could enhance readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter, no output schema, no annotations), the description is minimally adequate. It covers the basic purpose and parameter semantics but lacks details on behavioral traits, usage guidelines, and output specifics (e.g., result format). Without annotations or an output schema, more completeness would be beneficial for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for the single parameter 'query' by explaining it's 'The search query to search Splunkbase for,' which clarifies its purpose beyond the schema's basic title and type. Since schema description coverage is 0% and there's only one parameter, this compensation is effective, though it could be more detailed (e.g., query syntax).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search Splunkbase for apps.' It specifies the verb ('search') and resource ('Splunkbase for apps'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'download_app' or 'get_app_latest_version', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'download_app' or 'get_app_latest_version', nor does it specify any prerequisites, contexts, or exclusions for usage. This lack of comparative or contextual advice limits its helpfulness for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
3 tool updates
- First observed
download_app - First observed
get_app_latest_version - First observed
search
TDQS
Each tool has a clearly distinct purpose with no overlap: download_app downloads files, get_app_latest_version retrieves version information, and search finds apps. The descriptions reinforce these distinct functions, making misselection unlikely.
Two tools follow a consistent verb_noun pattern (download_app, get_app_latest_version), but 'search' deviates by using only a verb without a noun. This minor inconsistency slightly reduces predictability, though the names remain readable and intuitive.
With only 3 tools, the server feels thin for a Splunkbase integration, as it lacks operations like installing apps, managing updates, or accessing app details. While the tools cover basic search and download workflows, the scope is limited and may require agents to work around gaps.
The tool set is severely incomplete for a Splunkbase server, missing core operations such as installing downloaded apps, listing installed apps, updating apps, or retrieving detailed app metadata. Agents will face dead ends when trying to perform common Splunkbase management tasks beyond basic search and download.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
Search and get install details on MCP servers, right from your agent -- a unified marketplace index.
- OneOAuthai.withone
Search, document and execute authenticated API calls across 700+ apps via one MCP server
MCP server for the HubSpot Integrations Center HubDB: search and retrieve integration data.
Related MCP Servers
- AlicenseBqualityDmaintenanceA Model Context Protocol server that provides comprehensive control over QuickBase operations, allowing users to manage applications, tables, fields, records, and relationships through MCP tools.264MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Splunk Enterprise and Splunk Cloud instances through standardized MCP interface. Supports executing SPL queries, managing indexes and saved searches, listing applications, and retrieving server information with flexible authentication options.-
- AlicenseAqualityCmaintenanceAn MCP server designed for interacting with the Model Context Protocol Registry API to discover and retrieve information about available MCP servers. It provides tools to search, list, and view detailed configurations and version history for servers within the registry.4MIT
- FlicenseBqualityDmaintenanceA lightweight, extensible MCP server for Splunk Enterprise that enables secure, async, chat-based interaction with Splunk data via Claude Desktop or any MCP-compatible agent.71-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/EverdredIIDX/splunkbase-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server