Skip to main content
Glama
deslicer

MCP Server for Splunk

by deslicer

MCP Server for Splunk

FastMCP Python Docker MCP Tests Passing Community License

Enable AI agents to interact seamlessly with Splunk environments through the Model Context Protocol (MCP)

Transform your Splunk instance into an AI-native platform. Our community-driven MCP server bridges Large Language Models and Splunk Enterprise/Cloud with 20+ tools, 16 resources (including CIM data models), and production-ready securityβ€”all through a single, standardized protocol.

🌟 Why This Matters

  • πŸ”Œ Universal AI Connection: One protocol connects any AI to Splunk data

  • ⚑ Zero Custom Integration: No more months of custom API development

  • πŸ›‘οΈ Production-Ready Security: Client-scoped access with no credential exposure

  • πŸ€– AI-Powered Workflows: Intelligent troubleshooting agents that work like experts

  • 🀝 Community-Driven: Extensible framework with contribution examples

πŸš€ NEW: AI-Powered Troubleshooting Workflows - Transform reactive firefighting into intelligent, systematic problem-solving with specialist AI workflows.

Related MCP server: Splunk MCP for SOC Operations

πŸ“‹ Table of Contents

πŸš€ Quick Start

Prerequisites

  • Python 3.10+ and UV package manager

  • Nodejs (optional used for mcp inspector)

  • Docker (optional but recommended for full stack)

  • Splunk instance with API access (or use included Docker Splunk)

πŸ“– Complete Setup Guide: Installation Guide

Configuration

Before running the setup, configure your Splunk connection:

# Copy the example configuration
cp env.example .env

# Edit .env with your Splunk credentials
# - Use your existing Splunk instance (local, cloud, or Splunk Cloud)
# - OR use the included Docker Splunk (requires Docker)

# Optional HTTP transport defaults (local runs)
# - Stateless HTTP avoids sticky-session requirements
# - JSON responses improve compatibility with some clients
# These are already the defaults for local runs via `mcp-server --local`
echo "MCP_STATELESS_HTTP=true" >> .env
echo "MCP_JSON_RESPONSE=true" >> .env

One-Command Setup

Windows:

git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk

```python
# Start the MCP Server (project script)
uv run mcp-server --local --detached

# Verify the server
uv run mcp-server --test
# Optional: show detailed tools/resources and health output
uv run mcp-server --test --detailed

macOS/Linux:

git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk

# (Recommended) Preview what would be installed
./scripts/smart-install.sh --dry-run

# Install missing prerequisites (base: Python, uv, Git, Node)
./scripts/smart-install.sh

# Start the MCP Server (project script)
# Local runs default to HTTP stateless mode + JSON response
uv run mcp-server --local --detached

# Verify the server
uv run mcp-server --test
# Optional: show detailed tools/resources and health output
uv run mcp-server --test --detailed

πŸ’‘ Deployment Options: The mcp-server command will prompt you to choose:

  • Docker (Option 1): Full stack with Splunk, Traefik, MCP Inspector - recommended if Docker is installed

  • Local (Option 2): Lightweight FastMCP server only - for users without Docker

Stopping services:

  • uv run mcp-server --stop stops only this project's compose services (dev/prod/splunk). It does not stop the Docker engine.

Note on Splunk licensing: When using the so1 Splunk container, you must supply your own Splunk Enterprise license if required. The compose files include a commented example mount: # - ./lic/splunk.lic:/tmp/license/splunk.lic:ro. Create a lic/ directory and mount your license file, or add the license via the Splunk Web UI after startup.

🎯 What You Can Do

πŸ€– Workflow Discovery & Authoring

Discover and validate Splunk troubleshooting workflow definitions (JSON) without a built-in agent runner:

# Discover available troubleshooting workflows
result = await list_workflows.execute(ctx, format_type="summary")
# Returns: missing_data_troubleshooting, performance_analysis, custom_workflows...

# Author or validate a workflow definition
result = await workflow_builder.execute(
    ctx=ctx,
    mode="validate",
    workflow_data={"workflow_id": "my_check", "tasks": [...]},
)

OpenAI-based workflow_runner execution was removed in favor of FastMCP 4 / MCP SDK v2. Workflow JSON definitions remain available for discovery, validation, and external orchestration.

πŸ“– Workflows Guide β†’ for creation, templates, and contrib workflows.

πŸ›‘οΈ ITSI MCP Server (NEW!)

A dedicated Model Context Protocol server for Splunk IT Service Intelligence ships in this repo at mcp_itsi/, released independently to PyPI as mcp-itsi-server. It targets ITSI 4.21 and adds 70 tools, 9 documentation resources, and 3 workflow prompts for managing services, entities, KPIs, episodes, glass tables, deep dives, correlation searches, and aggregation policies.

# Standalone install
pip install mcp-itsi-server

# Together with the parent server
pip install "mcp-server-for-splunk[itsi]"

You can deploy it two ways with identical capabilities:

  • Plugin of mcp-for-splunk β€” auto-registers via the mcp_splunk.plugins Python entry point. One process, one URL, one credential set.

  • Standalone β€” its own FastMCP HTTP/stdio process, behind Traefik on /itsi/mcp (Docker), via mcp-itsi-server (local Python), or as the mcp_itsi Docker image (anywhere).

Both modes share the same per-request X-Splunk-* headers as the parent server (basic auth, bearer token, splunkd session token), plus optional X-ITSI-* overrides for app/user namespace.

πŸš€ ITSI Getting Started β†’ | πŸ—οΈ ITSI Deployment Guide β†’ | πŸ“¦ Package README β†’

πŸ“š Documentation Hub

Document

Purpose

Audience

Time

πŸ€– AI-Powered Troubleshooting

Intelligent workflows powered by the workflow tools

All users

5 min

Getting Started

Complete setup guide with prerequisites

New users

15 min

Integration Guide

Connect AI clients

Developers

30 min

HTTP Client Modes

Sessionless vs session-scoped HTTP clients

Developers

10 min

llms.txt

LLM-oriented guide for using the MCP server

Agents

5 min

AGENTS.md

Instructions for coding agents working in this repo

Contributors / agents

5 min

Deployment Guide

Production deployment

DevOps

45 min

Workflows Guide

Discover, author, and validate workflow JSON

Developers

10 min

API Reference

Tool documentation

Integrators

Reference

Resources Reference

Access CIM data models and Splunk docs

All users

Reference

Contributing

Add your own tools

Contributors

60 min

πŸ“– Contrib Guide

Complete contribution framework

Contributors

15 min

Architecture

Technical deep-dive

Architects

Reference

Tests Quick Start

First success test steps

Developers

2 min

Plugins

Extend with entry-point plugins (separate package)

Integrators

5 min

ITSI MCP Server (Getting Started)

Zero-to-working ITSI MCP server in 15 minutes

ITSI users

15 min

ITSI MCP Server (Deployment)

Standalone vs plugin, Docker, scaling, security

DevOps / Splunk admins

20 min

πŸ”§ Available Tools & Capabilities

πŸ€– Workflow Tools

  • list_workflows: Discover available troubleshooting workflows (core + contrib)

  • workflow_builder: Create, edit, and validate workflow JSON definitions

  • workflow_requirements: Schema and authoring guidance for workflow contributors

  • Built-in Workflows: Missing data troubleshooting, performance analysis, and more

  • πŸ“– Complete Workflow Guide β†’

πŸ” Search & Analytics

  • Smart Search: Natural language to SPL conversion

  • Real-time Search: Background job management with progress tracking

  • Saved Searches: Create, execute, and manage search automation

πŸ“Š Data Discovery

  • Metadata Exploration: Discover indexes, sources, and sourcetypes

  • Schema Analysis: Understand your data structure

  • Usage Patterns: Identify data volume and access patterns

πŸ‘₯ Administration

  • App Management: List, enable, disable Splunk applications

  • User Management: Comprehensive user and role administration

  • Configuration Access: Read and analyze Splunk configurations

πŸ₯ Health Monitoring

  • System Health: Monitor Splunk infrastructure status

  • Degraded Feature Detection: Proactive issue identification

  • Alert Management: Track and analyze triggered alerts

πŸ›‘οΈ Splunk IT Service Intelligence (ITSI) β€” NEW!

The companion mcp_itsi server (standalone or plugin β€” see πŸ›‘οΈ ITSI MCP Server) adds 70 ITSI-specific tools:

  • Service Insights: services, service templates, KPI base searches, KPI threshold templates, glass tables, deep dives, home views β€” full CRUD plus itsi_count_services and itsi_templatize_service.

  • Entity Integration: entities, entity types, alias inventory; full CRUD with the documented schema quirks (alias fields must also live at the document root).

  • Event Analytics: notable events with itsi_acknowledge_notable_event / itsi_close_notable_event shortcuts, plus full CRUD on aggregation policies and correlation searches.

  • Teams, maintenance windows, supported object types, and bundled docs as itsi_* tools and itsi://docs/<slug> resources.

πŸ“¦ Browse the ITSI tool catalog β†’

🌐 Client Integration Examples

πŸ’ͺ Multi-Client Configuration Strength: One of the key advantages of this MCP Server for Splunk is its ability to support multiple client configurations simultaneously. You can run a single server instance and connect multiple clients with different Splunk environments, credentials, and configurations - all without restarting the server or managing separate processes.

πŸ”„ Multi-Client Benefits

Session-Based Isolation: Each client connection maintains its own Splunk session with independent authentication, preventing credential conflicts between different users or environments.

Dynamic Configuration: Switch between Splunk instances (on-premises, cloud, development, production) by simply changing headers - no server restart required.

Scalable Architecture: A single server can handle multiple concurrent clients, each with their own Splunk context, making it ideal for team environments, CI/CD pipelines, and multi-tenant deployments.

Resource Efficiency: Eliminates the need to run separate MCP server instances for each Splunk environment, reducing resource consumption and management overhead.

Cursor IDE

Single Tenant

{
  "mcpServers": {
    "splunk": {
      "command": "fastmcp",
      "args": ["run", "/path/to/src/server.py"],
      "env": {
        "MCP_SPLUNK_HOST": "your-splunk.com",
        "MCP_SPLUNK_USERNAME": "your-user"
      }
    }
  }
}

Client Specified Tenant

Sessionless bearer-token (default HTTP mode) and session-scoped examples:

{
  "mcpServers": {
    "splunk-sessionless": {
      "url": "http://localhost:8003/mcp/",
      "headers": {
        "X-Splunk-Host": "myorg.splunkcloud.com",
        "X-Splunk-Port": "8089",
        "X-Splunk-Token": "eyJraWQiOiJzcGx1bmsuc2VjcmV0...",
        "X-Splunk-Scheme": "https",
        "X-Splunk-Verify-SSL": "true"
      }
    },
    "splunk-in-docker": {
      "url": "http://localhost:8003/mcp/",
      "headers": {
        "X-Splunk-Host": "so1",
        "X-Splunk-Port": "8089",
        "X-Splunk-Username": "admin",
        "X-Splunk-Password": "Chang3d!",
        "X-Splunk-Scheme": "http",
        "X-Splunk-Verify-SSL": "false",
        "X-Session-ID": "splunk-in-docker-session"
      }
    }
  }
}

See HTTP Client Connection Modes for both approaches.

Google Agent Development Kit

from google.adk.tools.mcp_tool.mcp_toolset import MCPToolset

splunk_agent = LlmAgent(
    model='gemini-2.0-flash',
    tools=[MCPToolset(connection_params=StdioServerParameters(
        command='fastmcp',
        args=['run', '/path/to/src/server.py']
    ))]
)

🀝 Community & Contribution

Quick links: Contributing Β· Code of Conduct Β· Security Policy Β· Governance Β· License

πŸ› οΈ Create Your Own Tools & Extensions

πŸš€ Quick Start for Contributors:

# Interactive tool generator (project script)
uv run generate-tool

# Browse existing tools for inspiration
./contrib/scripts/list_tools.py

# Validate your tool implementation (project script)
uv run validate-tools

# Test your contribution
./contrib/scripts/test_contrib.py

πŸ“– Complete Contributing Guide β†’ - Everything you need to know about creating tools, resources, and workflows for the MCP Server for Splunk.

Contribution Categories

  • πŸ›‘οΈ Security Tools: Threat hunting, incident response, security analysis

  • βš™οΈ DevOps Tools: Monitoring, alerting, operations, SRE workflows

  • πŸ“ˆ Analytics Tools: Business intelligence, reporting, data analysis

  • πŸ’‘ Example Tools: Learning templates and patterns for new contributors

  • πŸ”§ Custom Workflows: AI-powered troubleshooting procedures for your organization

πŸš€ Deployment Options

Development (Local)

  • Startup Time: ~10 seconds

  • Resource Usage: Minimal (single Python process)

  • Best For: Development, testing, stdio-based AI clients

  • HTTP Defaults: Local runs enable MCP_STATELESS_HTTP=true and MCP_JSON_RESPONSE=true by default for Official MCP clients (no sticky sessions; JSON over SSE).

    • Endpoint: http://localhost:8003/mcp/

    • Client headers: Accept: application/json, text/event-stream plus X-Splunk-* (prefer X-Splunk-Token; or username/password)

    • Sessionless (default): omit X-Session-ID / MCP-Session-ID

    • Session-scoped: send a stable X-Session-ID when you want cached config across requests

    • Details: HTTP Client Connection Modes

Production (Docker)

  • Features: Load balancing, health checks, monitoring

  • Includes: Traefik, MCP Inspector, optional Splunk

  • Best For: Multi-client access, web-based AI agents

  • Session Routing: Traefik is configured with sticky sessions for streamable HTTP; alternatively, enable stateless HTTP for development scenarios.

Enterprise (Kubernetes)

  • Scalability: Horizontal scaling, high availability

  • Security: Pod-level isolation, secret management

  • Monitoring: Comprehensive observability stack

ITSI MCP Server

  • Plugin mode: Auto-loads into mcp-for-splunk via the mcp_splunk.plugins entry point β€” single process, single URL.

  • Standalone mode: Dedicated FastMCP container behind Traefik at /itsi/mcp, or mcp-itsi-server console script for local Python, or mcp_itsi Docker image for any orchestrator.

  • Auth parity: Same X-Splunk-* headers as the parent server; optional X-ITSI-App / X-ITSI-User-NS / X-ITSI-API-Version for ITSI-specific namespacing.

  • Verification: uv run python scripts/test_itsi_mcp_both_modes.py exercises both modes end-to-end against any live ITSI cluster.

πŸ“– Full ITSI deployment guide β†’

πŸ†˜ Support & Community

  • πŸ› Issues: GitHub Issues

  • πŸ’¬ Discussions: GitHub Discussions

  • πŸ“– Documentation: Complete guides and references

  • πŸ”§ Interactive Testing: MCP Inspector for real-time testing

Windows Support

Windows users get first-class support with PowerShell scripts and comprehensive troubleshooting guides. See our Windows Setup Guide.

πŸ“ˆ Project Stats

  • βœ… 20+ Production Tools - Comprehensive Splunk operations

  • βœ… 16 Rich Resources - System info, documentation, and CIM data models

  • βœ… Comprehensive Test Suite - 170+ tests passing locally

  • βœ… Multi-Platform - Windows, macOS, Linux support

  • βœ… Community-Ready - Structured contribution framework

  • βœ… Enterprise-Proven - Production deployment patterns


🎯 Ready to Get Started?

Choose your adventure:

Learn More: Model Context Protocol | FastMCP Framework

Available Tools

56 tools
create_alertCreate AlertA

Create a Splunk alert (a scheduled saved search with trigger conditions). Actions can be any installed alert action, including custom ones, and more than one action is allowed. Call list_alert_actions first for custom action names and param keys.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp context (default: search)
nameYesUnique alert name (required)
searchYesSPL query (required)
actionsNo[{name, params, enabled}]. Empty means track-only. Custom action params use keys from list_alert_actions.
sharingNouser|app|global (default: user)user
alert_typeNoalways|number of events|number of hosts|number of sources|custom (default: number of events)number of events
is_visibleNo
alert_trackNoShow in Triggered Alerts (default: true)
descriptionNoDescription
latest_timeNoDispatch latest time, e.g. 'now'now
cron_scheduleYesCron schedule, e.g. '*/5 * * * *' (required)
earliest_timeNoDispatch earliest time, e.g. '-15m'-15m
alert_severityNo1-5 (default: 3)
alert_conditionNoRequired when alert_type is custom
alert_thresholdNoThreshold value (default: 0)0
alert_comparatorNogreater than|less than|equal to|not equal to (default: greater than)greater than
alert_digest_modeNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry behavioral context. It does add valuable information: actions are not limited to built-in ones, multiple actions are allowed, and custom action names/keys come from list_alert_actions. However, it does not disclose what happens on duplicate alert names, whether any authorization is needed, or what the response indicates about success.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loads the core definition, and uses three sentences that each add value. The prerequisite instruction about list_alert_actions is included without clutter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there are no annotations and no output schema, the description leaves gaps about how to verify creation success and what happens on conflict or invalid configurations. It covers the key conceptual role well, but relies almost entirely on the schema for the rest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is high at 88%, so the schema already explains most parameters. The description adds context around the actions parameter by saying custom actions are supported and pointing to list_alert_actions, but it does not enrich semantics for required parameters beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the specific operation: creating a Splunk alert, defined as a scheduled saved search with trigger conditions. This distinguishes it from create_saved_search, which creates saved searches without trigger conditions, and from update_alert, which modifies existing alerts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a useful prerequisite to call list_alert_actions first, but gives no guidance about when to use create_saved_search versus create_alert, or when to switch to update_alert. It does not mention any exclusions or alternatives by name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_configCreate ConfigA

Creates or updates a stanza in a Splunk .conf file at the app level. Uses REST first, with SDK fallback. Defaults to the current session owner and app 'search' when not provided. Will only overwrite existing keys when overwrite=true; otherwise, only new keys are added.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp namespace for the config (defaults to 'search' if not provided).
ownerNoOwner namespace (defaults to current session user if available).
stanzaYesStanza name to create/update.
settingsYesKey/value settings to apply in the stanza.
conf_fileYesConfiguration file name without .conf (e.g., 'props', 'transforms').
overwriteNoOverwrite existing keys if True; otherwise skip them.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently explains the overwrite logic (only overwrites when overwrite=true, otherwise adds new keys), the default to current session owner and app 'search', and the fallback mechanism. It does not mention permission requirements or potential side effects beyond the stated behavior, but the core semantics are well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with each serving a purpose: what it does, implementation/defaults, and overwrite semantics. No fluff or redundant information. Perfectly front-loaded and structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 6 parameters, a nested object, no output schema, and no annotations, the description adequately explains the key behaviors: the overwrite policy, defaults, and fallback. It does not describe return values or failure modes, but for a configuration mutation tool, the essential context is present. Slightly more detail on authentication or side effects could be added, but it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and each parameter already has a description (conf_file, stanza, settings, app, owner, overwrite). The description repeats the defaults and overwrite behavior, which adds little beyond the schema. It does not elaborate on the settings object structure or edge cases, so it meets the baseline for well-documented schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates or updates a stanza in a Splunk .conf file at the app level. This is specific and distinguishes it from sibling read-only tools like get_configurations and get_config_spec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the implementation approach (REST first, SDK fallback), default behavior for owner and app, and the overwrite parameter semantics. While it does not explicitly name alternatives, the context clearly implies its use for writing config versus reading, and the defaults are useful. It lacks explicit when-not-to-use guidance but provides sufficient context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_dashboardCreate DashboardA

Create a new dashboard in Splunk. Accepts Classic Simple XML (string) or Dashboard Studio JSON (object/string) via eai:data. Optionally overwrite if it exists and set sharing/permissions (ACL).

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp context. Default: 'search'search
nameYesDashboard name (required)
labelNoHuman label shown in UI
ownerNoDashboard owner. Default: 'nobody'nobody
themeNoDashboard Studio UI theme when wrapping JSON: 'light', 'dark', or 'auto' (default: 'auto'). With 'auto', reads uiSettings.theme / theme from Studio JSON or pre-wrapped XML; falls back to 'dark'. Ignored for Classic Simple XML.auto
sharingNo'user'|'app'|'global'
overwriteNoIf True, updates existing dashboard of same name
definitionYesStudio JSON (dict/string) or Classic XML (string) (required)
read_permsNoRoles/users granted read
descriptionNoDashboard description
write_permsNoRoles/users granted write
dashboard_typeNo'studio'|'classic'|'auto' (default: 'auto')auto

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden but only discloses that it accepts two formats, can overwrite existing dashboards, and can set ACLs. It does not mention authentication requirements, error behavior when a dashboard already exists and overwrite is false, or what the response looks like, leaving significant behavioral aspects undeclared.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and each clause adds relevant detail (formats, overwrite, ACL) without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter tool with no annotations and no output schema, the description is adequate but incomplete. It fails to explain how dashboard_type auto-detection works, what the tool returns, or any prerequisites/error conditions, relying heavily on the schema for parameter semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds some meaning by mentioning the eai:data transport mechanism and clarifying that definition can be a string or object, plus the ACL settings, but this adds limited value beyond the schema's own detailed parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a new dashboard in Splunk', providing a specific verb and resource. It distinguishes itself from sibling tools like get_dashboard_definition and list_dashboards by focusing on creation, and it adds key details about accepted formats and overwrite/ACL options.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use this tool (creating a dashboard, with optional overwrite for existing ones) but does not explicitly name alternatives or exclusions. The overwrite option implies it can also be used for updates, and the sibling list includes related tools, but no explicit when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_kvstore_collectionCreate Kvstore CollectionA

Create a KV Store collection with optional fields and indexing. Use this to provision a new collection for lookups or persisted configuration in a specific app.

ParametersJSON Schema
NameRequiredDescriptionDefault
appYesTarget Splunk application where the collection will be created. Examples: - 'search': Default search app - 'my_app': Custom application - 'splunk_monitoring_console': Monitoring console app
fieldsNoField definitions specifying data types and constraints
collectionYesName for the new collection (alphanumeric and underscores only). Examples: - 'users': User information store - 'configurations': Application settings - 'lookup_table': Data enrichment table
replicatedNoWhether to replicate across cluster (default: True)
accelerated_fieldsNoIndex definitions for faster queries
create_lookup_definitionNoAlso create a transforms.conf lookup definition (default: False)

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden for behavioral disclosure. It merely states the creation action but does not mention any side effects, permissions required, idempotency, or whether existing collections with the same name are overwritten. This is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action and key details. It is appropriately sized and every sentence contributes meaning without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich schema with 100% parameter coverage and no output schema, the description is complete enough for an AI agent to understand the tool's purpose and usage. It lacks only minor behavioral details, but the overall context is sufficient for a straightforward creation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameters with detailed descriptions and examples, so the baseline is 3. The description adds no parameter-specific detail beyond what the schema already provides, but it does reinforce that fields and indexing are optional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create a KV Store collection') and the scope ('for lookups or persisted configuration in a specific app'). It differentiates from sibling tools like list_kvstore_collections and get_kvstore_data by focusing on the creation action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit use case: 'Use this to provision a new collection for lookups or persisted configuration in a specific app.' It does not enumerate alternatives or when-not-to-use, but the context is clear and sufficient for an agent to select this tool for creation tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_alertDelete AlertA

Delete a Splunk alert. Alerts are saved searches, so this removes that saved search. Requires confirm=true. Use app and owner when the name exists in more than one namespace.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp context for lookup
nameYesAlert name (required)
ownerNoOwner context for lookup
confirmNoMust be true to delete (default: false)

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full disclosure burden. It discloses the cascading destructive side effect ('this removes that saved search') and the confirm gate, which addresses the highest-risk behavioral trait. However, it does not state whether deletion is permanent/irreversible, what happens to dependent artifacts like triggered alerts, or what occurs if confirm is omitted β€” meaningful gaps for a destructive tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, each earning its place: the core action, the key domain fact linking alerts to saved searches, the mandatory flag, and the conditional namespace guidance. The action is front-loaded and there is zero filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema and no annotations, the description covers purpose, side-effect scope, the required safety flag, and namespace disambiguation β€” giving all four parameters contextual treatment. Minor gaps remain (return behavior, irreversibility), but nothing an agent needs to invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, setting the baseline at 3. The description adds genuine meaning beyond the schema: it explains the disambiguation role of app/owner ('when the name exists in more than one namespace'), going beyond 'App context for lookup', and reinforces confirm as a mandatory safety gate rather than just a default value. This elevates it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action on a specific resource ('Delete a Splunk alert') and differentiates itself from sibling tools by explaining the alert/saved-search relationship ('Alerts are saved searches, so this removes that saved search'). This directly distinguishes it from delete_saved_search and clarifies what it is not, so an agent can select it correctly after one read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit invocation conditions: 'Requires confirm=true' states a mandatory precondition, and 'Use app and owner when the name exists in more than one namespace' gives a clear conditional for parameter selection. It stops short of a full routing contract β€” there is no explicit 'instead use X' or 'do not use when' β€” but the context is clear enough to use correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

discover_splunk_docsDiscover Splunk DocsA

Discover all available Splunk documentation resources with examples and usage patterns. Returns a comprehensive guide showing available documentation types, URI patterns, and quick access links. Perfect for understanding what documentation is available and how to access it through the documentation tools.

Returns embedded resource with discovery guide including:

  • Static documentation resources (cheat sheet, etc.)

  • Dynamic documentation patterns (SPL reference, troubleshooting, admin guides)

  • Version support information

  • Quick access examples for common documentation needs

  • Usage patterns for agentic frameworks

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It states it 'Returns embedded resource with discovery guide' and lists contents, which is useful. However, it doesn't describe side effects (none expected), error handling, or any constraints. It's a simple discovery tool, so this level is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line summary, then a bullet list of what is returned. It's concise, no fluff, and front-loaded with the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, a simple discovery guide, it includes the key contents and usage patterns. It could mention that it's a starting point before using specific documentation tools, but the description already implies that. It's sufficiently complete for a zeroparameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters (%100 schema coverage vacuously), so the description doesn't need to explain parameters. It adds value by explaining what the returned guide contains, which is the only relevant semantic information here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Discover all available Splunk documentation resources' with a specific verb and resource. It distinguishes itself from sibling tools like get_admin_guide or get_spl_reference by focusing on discovery overview rather than specific content retrieval. The listed content types make its scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Perfect for understanding what documentation is available and how to access it through the documentation tools.' This gives clear context for when to use it. It doesn't explicitly mention when NOT to use it, but given the sibling tools (specific reference getters), the usage intent is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enhance_tool_descriptionEnhance Tool DescriptionA

Analyzes existing MCP tools and enhances their descriptions with detailed argument definitions, parameter examples, and usage patterns. Use this tool when you need to improve or generate better documentation for a tool, such as adding examples or clarifying parameters. This tool examines the current tool's metadata, inspects its execute method signature, and generates comprehensive documentation improvements.

ParametersJSON Schema
NameRequiredDescriptionDefault
tool_nameYesName of the tool to enhance (e.g., 'get_configurations', 'list_indexes')
generate_examplesNoWhether to generate parameter examples based on the tool's signature and category. Defaults to True.
include_response_formatNoWhether to analyze and include expected response format information. Defaults to True.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While no annotations are provided, the description explains the internal process ("examines the current tool's metadata, inspects its execute method signature") and generation capabilities, which gives some transparency into behavior. However, it lacks details on edge cases, failure modes, or what happens when the tool cannot complete the enhancement, leaving some room for improvement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is composed of three well-structured sentences: the first introduces the tool's purpose, the second details usage scenarios, and the third describes the method. It is concise, informative, and avoids redundancy, effectively earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the lack of an output schema and annotations, the description sufficiently explains the tool's purpose, how it works, and what it produces. It covers the essential aspects needed for an agent to decide when to use it, though it could expand on potential limitations or errors. However, given the tool's complexity, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the parameters are well-documented in the schema itself, which is the baseline. The description doesn't add much semantic depth beyond the schema, but the schema is already clear on the parameters and their defaults, so the description doesn't need to repeat it, warranting the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool "Analyzes existing MCP tools and enhances their descriptions" with specific verbs and resources. It distinguishes itself by mentioning specific actions like adding examples, clarifying parameters, and inspecting the execute method signature, which differentiates it from general documentation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context: "Use this tool when you need to improve or generate better documentation for a tool, such as adding examples or clarifying parameters." It clearly outlines the use cases and what the tool does (examines metadata, inspects execute method, generates documentation improvements), giving the agent clear guidance on when to apply it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_admin_guideGet Admin GuideC

Get detailed Splunk administration documentation for specific topics. Returns comprehensive administration guides with configuration, management, and best practices as an embedded resource.

ParametersJSON Schema
NameRequiredDescriptionDefault
topicYesAdministration topic. Use list_admin_topics() to see all available topics. Common topics include: - 'indexes' - Index management and configuration - 'authentication' - User authentication setup - 'users' - User management and roles - 'apps' - Application management - 'deployment' - Deployment configuration - 'monitoring' - System monitoring setup - 'performance' - Performance optimization - 'security' - Security configuration - 'forwarders' - Forwarder configuration - 'clustering' - Clustering setup
versionNoSplunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default)latest
auto_detect_versionNoWhether to auto-detect Splunk version from connected instance. Defaults to True.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It states it 'Returns... as an embedded resource' but does not disclose whether it is read-only, any error conditions (e.g., unknown topic), or if it requires authentication. Without annotations, this is insufficient for an agent to understand side effects or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is front-loaded with the core purpose. It wastes no words and is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema or description of the returned content format (e.g., sections, length, structure). The description also does not help differentiate from the many similar documentation tools available, and given the lack of annotations, it leaves significant gaps for an agent to understand when this specific tool is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already provides detailed descriptions for each parameter, including common topics and version examples. The description adds no additional parameter semantics beyond what the schema provides, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves Splunk administration documentation for specific topics, with a clear verb (Get) and resource (administration documentation). While it distinguishes from generic docs tools like get_splunk_documentation by focusing on 'administration', it does not explicitly differentiate from similar tools like get_troubleshooting_guide or get_config_spec, so it's not a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the many sibling documentation tools (get_splunk_documentation, get_troubleshooting_guide, get_config_spec, etc.). The tool name suggests admin topics, but the description does not state any exclusions or alternatives, leaving the agent to infer usage from the name and schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_cim_referenceGet Cim ReferenceB

Get detailed Splunk CIM data model documentation with field specifications and configuration examples. Returns comprehensive reference including field mappings, tagging requirements, and implementation guidance.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelYesCIM data model name. Use list_cim_data_models() to see all available models. Examples: 'authentication', 'network-traffic', 'malware'
versionNoCIM version (default: 'latest'). Options: '6.1', '6.0', '5.3', '5.2', '5.1', 'latest'latest

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It does not disclose read-only vs. potentially heavy resource usage, nor what happens with invalid model names or version fallback. It claims 'comprehensive reference' but no caveats.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence forming a tight, front-loaded description. No fluff; every phrase adds value (detailed, field specs, examples, mappings, tagging, implementation). Well-structured, though could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Two parameters, no output schema, no annotations – the description covers content but omits return format, error handling, or use cases. It's adequate for a documentation lookup but lacks completeness for an agent unfamiliar with CIM.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with descriptions, including model examples and version options. Parameter semantics are well-handled by the schema; description adds no additional parameter insight. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it retrieves Splunk CIM data model documentation with field specs and config examples. Its purpose is distinct from siblings like get_spl_reference or list_cim_data_models, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use when needing CIM-specific reference, but lacks explicit guidance on when NOT to use it (e.g., for general Splunk docs). Sibling names suggest alternatives, but no direction is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_config_specGet Config SpecA

Get detailed Splunk configuration file specification documentation. Returns comprehensive reference with all configuration options, syntax, and examples.

ParametersJSON Schema
NameRequiredDescriptionDefault
configYesConfiguration file name (with or without .conf extension). Use list_config_files() to see common files. Examples: 'props.conf', 'transforms', 'indexes.conf'

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses the return content ('comprehensive reference with all configuration options, syntax, and examples') and the verb 'Get' implies a read-only operation, but it does not address potential errors, prerequisites, or scope limitations. A 3 reflects minimal transparency beyond the obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words. The description front-loads the action and result; every phrase contributes to understanding what the tool returns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter documentation lookup tool, the description provides sufficient detail about the return value and uses the schema to handle the parameter. With no output schema or annotations, a little more specificity about the output format would improve completeness, but the low complexity keeps it adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage, including format details and examples ('props.conf', 'transforms', 'indexes.conf'). The tool description adds no additional parameter semantics, but the schema fully compensates, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and clearly identifies the resource as 'detailed Splunk configuration file specification documentation.' It distinguishes from siblings like list_config_files or get_configurations by stating it returns documentation rather than actual configs. Evidence: 'Returns comprehensive reference with all configuration options, syntax, and examples.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives, nor does it mention exclusions. It implies usage via the schema parameter hint to use list_config_files() to see common files, but the main description lacks a direct when-to-use/when-not-to-use framing. This is adequate but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_configurationsGet ConfigurationsA

Retrieves Splunk configuration settings from specified .conf files. Use this tool when you need to access or inspect Splunk configurations, such as for troubleshooting, auditing, or understanding settings in files like props.conf or inputs.conf. Access settings from any Splunk configuration file (props.conf, transforms.conf, inputs.conf, outputs.conf, etc.) either by entire file or specific stanza. Returns structured configuration data showing all settings and their values.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoFilter results to stanzas owned by this app (namespace).
ownerNoFilter results to stanzas owned by this owner (user).
stanzaNoSpecific stanza name within the conf file to retrieve. If not provided, returns all stanzas in the file.
conf_fileYesConfiguration file name without .conf extension (e.g., 'props', 'transforms', 'inputs', 'outputs', 'server', 'web')

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full transparency burden. It discloses that the tool accesses any Splunk configuration file, can retrieve by entire file or specific stanza, and returns structured data with all settings and values. The word 'Retrieves' implies a read-only operation, and the return format is stated, though permissions and error behavior are not covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences and front-loaded with the core action. It efficiently covers usage context, scope, and return format without unnecessary filler. There is slight redundancy between 'Retrieves Splunk configuration settings' and 'Access settings from any Splunk configuration file,' but overall it is well-structured and appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description does a solid job covering purpose, scope, usage context, and return format for a read-only tool. It addresses the key behavioral aspects an agent needs to invoke it correctly. It does not cover edge cases like empty results or errors, but for a straightforward retrieval tool, it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds minor context by mentioning 'entire file or specific stanza' and providing example conf files, but it largely relies on the schema's parameter descriptions. It does not meaningfully elaborate on app/owner parameters beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Retrieves Splunk configuration settings from specified .conf files,' a specific verb-resource pair that clearly states the tool's function. It distinguishes itself from siblings like create_config, list_config_files, and get_config_spec by focusing on reading actual settings from .conf files, and it reinforces the purpose with examples like props.conf and inputs.conf.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this tool when you need to access or inspect Splunk configurations, such as for troubleshooting, auditing, or understanding settings.' This provides clear context for when to invoke the tool. However, it does not name alternatives or explicitly state when not to use it, so it misses the full 5-point bar.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboard_definitionGet Dashboard DefinitionA

Get the raw definition of a specific dashboard. Returns the complete dashboard source (Simple XML or Dashboard Studio JSON), type, app context, owner, and Splunk Web viewing URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp context. Default: 'search'search
nameYesDashboard name (required)
ownerNoDashboard owner. Default: 'nobody'nobody

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It explicitly states what is returned: the complete dashboard source (Simple XML or Dashboard Studio JSON), type, app context, owner, and viewing URL. It does not mention permissions or error behavior, but it provides sufficient context about the operation's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core purpose, and every sentence adds useful information. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple read tool with three fully documented parameters and no output schema. The description compensates well by listing the return contents and the resource type. It could note behavior on missing dashboards or permission requirements, but the current level is adequate for the tool's low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters and their defaults. The description adds minimal parameter-specific meaning, only reinforcing that it operates on a specific dashboard by name, which aligns with the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: "Get the raw definition of a specific dashboard," clearly distinguishing this from list_dashboards and create_dashboard. It also enumerates the returned data, making the tool's function unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies this is for retrieving the raw definition of a specific dashboard rather than listing dashboards, which contrasts with the sibling list_dashboards tool. It does not explicitly list alternatives or exclusions, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_executed_workflowsGet Executed WorkflowsA

Retrieve executed workflows for the current session. If 'id' is provided, returns that single record (if it belongs to this session). If 'workflow_id' is provided, filters the list to that workflow. Otherwise returns a paginated list of latest results per workflow for this session.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNo
limitNo
offsetNo
workflow_idNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It transparently discloses session scoping, conditional filtering, and pagination, which adds context beyond the bare schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, no fluff. Every clause adds new behavioral detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema and no annotations, the description fully covers the tool's behavior for a retrieval function. It could mention authentication or error scenarios, but the core usage is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description directly explains the semantics of 'id' and 'workflow_id' parameters, which complements the schema. Since schema coverage is 0%, the description's contribution is valuable, though it could mention 'limit' and 'offset' explicitly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description has a specific verb ('Retrieve') and a clear resource ('executed workflows for the current session'). It explains conditional behavior based on parameters, which distinguishes it from sibling tools like list_workflows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use 'id', when to use 'workflow_id', and the default paginated behavior. It does not name alternative sibling tools, but the usage context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_kvstore_dataGet Kvstore DataA

Get documents from a KV Store collection with optional MongoDB-style query filtering. Use this to fetch lookup/configuration data or narrow results by field values.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp where the collection resides (defaults to current/app context)
queryNoMongoDB-style filter object (e.g., {"status": "active"})
collectionYesCollection name

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Get documents' and 'fetch' imply a read-only operation, and optional query filtering is disclosed, but there is no mention of default limits, pagination, empty-result behavior, or other side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences: the first front-loads the core operation, and the second adds practical usage context. No unnecessary detail or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple parameter set and complete schema descriptions, the description is reasonably adequate for invocation. However, there is no output schema and no mention of return shape, document limits, or error behavior, leaving moderate uncertainty for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% parameter coverage with descriptions for collection, app defaulting to context, and the query example. The description mostly restates the MongoDB-style query filtering and adds the 'narrow results by field values' use case, adding minimal semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says 'Get documents from a KV Store collection' with optional 'MongoDB-style query filtering', clearly identifying the operation, resource, and scope. It differentiates from sibling tools like list_kvstore_collections by focusing on retrieval of documents rather than collection listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to fetch lookup/configuration data or narrow results by field values', providing clear context for when to invoke the tool. It does not explicitly name alternatives to avoid, so it falls short of a full when-to-use vs when-not-to-use guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_metadataGet MetadataA

Retrieve distinct metadata values for a given index to aid query construction. Use this tool when you need to discover which hosts, sourcetypes, or sources are present in an index within a recent time window. This is useful for building targeted searches or validating data availability. Results are constrained by your Splunk permissions.

ParametersJSON Schema
NameRequiredDescriptionDefault
fieldNoMetadata field to list values for. One of 'host', 'sourcetype', or 'source' (default: 'host')host
indexYesTarget index to inspect (e.g., 'main', 'security')
limitNoMaximum number of distinct values to return (default: 100)
latest_timeNoSearch end time (e.g., 'now') (default: 'now')now
earliest_timeNoSearch start time (e.g., '-24h@h') (default: '-24h@h')-24h@h

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It adds useful context such as 'distinct values', 'recent time window', and 'Results are constrained by your Splunk permissions.' However, it does not mention any rate limits, response format, or what happens with no results, so it is moderately transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the main purpose, followed by usage context and a permission note. Every sentence earns its place, though the second and third sentences are somewhat complementary and could be merged without loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and no annotations, the description provides sufficient context: it explains the purpose, usage, and a key behavioral constraint (permissions). It implicitly describes the return value as 'distinct metadata values.' It could mention pagination or the default field, but the schema covers those, so it is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description adds context that the tool is for 'query construction' and that the values are for 'hosts, sourcetypes, or sources,' but this is implicitly in the schema. It does not provide additional detail beyond the schema, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Retrieve') and resource ('distinct metadata values for a given index'), clearly stating what the tool does. It differentiates from siblings like 'list_sources' and 'list_sourcetypes' by scoping to a specific index and time window.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('when you need to discover which hosts, sourcetypes, or sources are present in an index within a recent time window') and explains its utility ('building targeted searches or validating data availability'). It does not explicitly mention when not to use it or name alternatives, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_saved_search_detailsGet Saved Search DetailsA

Get comprehensive details about a specific saved search including configuration, metadata, scheduling, permissions, and alert actions. Returns detailed information about saved search properties, execution settings, and access control configuration. Essential for troubleshooting, auditing, and understanding saved search configurations.\n\nArgs:\n name (str): Name of the saved search to inspect (required)\n app (str, optional): Application context for saved search lookup\n owner (str, optional): Owner context for saved search lookup\n\nResponse Format:\nReturns dictionary with 'status', 'name', 'details', and 'retrieved_at' fields. The 'details' field contains comprehensive nested information including:\n- basic_info: Name, description, search query, visibility\n- scheduling: Schedule configuration and timing\n- dispatch: Time range and execution settings\n- permissions: Access control and sharing settings\n- actions: Email, script, and other alert actions\n- alert: Alert conditions and suppression settings\n- metadata: Creation timestamps and authorship

ParametersJSON Schema
NameRequiredDescriptionDefault
appNo
nameYes
ownerNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the exact response shape (dictionary with status, name, details, retrieved_at) and enumerates the nested detail categories, such as scheduling, permissions, and alert actions. It does not discuss auth requirements or errors, but it provides substantial runtime behavior beyond the tool name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary, Args section, and Response Format section. It is longer than minimal but every section adds value. There is minor redundancy between the opening sentences and the Response Format breakdown, but the organization keeps it scannable and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description appropriately compensates by documenting the return structure and the contents of the nested 'details' object. Combined with parameter explanations, this gives an agent enough context to invoke the tool and interpret results. It could mention error cases or permission prerequisites, but it is reasonably complete for a read-only detail-fetch operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does by listing each parameter with a meaningful explanation: name is 'required', app is 'Application context for saved search lookup', and owner is 'Owner context for saved search lookup'. This adds practical lookup semantics that the bare JSON schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Get comprehensive details about a specific saved search' and enumerates the included facets (configuration, metadata, scheduling, permissions, alert actions). This clearly distinguishes it from sibling tools like list_saved_searches, update_saved_search, or delete_saved_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context by stating it is 'Essential for troubleshooting, auditing, and understanding saved search configurations' and emphasizes 'a specific saved search.' It does not explicitly name alternatives or exclusions, but the context is enough to guide an agent toward single-item inspection rather than listing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_search_job_infoGet Search Job InfoA

Get status/properties/messages for a Splunk search job by job id (sid). Use this after run_splunk_search returns a job_id when you want to poll progress or inspect errors without re-running the search.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesSplunk search job id (sid)
include_raw_contentNoInclude raw job.content for debugging (default: False)

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that this is a non-destructive read operation by saying 'without re-running the search' and listing the data retrieved (status, properties, messages). It also implies it can be polled, but it doesn't explicitly state read-only or cover edge cases like job expiration or missing job errors. Still, it adds meaningful context beyond the tool name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences deliver the full purpose and usage context with zero fluff. The first sentence states the action and target, the second gives the trigger scenario. Perfectly front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 params, no output schema) and the description explains what it does, when to use it, and what it retrieves. It doesn't describe return format or error handling, but given the tool's simplicity and the clue that it returns 'status/properties/messages', it is sufficiently complete for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with job_id described as 'Splunk search job id (sid)' and include_raw_content as 'Include raw job.content for debugging (default: False)'. The tool description adds no additional parameter-level detail beyond referencing 'job id' in the purpose, so it doesn't exceed the baseline for fully documented schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and a resource 'status/properties/messages for a Splunk search job by job id (sid)', clearly distinguishing it from sibling tools like run_splunk_search or run_oneshot_search. It immediately clarifies that this is for retrieving info about an existing job, not for starting one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'Use this after run_splunk_search returns a job_id when you want to poll progress or inspect errors without re-running the search.' This gives a clear trigger (after run_splunk_search) and purpose (poll/inspect errors), and implies not to use it for starting searches.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_spl_referenceGet Spl ReferenceB

Get detailed reference documentation for specific SPL (Search Processing Language) commands. Returns comprehensive documentation with syntax, examples, and usage patterns as an embedded resource.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesSPL command name. Use list_spl_commands() to see common commands. Examples: - 'stats' - Statistical aggregation command - 'eval' - Field calculation and manipulation - 'search' - Search filtering command - 'timechart' - Time-based charting - 'rex' - Regular expression field extraction - 'lookup' - Data enrichment from lookups
versionNoSplunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default)latest
auto_detect_versionNoWhether to auto-detect Splunk version from connected instance. Defaults to True.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. While the tool is obviously a read-only documentation lookup, the description does not explicitly state that it has no side effects, requires no special permissions, or is safe. The only behavioral detail is that it 'Returns... as an embedded resource,' which is vague about the return format but adds minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main purpose and a brief secondary sentence about return content. No fluff or redundant information, making it highly concise and effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity documentation retrieval tool, the description reasonably explains what is returned (syntax, examples, usage patterns) but leaves the exact output format vague with 'as an embedded resource.' Since there is no output schema, a bit more detail about the return structure could improve completeness, but overall it is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all three parameters (command, version, auto_detect_version) with detailed descriptions and examples. The tool description itself adds no parameter semantics, but given the schema coverage is 100%, the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get detailed reference documentation for specific SPL (Search Processing Language) commands.' It uses a specific verb (get) and resource (SPL command reference), and distinguishes itself from sibling tools like list_spl_commands by emphasizing detailed, per-command documentation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention that this is the tool to use for detailed command reference, nor does it reference sibling tools like list_spl_commands for command discovery or get_splunk_documentation for broader documentation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_splunk_cheat_sheetGet Splunk Cheat SheetA

Get the comprehensive Splunk SPL cheat sheet with commands, regex patterns, and usage examples. Returns the complete cheat sheet as an embedded resource with actual markdown content, perfect for quick reference during SPL query development and troubleshooting.

Returns embedded resource with complete SPL reference content including:

  • Core SPL commands and syntax

  • Regular expression patterns

  • Statistical functions

  • Time modifiers and formatting

  • Search optimization tips

  • Common use cases and examples

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It plainly states that the tool 'returns an embedded resource with actual markdown content' and lists the content categories, making the non-mutating retrieval behavior clear. It does not discuss potential limitations like stale content or response size, but for a static reference resource this is adequately transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear one-sentence summary and then uses a bullet list to enumerate the reference content. It is somewhat repetitive with 'comprehensive' and 'complete' in adjacent sentences, but the structure is scannable and every bullet adds useful detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no parameters, no input schema complexity, no output schema), so the description does not need to explain return-value structures. It adequately covers what the cheat sheet includes and its intended use, making it sufficiently complete for an agent to decide whether to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the schema offers nothing to clarify. The baseline for 0-parameter tools is 4, and the description appropriately focuses on what the returned content contains rather than trying to explain nonexistent inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves a comprehensive Splunk SPL cheat sheet with commands, regex patterns, and usage examples. It names a specific resource type ('cheat sheet') but does not explicitly contrast itself with related siblings like get_spl_reference or list_spl_commands, so it loses one point for differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says the cheat sheet is 'perfect for quick reference during SPL query development and troubleshooting,' giving clear usage context. However, it does not mention when to prefer other SPL reference tools over this one or provide exclusions, so it is not a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_splunk_documentationGet Splunk DocumentationA

Retrieve any Splunk documentation by URI pattern. This tool wraps existing documentation resources and returns embedded resources with actual content, making them compatible with agentic frameworks that don't support MCP resources natively. Supports all documentation types including cheat sheets, troubleshooting guides, SPL references, and admin guides.

ParametersJSON Schema
NameRequiredDescriptionDefault
doc_uriYesDocumentation URI pattern. Use list_available_topics() to see all available URI patterns and topics. Examples: - 'splunk-docs://cheat-sheet' - Splunk SPL cheat sheet - 'splunk-docs://discovery' - Available documentation discovery - 'splunk-docs://9.4/spl-reference/stats' - SPL stats command - 'splunk-docs://latest/troubleshooting/metrics-log' - Troubleshooting guide - 'splunk-docs://9.3/admin/indexes' - Admin guide for indexes - 'splunk-cim://authentication' - CIM data model (latest version) - 'splunk-cim://6.1/network-traffic' - CIM data model (specific version) - 'splunk-cim://discovery' - CIM discovery index - 'dashboard-studio://cheatsheet' - Dashboard Studio cheatsheet - 'dashboard-studio://discovery' - Dashboard Studio discovery - 'splunk-spec://props.conf' - Config file specification
auto_detect_versionNoWhether to auto-detect Splunk version for dynamic resources. Defaults to True.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry full behavioral disclosure. It explains it returns embedded resources with actual content, which is helpful, but does not explicitly state read-only nature, side-effect-free, or potential failure modes. It adds some context but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded paragraph with zero waste. Every sentence earns its place, and it is appropriately sized for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich parameter schema and no output schema, the description covers the tool's purpose and types adequately. It explains the wrapper behavior and supported categories, which is sufficient for the complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions and examples for both parameters. The description itself adds minimal parameter info beyond what the schema already provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves Splunk documentation by URI pattern, distinguishing it from sibling specific getters like get_admin_guide or get_spl_reference. The verb+resource+scope is specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It says it supports all documentation types and even references list_available_topics() for discovering URIs, but does not explicitly state when to prefer this over specific sibling tools or when to avoid it. No exclusions or alternatives are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_splunk_healthGet Splunk HealthA

Check Splunk server connectivity and return comprehensive health status information including server version, connection status, and system information. Supports both server-configured connections and custom connection parameters for testing different Splunk instances. Essential for connectivity troubleshooting and server validation.\n\nArgs:\n splunk_host (str, optional): Splunk server hostname or IP address (e.g., 'localhost', 'splunk.example.com', '10.1.1.100')\n splunk_port (int, optional): Splunk management port, typically 8089 (e.g., 8089, 8000, 9997)\n splunk_username (str, optional): Splunk username for authentication (e.g., 'admin', 'splunk', 'analyst')\n splunk_password (str, optional): Splunk password for authentication\n splunk_scheme (str, optional): Connection scheme - 'http' or 'https'\n splunk_verify_ssl (bool, optional): Whether to verify SSL certificates\n\nNote: If connection parameters are not provided, uses the server's configured connection.\n\nResponse Format:\nReturns dictionary with 'status', 'version', 'server_name', and 'connection_source' fields. Status can be 'connected' or 'error'.

ParametersJSON Schema
NameRequiredDescriptionDefault
splunk_hostNo
splunk_portNo
splunk_schemeNo
splunk_passwordNo
splunk_usernameNo
splunk_verify_sslNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It discloses the key behavior: if connection parameters are not provided, the server's configured connection is used; it also outlines possible status values ('connected' or 'error') and response fields. This conveys auth and connection aspects beyond the schema, though it could detail more edge cases or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is logically structured with a one-sentence summary, a categorized Args section, and a concise Response Format section. It includes exactly the details needed without unnecessary filler, and the important usage statement is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity of six optional parameters and zero annotation or output schema, the description is complete. It explains the tool's fallback behavior, connection customization approach, and example response fields with status/version/server_name/connection_source, giving an agent everything needed to call it correctly and interpret its result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. It explicitly documents all six parameters with types, optionality, and realistic examples (e.g., hostname 'localhost', port '8089', usernames like 'admin'). This goes beyond the bare schema and gives an agent actionable onboarding for each parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific action ('Check Splunk server connectivity') and clearly identifies the resource and scope (Splunk health status, version, connection info). It distinguishes itself from the sibling tools by focusing on a health/connectivity operation rather than searches, saved searches, app management, or dashboards. The mention of 'connectivity troubleshooting and server validation' reinforces its distinct purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context, stating it is 'Essential for connectivity troubleshooting and server validation' and explaining when custom connection parameters are useful ('testing different Splunk instances'). It does not explicitly enumerate when not to use it or name alternative tools, but the context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_studio_topicGet Studio TopicA

Get Dashboard Studio documentation for a specific topic. Returns comprehensive documentation with examples, schema details, and best practices.

ParametersJSON Schema
NameRequiredDescriptionDefault
topicYesDocumentation topic. Use list_dashboard_studio_topics() to see available topics. Examples: 'cheatsheet', 'definition', 'visualizations', 'configuration', 'datasources', 'framework'
versionNoSplunk version for live Help pages. Default 10.2. Supported: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.010.2

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden. It states that the tool returns 'comprehensive documentation with examples, schema details, and best practices', which is helpful. However, it does not disclose whether the tool accesses the internet (e.g., for live Help pages), any potential latency or network dependencies, or what happens if the topic is invalid. The version parameter is described as 'for live Help pages', which hints at an external lookup, but it could be more explicit about the live fetch behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded with the main purpose. It wastes no words, though it could benefit from a note about how version affects the output, but given the schema covers that, this is appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description should compensate. It mentions return content (examples, schema details, best practices) but does not specify the return format (e.g., Markdown, JSON), error handling, or whether the content is static or fetched from live help pages. Given the tool's moderate complexity (version parameter for live pages), more detail about the live fetching and failure modes would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, providing detailed descriptions for both parameters, including defaults and allowed versions. The description adds little beyond the schema, but the schema already fully defines the parameters. The description's mention of 'comprehensive documentation' reinforces the output purpose, but it does not explain how version affects the response beyond 'live Help pages'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'Dashboard Studio documentation', and the purpose 'for a specific topic'. It is distinct from siblings like list_dashboard_studio_topics because it retrieves content for one topic rather than listing topics, though it does not explicitly name a sibling to differentiate from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies its use case: when an agent needs specific topic documentation. It references list_dashboard_studio_topics() for available topics, which provides a clear prerequisite. However, it does not state when NOT to use it, such as when the agent needs a full documentation reference or a different product's docs, which would be handled by siblings like get_splunk_documentation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_troubleshooting_guideGet Troubleshooting GuideB

Get detailed Splunk troubleshooting documentation for specific topics. Returns comprehensive troubleshooting guides with diagnostics, solutions, and best practices as an embedded resource.

ParametersJSON Schema
NameRequiredDescriptionDefault
topicYesTroubleshooting topic. Use list_troubleshooting_topics() to see all available topics. Common topics include: - 'metrics-log' - About metrics.log for performance monitoring - 'splunk-logs' - What Splunk logs about itself - 'platform-instrumentation' - Platform instrumentation overview - 'search-problems' - Splunk web and search problems - 'indexing-performance' - Indexing performance issues - 'indexing-delay' - Event indexing delays - 'authentication-timeouts' - Authentication timeout issues
versionNoSplunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default)latest
auto_detect_versionNoWhether to auto-detect Splunk version from connected instance. Defaults to True.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions the resource is 'embedded' and describes content (diagnostics, solutions, best practices) but does not disclose behavior like whether it performs network calls, caching, or error handling. It also doesn't mention if it mutates anything or requires special permissions. For a read-only documentation tool, this is somewhat acceptable but still limited.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is clear and front-loaded with the core action. It efficiently conveys the purpose without redundancy. While it lacks explicit usage guidelines, that is a separate dimension; in terms of structure and length, it is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 parameters with full schema descriptions and no output schema, so the description doesn't need to explain return values. However, for a documentation retrieval tool, it could benefit from mentioning the format of the returned resource and any version-specific behavior. The tool is moderately simple, but the lack of behavioral details and alternative guidance leaves gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all parameters, including the topic and version fields with rich examples and defaults. The description itself adds no extra parameter info beyond what's in the schema, so the baseline of 3 applies. It doesn't elaborate on interactions or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches detailed Splunk troubleshooting documentation for specific topics, with a specific verb ('get') and resource ('troubleshooting guide'). It distinguishes from siblings like get_splunk_documentation and get_admin_guide by focusing on troubleshooting, though it could more explicitly differentiate from get_splunk_documentation which might overlap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool vs alternatives like list_troubleshooting_topics or get_splunk_documentation. However, the context of returning 'detailed troubleshooting guides' implies it's for in-depth problem-solving content, but no clear exclusions or alternatives are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_admin_topicsList Admin TopicsA

List all available admin guide topics with descriptions. Returns a structured list of administration topics that can be used with the get_admin_guide tool. Each topic includes:

  • Topic key for use in API calls

  • Description of what the topic covers

  • Example usage

Use this tool to discover what admin documentation is available before calling get_admin_guide with specific topics.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden of behavioral disclosure. It responsibly discloses what the response contains (topic key, description, example usage) and the tool's role as a prerequisite discovery step for get_admin_guide. Given there's no output schema, disclosing the three returned fields provides meaningful transparency. Could add error handling info or an explicit note that it returns all topics without pagination, but for a list operation this is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Efficiently written at roughly 60 words with no wasted language. The structure is well-organized: opening declarative statement, scannable bulleted list of included fields, and a closing usage directive. Every element earns its place in the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter documentation discovery tool, this is well-scoped. It covers what it returns, the structure of each topic entry, and how to use it with get_admin_guide. A minor gap: given multiple similarly-named siblings (list_available_topics, list_troubleshooting_topics), a one-word clarification of what makes 'admin' topics distinct could have further reduced ambiguity. Otherwise quite complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, which per the calibration rubric establishes a baseline of 4. The description appropriately avoids inventing parameters and doesn't waste space discussing parameters. The description's focus on return schema (topic key, description, example usage) is appropriate given the parameter-free interface.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource construction: 'List all available admin guide topics with descriptions.' It goes beyond a generic statement by differentiating itself from sibling tools like list_available_topics and list_troubleshooting_topics through explicit 'admin guide' scoping. It also anchors itself to a companion tool (get_admin_guide), which clearly positions it within the tool family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use guidance is provided: 'Use this tool to discover what admin documentation is available before calling get_admin_guide with specific topics.' While it clearly names the companion tool, it doesn't explicitly contrast itself with other similar listing siblings like list_available_topics or list_troubleshooting_topics, which would have been useful given their near-identical naming patterns.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_alert_actionsList Alert ActionsA

List alert actions installed on the connected Splunk instance, including custom actions. Returns name, label, description, is_custom, app, and param_keys. Call this before create_alert or update_alert when using a custom action so you pass the correct action name and param keys.

Outputs: 'alert_actions' array and 'count'. Security: results are constrained by the authenticated user's permissions.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It states results are constrained by the authenticated user's permissions and that it lists both standard and custom actions, which gives useful context about scope and security. However, it does not explicitly state that the operation is read-only or has no side effects, though the verb 'list' strongly implies this.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: it opens with the tool's purpose and scope, then lists the returned fields, gives a usage tip, and closes with output and security notes. Every sentence adds distinct value, and the structure makes it easy to skim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has no parameters and no output schema, the description covers everything an agent needs for correct invocation: it lists the return keys ('alert_actions' array and 'count'), explains why to call it (before create/update with custom actions), and notes permission constraints. No critical information is missing for this list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so there are no parameter meanings to explain. According to the rubric, a baseline of 4 applies for 0 params. The description appropriately devotes no space to parameters and instead focuses on outputs and usage context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists alert actions installed on the connected Splunk instance, including custom actions, and enumerates the returned fields. This is a specific verb+resource combination that leaves no ambiguity about what the tool does. It inherently distinguishes itself from sibling tools like list_triggered_alerts or list_saved_searches by naming the resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs when to call this tool: before create_alert or update_alert when using a custom action, so the correct action name and param keys are passed. This gives a concrete condition and references alternative tools, providing clear guidance on when to use this tool versus other actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_appsList AppsA

Retrieve comprehensive inventory of all installed Splunk applications including metadata (name, label, version, description, author, visibility status). Use this tool when you need to list all apps in the Splunk environment, such as for auditing, management, or troubleshooting compatibility. This tool requires no arguments.

Returns detailed app catalog with 54+ apps typically found in enterprise environments, including core Splunk apps, add-ons (TAs), custom applications, and third-party integrations.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool returns a detailed catalog with typical counts (54+ apps), content types (core apps, add-ons, custom, third-party), and metadata fields (name, label, version, description, author, visibility). This goes beyond a generic 'list' and gives concrete behavioral expectations. It implies a read-only operation, but does not explicitly state safety. Overall, it adds meaningful context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short paragraphs, front-loaded with the primary purpose. The first sentence immediately says what it does and what it returns. The second paragraph adds useful details about typical contents and volume. Every sentence contributes relevant information without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description provides clear expectations for the return: metadata fields, app categories, and approximate count. It also explains the tool's role in auditing/management. For a simple list operation with no parameters, this is complete and sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, and the description explicitly states 'This tool requires no arguments', reinforcing the schema's empty property set. The instruction indicates a baseline of 4 for zero-parameter tools. The description adds value by confirming the no-argument requirement, though it is already implied by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve comprehensive inventory of all installed Splunk applications including metadata', specifying the action (Retrieve), resource (inventory of apps), and scope (all installed). It distinguishes from siblings like list_indexes or list_users by explicitly mentioning apps and their metadata. The verb is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states 'Use this tool when you need to list all apps in the Splunk environment, such as for auditing, management, or troubleshooting compatibility', providing clear use cases. It does not explicitly mention when not to use it or name alternatives, but the context is sufficient for typical scenarios. It also notes that it requires no arguments, which is an important usage guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_available_topicsList Available TopicsA

List all available documentation topics and URI patterns for discovery. This tool helps LLMs and agentic frameworks understand what documentation topics are available across different categories:

Returns structured information about:

  • Available troubleshooting topics with descriptions

  • Available admin guide topics

  • Common SPL commands with examples

  • URI patterns for accessing documentation

  • Version support information

Use this tool first to discover what documentation is available before requesting specific topics.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey side effects and behavior. It clearly states it returns structured information and lists content categories, implying a read-only discovery operation. It lacks an explicit 'no side effects' statement, but given its nature, a score of 4 is fair.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with bullet points, but is slightly verbose. It could be more concise while keeping key information, but it earns a 4.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given it has no output schema, the description thoroughly explains what is returned (topics, descriptions, URI patterns) and provides usage context. For a discovery tool with no params, it is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the description doesn't need to explain parameters. The rule says baseline 4 for 0 params, and this is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb-resource pair: 'List all available documentation topics and URI patterns for discovery.' It clearly differentiates from sibling tools like list_troubleshooting_topics and list_admin_topics by covering all topics across categories. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises using this tool first to discover documentation before requesting specific topics, which distinguishes it from sibling access tools like get_splunk_documentation or list_troubleshooting_topics. This provides clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_cim_data_modelsList Cim Data ModelsA

List all available Splunk Common Information Model (CIM) data models. Returns structured information about all 26 CIM data models including name, description, use cases, required tags, and deprecation status. Use this to discover what CIM models are available before calling get_cim_reference.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool returns 'structured information' and lists specific fields (name, description, use cases, required tags, deprecation status), which is useful behavioral context. It doesn't cover auth, errors, or other runtime aspects, but for a list operation this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentencesβ€”one for purpose, one for usage guidance and return details. No wasted words; the description is front-loaded and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool with no output schema, the description is complete: it specifies the scope (26 models), the type of output (structured information), and the expected contents. It also gives a practical use case, ensuring the agent knows exactly when to invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. There is no parameter documentation needed since the schema is empty. The description adds no parameter info, but none is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'List all available Splunk Common Information Model (CIM) data models' with a specific verb and resource. It also differentiates the scope by mentioning 'all 26' and details what information is returned, plus explicitly references the sibling tool 'get_cim_reference' to distinguish its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use the tool: 'before calling get_cim_reference.' This is clear context for a specific use case. However, it doesn't discuss alternatives or when not to use it, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_config_filesList Config FilesA

List common Splunk configuration files (.conf) with descriptions. Returns structured information about configuration files that can be used with get_config_spec() to retrieve detailed specification documentation.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description is the sole source of behavioral information. It states that the tool lists 'common' configuration files, implying a scope, and that it returns structured information. It does not mention any side effects (none likely), permissions, or error conditions, but for a read-only listing operation the provided details are reasonable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences. It includes the core function and a note on its relationship to get_config_spec, with no redundant or filler content. Well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description is complete. It clarifies what it does, the scope ('common'), and the return type ('structured information'), and even indicates how to use the result. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so schema coverage is complete. There is nothing to explain, and the description adds no unnecessary parameter details. This is ideal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'List common Splunk configuration files (.conf) with descriptions.' It uses a specific verb ('List') and resource ('configuration files'), and distinguishes from the sibling get_config_spec by indicating that returned info can be used with that tool for detailed specs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool by noting that the returned structured information can be used with get_config_spec() for detailed documentation. This suggests it is for obtaining an overview before drilling down. However, it does not explicitly state alternatives or when not to use it, so it is slightly less than perfect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_dashboardsList DashboardsA

List dashboards in Splunk (Simple XML and Dashboard Studio). Returns metadata including name, label, type (classic/studio), app, owner, permissions, sharing level, last updated, and Splunk Web viewing URLs.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoFilter by app context. Default: '-' (all apps)-
countNoMax results to return. 0=all, default: 50 for performance
ownerNoFilter by owner. Use 'me' for current user's dashboards, 'nobody' for shared dashboards, or a specific username. Default: 'nobody'nobody
offsetNoResult offset for pagination. Default: 0
type_filterNoFilter by type: 'classic', 'studio', or 'any'. Default: 'any'any
private_onlyNoIf True, only return private dashboards (sharing='user'). Works with any owner filter. Default: False
search_filterNoFilter results (e.g., 'name=*security*')
my_dashboards_onlyNoIf True, only return dashboards owned by the current user. Overrides 'owner' parameter. Default: False

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It does disclose the return scope (classic/studio dashboards) and the metadata fields, but does not mention pagination behavior, permission requirements, or performance implications (e.g., the 'count' parameter default for performance). The description is informative but not fully transparent about edge behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the action stated upfront. Every phrase earns its place: it names the target, the scope, and the key return fields without redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with no output schema, the description provides a clear list of return metadata and the scope. It does not mention filtering or pagination in the description, but the schema covers those. The description is sufficiently complete for an agent to understand the tool's primary function and expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each of the 8 parameters having a meaningful description. The description adds no parameter-specific semantics beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('List dashboards in Splunk') and distinguishes the scope (Simple XML and Dashboard Studio). It clearly differentiates from sibling list tools like list_indexes and list_apps by naming the resource and even listing the metadata fields returned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a listing use case but does not explicitly state when to use this tool vs alternatives like get_dashboard_definition (for a single dashboard's definition) or create_dashboard. No exclusion or comparison to sibling tools is given, leaving usage context implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_dashboard_studio_topicsList Dashboard Studio TopicsA

List all available Dashboard Studio documentation topics. Returns structured information about available topics including cheatsheet, definition schema, visualizations guide, and configuration options. Use this to discover what Dashboard Studio documentation is available.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description implies a read-only listing operation but does not explicitly state side effects or lack thereof. It provides no detail on potential edge cases or rate limits, which would be beneficial given the lack of annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences convey the purpose, the content returned, and a usage hint. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

As a simple listing tool with no parameters and no output schema, the description provides enough context about what topics are covered. It could optionally mention the format of the returned structure, but that is not essential for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters and the schema has full coverage (0 params), so there is no additional meaning to add. The description appropriately does not elaborate on non-existent parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all available Dashboard Studio documentation topics, specifying distinct categories such as cheatsheet, definition schema, visualizations guide, and configuration options. This distinguishes it from sibling list_* tools that target other domains.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises when to use the tool ('Use this to discover what Dashboard Studio documentation is available'). Does not explicitly mention when not to use, but the specificity to Dashboard Studio makes the context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_indexesList IndexesA

Retrieve all accessible data indexes from the Splunk instance. Use this to discover which indexes you can query when building searches or troubleshooting data availability. Returns customer indexes (excludes internal system indexes like _internal and _audit for readability). Results are constrained by the current user's permissions.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses that it excludes internal system indexes and that results are permission-constrained. This adds useful behavioral context beyond just 'list indexes'. It's not super detailed but sufficient for a listing tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose, then specifics. No fluff, each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, zero-output-schema tool, the description provides key context: what it returns, what it excludes, and permission constraints. Missing explicit return structure but adequate given no schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameters to describe. The schema coverage is 100% (trivially). The description adds no parameter-specific info because there is none needed. Baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Retrieve all accessible data indexes' with a specific resource (data indexes) and scope (accessible). It distinguishes from sibling tools like run_splunk_search or list_saved_searches by focusing on index discovery for querying. The verb 'Retrieve' and resource 'data indexes' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states when to use it ('when building searches or queries') and explains context (returns only customer indexes). It doesn't explicitly discuss when NOT to use it or name alternatives, but given the siblings are mostly search/configuration tools, the purpose is clear enough. It could explicitly say 'use this to find the right index before querying' but implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_kvstore_collectionsList Kvstore CollectionsA

List KV Store collections with basic schema details. Use this to discover available KV stores for lookups, configuration, or caching, optionally filtering by app.

Outputs: array of collections with name, fields, accelerated_fields, replicated; and total count. Security: results are constrained by the authenticated user's permissions.Args: app (str, optional): Optional app name to filter collections

ParametersJSON Schema
NameRequiredDescriptionDefault
appNo

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses security constraint and outputs, but is silent on pagination, rate limits, or whether it is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise with an intro, outputs, security note, and argument description. Slight duplication in the args section.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, outputs, security, and filter param. However, no info on pagination or error cases, but those may not be critical for a list operation. Good given no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It mentions the app param and its purpose, but no details on accepted values or behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists KV Store collections with schema details aggregates. It distinguishes from siblings like list_indexes by naming the resource type. It also mentions selective filter by app.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It suggests use for discovery, lookups, configuration, or caching, but does not explicitly tell when to use it versus alternatives. Could be improved by mentioning when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_lookup_definitionsList Lookup DefinitionsB

List lookup definitions (transforms) in Splunk. Returns metadata including name, type, associated filename, fields configuration, app, owner, and permissions. Lookup definitions specify how CSV files or external lookups are used in searches.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoFilter by app context. Default: '-' (all apps)-
countNoMax results to return. 0=all, default: 50 for performance
ownerNoFilter by owner. Default: 'nobody' (all users)nobody
offsetNoResult offset for pagination. Default: 0
search_filterNoFilter results (e.g., 'filename=*.csv')

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It offers some transparency by stating that the tool 'returns metadata including name, type, associated filename, ... permissions', which tells the agent the nature and content of the result. However, it does not explicitly state that the operation is read-only, nor describe pagination behavior, authentication needs, or possible error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, consisting of three targeted sentences that state the purpose, define the resource type, and list expected return fields. It is well-structured and free of filler, though it could be slightly tighter if it omitted the final explanatory sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a listing tool, the description captures the core purpose and key outputs, but it does not clarify the relationship to similar sibling tools or explain how filtering/pagination parameters affect behavior. Given there is no output schema and no annotations, the description is adequate but misses opportunities to give the agent fuller operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% description coverage, so each parameter already has clear semantics and defaults. The description supplies domain context about lookup definitions but does not deepen the meaning of specific parameters like app, owner, or search_filter beyond what the schema already says, so the baseline score of 3 is maintained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('List lookup definitions') and resource ('transforms in Splunk'), so it has specificity beyond a tautology. However, it does not explicitly distinguish this tool from the closely related sibling 'list_lookup_files', so it falls short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given about when to use this tool versus alternatives such as list_lookup_files or run_splunk_search. The description only states what the tool does, leaving the agent to infer appropriate use cases without exclusionary or comparative context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_lookup_filesList Lookup FilesA

List CSV lookup table files in Splunk. Returns metadata including name, filename, app, owner, sharing/permissions, and last updated time. Use this to discover available lookup files. To view the actual CSV content, use run_splunk_search with '| inputlookup '.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoFilter by app context. Default: '-' (all apps)-
countNoMax results to return. 0=all, default: 50 for performance
ownerNoFilter by owner. Default: 'nobody' (all users)nobody
offsetNoResult offset for pagination. Default: 0
search_filterNoFilter results (e.g., 'name=*geo*')

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It does describe the output metadata, but does not disclose whether the operation has side effects (it appears read-only) or any permission requirements. Since it's a list operation, the risk is low, but the description does not explicitly state its non-destructive nature. This is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of three short sentences that pack purpose, output summary, usage guidance, and an alternative. There is no fluff, and the most important information (the listing action) is front-loaded. Each sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with no output schema and fully described parameters, the description is complete. It informs the agent what the tool returns, when to use it, and how to get more detailed content. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema describes all 5 parameters with descriptions and default values, achieving 100% coverage. The description does not add parameter-specific details beyond what the schema provides, but it does mention the purpose of filtering via 'discover available lookup files' implying the need for filters. Baseline 3 is appropriate since schema covers the parameters fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: 'List CSV lookup table files in Splunk' and specifies the returned metadata fields (name, filename, app, owner, permissions, last updated). It is specific and unambiguous, distinguishing it from generic listing tools by focusing on lookup files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context ('Use this to discover available lookup files') and directs to an alternative tool for viewing content ('use run_splunk_search with '| inputlookup <filename>''). It lacks explicit 'when not to use' guidance, but the alternative is clearly stated, making it easy for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_saved_searchesList Saved SearchesA

List saved searches with ownership, schedule, visibility, and permission metadata. Use this to discover available reports/automations and to filter by owner/app/sharing. Results reflect only saved searches the current user can access.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoFilter by application name (optional)
ownerNoFilter by owner name (optional)
sharingNoFilter by sharing level (optional)
include_disabledNoInclude disabled saved searches (default: False)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It adds meaningful context: results include ownership, schedule, visibility, and permission metadata, and results are limited to saved searches the current user can access. It does not mention pagination, ordering, or output shape, but for a list tool this is reasonably transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences and immediately states the core purpose. Every sentence adds value: what is listed, how to use it, and the access limitation. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a straightforward list operation with four optional well-documented parameters and no output schema. The description covers purpose, filters, metadata returned, and access scope, which is sufficient for an agent to select and invoke it correctly. Some minor gaps remain around pagination and exact return formatting, but they are not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already explains all four parameters. The description mostly restates filtering by owner/app/sharing, which adds little beyond the schema. The baseline of 3 applies because the structured fields carry the semantic weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') with a clear resource ('saved searches') and enriches it with metadata types (ownership, schedule, visibility, permission). It distinguishes itself from siblings like get_saved_search_details or run_splunk_search by focusing on discovery and filtering of saved searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use the tool: 'Use this to discover available reports/automations and to filter by owner/app/sharing.' It also communicates an access boundary, but does not name alternative tools for different use cases (e.g., get_saved_search_details for a single saved search).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_sourcesList SourcesA

Discover and enumerate all available data sources from the configured Splunk instance using the metadata command. This tool provides a comprehensive inventory of data sources across all indexes, helping with data discovery, troubleshooting, and understanding the data landscape in your Splunk environment. Sources represent the origin points of data such as log files, network streams, databases, and other data inputs.

Use Cases:

  • Data discovery and cataloging

  • Troubleshooting missing data sources

  • Understanding data flow and origins

  • Planning data retention and archival

  • Security analysis and audit trails

Response Format: Returns a dictionary with 'status' field and 'data' containing:

  • sources: Sorted array of all data source paths/identifiers

  • count: Total number of unique sources discovered

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full disclosure burden. It does well by revealing the underlying command ('metadata'), framing the operation as a read-only discovery, and detailing the response structure (dictionary with status, data.sources sorted array, and count). However, it doesn't describe error handling, empty-result behavior, potential performance cost of the metadata command, or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections (overview, use cases, response format) and scannable bullet points. The key information is front-loaded. It's slightly verbose with the five-item use-case list, but every section earns its place and the response-format section is genuinely useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless tool with no output schema or annotations, this description covers all bases: it explains what the tool does, why it exists, the exact response structure, and typical use cases. The inline response format effectively substitutes for a formal output schema. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, which sets a baseline of 4 per the rubric. There's nothing more the description needs to explain about parameters, and the schema is vacuous (empty object), so no information is missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource: 'Discover and enumerate all available data sources from the configured Splunk instance using the metadata command.' It clearly scopes to 'all indexes' and defines what sources are (origin points like log files, network streams). However, it doesn't explicitly distinguish itself from conceptually similar siblings like list_indexes or list_sourcetypes, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear list of use cases (data discovery, troubleshooting missing sources, retention planning, security analysis) that tell an agent when to invoke this tool. However, it doesn't mention alternatives or exclusion criteria β€” it never says when NOT to use it or how it differs from similar list_* siblings β€” so it gets a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_sourcetypesList SourcetypesA

Discover and enumerate all available sourcetypes from the configured Splunk instance using the metadata command. Sourcetypes define how Splunk interprets and processes different types of data, controlling parsing rules, field extractions, and indexing behavior. This tool returns a comprehensive list of sourcetypes present in your Splunk environment, essential for data modeling and search optimization.

Use Cases:

  • Data modeling and CIM compliance

  • Understanding data variety and formats

  • Troubleshooting parsing and extraction issues

  • Planning data preprocessing and transformations

  • Security analysis and event correlation

  • Building comprehensive search queries

Response Format: Returns a dictionary with 'status' field and 'data' containing:

  • sourcetypes: Sorted array of all sourcetype identifiers

  • count: Total number of unique sourcetypes discovered

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden. It discloses that the tool uses the metadata command and specifies the exact response shape: a dictionary with 'status' and 'data' containing a sorted sourcetypes array and count. This makes the read-only, list-producing behavior clear, though it does not discuss auth or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an opening summary, a bulleted Use Cases section, and a Response Format section. It is easy to scan and front-loaded, though some bullets are generic and slightly redundant with the opening mention of data modeling and search optimization.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, zero-parameter tool with no output schema, the description is fully self-contained. It explains what sourcetypes are, when the tool is useful, how it works, and exactly what the returned data will contain, so an agent has enough context to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema, so there is no parameter-level meaning to add. The baseline for a no-parameter tool is 4, and the description instead adds value by explaining the response payload, which helps the agent understand what to expect after invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence clearly states the tool's purpose: 'Discover and enumerate all available sourcetypes from the configured Splunk instance using the metadata command.' It names a specific resource (sourcetypes), an action (list/enumerate), and distinguishes itself from sibling tools like list_sources or list_indexes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'Use Cases' section covering data modeling, CIM compliance, parsing troubleshooting, and search query building, which gives the agent clear context for when to use this tool. It does not explicitly mention when not to use it or name alternative tools, so it stops short of full exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_spl_commandsList Spl CommandsA

List common SPL (Search Processing Language) commands with descriptions. Returns a structured list of SPL commands that can be used with the get_spl_reference tool. Each command includes:

  • Command name for use in API calls

  • Description of what the command does

  • Example usage

Note: This list includes the most common commands, but get_spl_reference supports many more SPL commands beyond those listed here.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it reveals the return structure (fields), indicates the list is not exhaustive ('most common'), and explains the purpose of the output. This sets accurate expectations for the agent without hiding the limitation of coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a clear lead sentence followed by a scannable bullet list and a short note. Every sentence adds value, and the structure is easy to parse. It earns a high score for efficiency, though it could be slightly tighter by removing the 'Note:' phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, the description covers the essentials: what it does, what it returns, and how it relates to get_spl_reference. It could mention whether authentication is needed or return size limits, but those are likely not critical for a list command. The note about coverage is a nice touch that prevents over-reliance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters in the schema, so the baseline is 4. The description does not need to add parameter-level details since there are none. The description's mention of the output structure (command name, description, example) is helpful but not required for parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists common SPL commands with descriptions, but it could be more specific about its relationship to the sibling get_spl_reference tool. The verb 'list' plus resource is clear, and the output structure (command name, description, example) is described. It distinguishes itself from siblings by noting it's a curated subset for use with get_spl_reference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions the tool can be used with get_spl_reference, providing context on when to use it. It also notes that get_spl_reference supports more commands, helping users decide between the two. However, it does not explicitly contrast with other list_* tools or state 'use this when...'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_triggered_alertsList Triggered AlertsA

List fired alerts and their details. Use this to review recent triggered alerts, including saved search name, trigger time, owner/app, and trigger reason. Supports a name filter and a max results cap. Note: Splunk's fired alerts feed may not strictly filter by time; earliest/latest are advisory.

ParametersJSON Schema
NameRequiredDescriptionDefault
countNoMaximum number of alert groups to return (default: 50)
searchNoCase-insensitive substring filter applied to alert group name
latest_timeNoAdvisory filter for latest trigger time (default: 'now')now
earliest_timeNoAdvisory filter for earliest trigger time (default: '-24h@h')-24h@h

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does well by disclosing a non-obvious behavioral quirk: Splunk's fired alerts feed may not strictly filter by time, and earliest/latest are advisory. It also mentions the max results cap. It does not detail permissions or response shape, but the key operational caveat is transparently surfaced.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the core purpose, followed by practical use context and an important caveat. Every sentence earns its place, and there is no redundant restating of the tool name or schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with no output schema or annotations, the description provides sufficient context: what is returned, how to filter, and the advisory nature of time constraints. It stops short of describing result format or edge cases, but it is complete enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing baseline meaning for all four parameters. The description adds value by clarifying that 'search' is a name filter, 'count' is a max results cap, and the time parameters are only advisoryβ€”beyond what the schema states. This enriches the parameter semantics meaningfully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('fired alerts'), and clearly distinguishes the tool from siblings like list_saved_searches or run_splunk_search by focusing on triggered alert details. The listed fields (saved search name, trigger time, owner/app, trigger reason) make the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Use this to review recent triggered alerts' provides clear context for when the tool is appropriate. It does not explicitly name alternatives or exclusions, but the purpose is distinct enough from sibling tools that the usage guidance is adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_troubleshooting_topicsList Troubleshooting TopicsA

List all available troubleshooting topics with descriptions. Returns a structured list of troubleshooting topics that can be used with the get_troubleshooting_guide tool. Each topic includes:

  • Topic key for use in API calls

  • Human-readable title

  • Description of what the topic covers

  • Example usage

Use this tool to discover what troubleshooting documentation is available before calling get_troubleshooting_guide with specific topics.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses that the tool returns a structured list with specific fields (topic key, title, description, example usage) and that it is read-only in nature (listing). However, it does not mention potential pagination, rate limits, or whether the list is exhaustive, which would be useful for a listing tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. It opens with a clear one-sentence summary, then uses a bulleted list to detail the return fields, and ends with a usage directive. Every sentence adds value, and the structure is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description provides sufficient context: it explains the return fields, the purpose, and the workflow with get_troubleshooting_guide. It could be slightly more complete by noting whether the list is sorted or if there are any limitations, but for a simple listing tool, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100% (empty schema). The description adds value by explaining the return structure and the purpose of the topic keys, which is essential for using the output with get_troubleshooting_guide. Since there are no parameters, the description's explanation of the output fields compensates for the lack of parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all available troubleshooting topics with descriptions, and explicitly notes it returns a structured list for use with get_troubleshooting_guide. This distinguishes it from sibling tools like list_admin_topics and list_available_topics by specifying the troubleshooting domain and its integration with a specific companion tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'Use this tool to discover what troubleshooting documentation is available before calling get_troubleshooting_guide with specific topics.' This provides clear usage context and names the alternative tool, making the workflow explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_usersList UsersA

Retrieve comprehensive inventory of all Splunk users and their properties. Use this tool when you need to list all users in the Splunk environment, such as for security audits, user management, or understanding access patterns. This tool requires no arguments.

Response Format: Returns a dictionary with 'status' field indicating success/error and 'data' containing:

  • count: Total number of users found

  • users: Array of user objects with username, realname, email, roles, type, and defaultApp

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavior. It explains that the tool returns a dictionary with a 'status' field and 'data' containing 'count' and 'users' array with properties (username, realname, email, roles, type, defaultApp). This clarifies output format and the nature of the operation (a retrieval). However, it does not mention potential limitations like pagination or permission requirements, but for a simple list operation, the disclosed behavior is adequate for agent decision-making.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear first sentence stating purpose, followed by explicit usage guidance, and a separate 'Response Format' section. It is not overly verbose, though the enumeration of use cases adds a bit of extra length. Overall, it is efficiently written and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description is quite complete. It covers the purpose, usage context, and details the return format (including the structure of the 'users' array). The only minor gap is the absence of note about potential large responses or error cases, but that is not critical for this straightforward operation. It satisfies the requirements for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the description explicitly states 'This tool requires no arguments.' With schema description coverage at 100% (since there are no properties), there is nothing technical to clarify. The baseline for zero parameters is 4, and the description reinforces that fact, earning the full score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Retrieve comprehensive inventory of all Splunk users and their properties.' It uses a specific verb ('Retrieve') and resource ('all Splunk users'), and it distinguishes itself from siblings by listing the exact use cases (security audits, user management, access patterns). No other sibling tool appears to focus on listing users, so it stands apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'Use this tool when you need to list all users in the Splunk environment, such as for security audits, user management, or understanding access patterns.' It also notes that it requires no arguments, which is useful for an agent deciding to call it. There are no explicit alternatives mentioned, but none exist among the siblings, so the guidance is complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflowsList WorkflowsA

List all available workflows from core and contrib sources.

This tool provides a comprehensive listing of troubleshooting workflows available in the MCP Server for Splunk system. It discovers and lists both built-in core workflows and user-contributed workflows from the contrib directory.

Output Formats:

  • detailed: Complete workflow information with descriptions and metadata (default)

  • summary: Brief overview with workflow IDs, names, and basic statistics

  • ids_only: Simple list of workflow IDs for programmatic use

  • by_category: Workflows organized by category (security, performance, etc.)

Workflow Sources:

  • Core Workflows: Built-in system workflows (missing_data_troubleshooting, performance_analysis)

  • Contrib Workflows: User-contributed workflows from contrib/workflows/ directory

Key Information Provided:

  • Workflow ID and human-readable name

  • Description and purpose of each workflow

  • Number of tasks and dependency information

  • Source (core vs contrib) and validation status

  • Category and organizational information

  • Integration instructions for dynamic troubleshoot agent

When to use

  • Use when you need to discover which workflows exist before running one

  • Use to filter by category or get just workflow IDs for programmatic selection

Arguments

  • format_type (optional): "detailed" (default), "summary", "ids_only", or "by_category"

  • include_core (optional): Include built-in workflows (default: true)

  • include_contrib (optional): Include contrib workflows (default: true)

  • category_filter (optional): Filter by category (e.g., "security", "performance")

Outputs

  • Workflow listings in the requested format, discovery metadata, and category summaries

  • Note: Only workflows available in this server are listed (core + any contrib present)

Perfect for discovering available troubleshooting capabilities and selecting the right workflow for specific Splunk problems.

ParametersJSON Schema
NameRequiredDescriptionDefault
format_typeNodetailed
include_coreNo
category_filterNo
include_contribNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly explains what the tool does: lists workflows from core and contrib, supports multiple output formats, and notes that 'Only workflows available in this server are listed.' It does not explicitly state it is a read-only operation, but that is implied by the listing nature. It adds significant context beyond mere existence, covering output formats, sources, and included information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but well-structured with clear headers (Output Formats, Workflow Sources, Key Information, When to use, Arguments, Outputs). It front-loads the primary purpose and uses organized sections. While every sentence contributes information, there is some redundancy (e.g., the 'Outputs' section partially duplicates earlier mentions), but overall it is efficient for the level of detail provided.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 4 parameters, no output schema, and no annotations, the description is exceptionally complete. It details all parameter options, expected return content, sources, and integration context. The agent can select and invoke the tool with full understanding of its behavior and outputs. This is a model of thorough contextual disclosure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description fully compensates by explaining each parameter in detail. For example, it specifies format_type with allowed values ('detailed', 'summary', 'ids_only', 'by_category') and defaults, and similarly describes include_core, include_contrib, and category_filter with usage context. This adds meaning far beyond the raw schema, making it highly actionable for the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'List all available workflows from core and contrib sources.' It uses a specific verb ('list') and resource ('workflows') with scope, and it distinguishes itself from sibling tools by focusing specifically on workflows (vs indexes, apps, etc.). The detailed breakdown of output formats and sources reinforces purpose clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'When to use' section with explicit guidance: 'Use when you need to discover which workflows exist before running one' and 'Use to filter by category or get just workflow IDs for programmatic selection.' It provides clear context, though it does not explicitly state exclusions or alternatives. This is strong but lacks a 'when not to use' clause, so a 4 is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

manage_appsManage AppsA

Manage Splunk application lifecycle operations including enable, disable, restart, and reload actions. Use this tool when you need to change the state of a Splunk app, such as enabling a disabled app, restarting for configuration changes, or troubleshooting issues. This tool provides essential app management capabilities for maintaining Splunk environments, troubleshooting app issues, and controlling app availability. Operations affect app state and may require Splunk restart for some changes to take effect.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesManagement action to perform. Valid options: - 'enable': Activate the application - 'disable': Deactivate the application - 'restart': Disable then enable the application - 'reload': Refresh application configuration
app_nameYesName of the Splunk application to manage. Examples: - 'search': Core Splunk Search app - 'splunk_monitoring_console': Monitoring Console - 'my_custom_app': Custom business applications

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions that some changes may require Splunk restart, which is useful behavioral info. However, it doesn't disclose other potential side effects like downtime, permission requirements, or whether operations are synchronous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core purpose. Four sentences with information density, but the middle sentence about 'maintaining Splunk environments' is generic filler that could be trimmed. Still well-structured overall.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema covers parameters well and there's no output schema, the description is adequate but not thorough. It misses potential caveats like permissions required or impact on running search heads. The restart note helps, but more behavioral context would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% - both parameters have rich descriptions including enum values and examples. The description adds little beyond restating the actions. Baseline 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Manage Splunk application lifecycle operations' with specific actions (enable, disable, restart, reload), making the tool's purpose immediately obvious and distinguishing it from sibling tools like list_apps or get_configurations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this tool when you need to change the state of a Splunk app' and gives examples. It implies when not to use (i.e., for listing or viewing) but doesn't name alternative tools. Good context, could be more explicit about exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

meMeA

Retrieve information about the currently authenticated Splunk user. Use this tool whenever you need to check the current user's details, permissions, roles, or capabilities, such as for debugging access issues, understanding available actions, or verifying user context in Splunk environments. This tool requires no arguments.

Response Format: Returns a dictionary with 'status' field indicating success/error and 'data' containing:

  • username: Current authenticated username

  • realname: Full display name

  • email: Email address

  • roles: Array of assigned role names

  • type: User type (e.g., 'Splunk')

  • defaultApp: Default application for the user

  • capabilities: Array of capabilities granted through roles

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden. It clearly states this is a read operation ('Retrieve information') and outlines the response format, which implies no side effects. It doesn't explicitly state 'read-only' or 'no destructive effects,' but the language is unambiguous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise but comprehensive: purpose, usage scenarios, and detailed response format. Every sentence serves a purpose, front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with no output schema, the description fully covers what it does, when to use it, and what it returns. It's complete for this simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters-newline(schema with no properties), so the baseline is 3. The description explicitly states 'requires no arguments,' which adds clarity. No parameter details needed since there are none.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve information about the currently authenticated Splunk user' – a specific verb and resource. It distinguishes itself from siblings like list_users (which likely lists all users) by explicitly focusing on the current user.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'whenever you need to check the current user's details, permissions, roles, or capabilities, such as for debugging access issues, understanding available actions, or verifying user context in Splunk environments.' This clearly directs when to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sentry_testSentry TestA

Test Sentry integration by sending traces, spans, and optionally errors.

This tool creates a complete transaction with nested spans to verify that tracing is working correctly in your Sentry dashboard.

ParametersJSON Schema
NameRequiredDescriptionDefault
test_typeNoType of test to run: - "full": Complete test with transaction, spans, and message - "trace": Only create transaction and spans - "error": Only trigger an error - "message": Only send a test messagefull
trigger_errorNoIf True, triggers a test exception to verify error tracking.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden of behavioral disclosure. It clearly states that the tool sends traces, spans, and optionally errors, and creates a transaction with nested spans. It could mention side effects more thoroughly, such as duplicate events or permission requirements, but the primary behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the first sentence states the verb and purpose, and the second adds useful context about the transaction structure. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two optional parameters, full schema coverage, and an output schema, the description is complete. It explains what the tool does, why it is used, and what the user can expect to verify in the Sentry dashboard.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptive parameter explanations for test_type and trigger_error. The description only adds general context about optional errors, so it does not substantially improve parameter understanding beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Test Sentry integration') and clearly names the resource and actions: sending traces, spans, and optionally errors. It further clarifies that a complete transaction with nested spans is created, which distinguishes it from the unrelated Splunk sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: to verify that tracing is working correctly in the Sentry dashboard. It does not provide explicit exclusions or alternative tool mentions, but no Sentry alternatives exist among the sibling tools, so this is acceptable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_alertUpdate AlertA

Update an existing Splunk alert (a scheduled saved search with trigger conditions and optional actions). Omit any field you do not want to change. Search, schedule, trigger, and tracking fields are always patched.

actions_mode (only applies when actions is sent): patch (default): Change only the listed actions and params. Other actions and unspecified params on those actions stay as they are. Use this to change one setting (for example only email.to). Set enabled=false on an action to turn that action off without touching the others. override: The actions list becomes the full set. Listed actions are enabled with the given params; any action currently on the alert but missing from the list is disabled. Use this when you want the alert to have exactly these actions.

Call list_alert_actions first for custom actions and their param names.

ParametersJSON Schema
NameRequiredDescriptionDefault
appNoApp context for lookup
nameYesAlert name (required)
ownerNoOwner context for lookup
searchNoNew SPL query
actionsNo[{name, params, enabled}]
alert_typeNoTrigger type
is_visibleNo
alert_trackNoShow in Triggered Alerts
descriptionNoNew description
latest_timeNoNew dispatch latest time
actions_modeNopatch|override (default: patch)patch
cron_scheduleNoNew cron schedule
earliest_timeNoNew dispatch earliest time
alert_severityNo1-5
alert_conditionNoCustom trigger search
alert_thresholdNoThreshold
alert_comparatorNoComparator
alert_digest_modeNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states that certain fields are always patched and explains the update semantics for actions (partial vs full replacement). It also implicitly warns that actions_mode only applies when actions is sent. While it doesn't specify response format or error handling, it covers the key behavioral nuances well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, using line breaks to separate the main function from the details of actions_mode. It is front-loaded with the core purpose and then provides necessary elaboration without redundancy. Every sentence contributes to understanding the tool's behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (18 parameters, update semantics, and no output schema), the description is quite complete. It explains the patching behavior, actions modes, and necessary prerequisites. However, it doesn't explicitly state what the tool returns (e.g., success indicator), though this might be inferred. It also could mention potential errors (e.g., alert not found), but overall it's comprehensive for an update operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (89%), so the description doesn't need to re-explain each parameter. It adds value by explaining the actions_mode parameter in detail, which the schema only briefly covers as 'patch|override'. The description's note that actions_mode only applies when actions is sent is additional semantic clarity not in the schema, earning a baseline 3 with modest enhancement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates an existing Splunk alert, specifying it as a scheduled saved search with trigger conditions and actions. It distinguishes it from similar operations like create_alert and update_saved_search, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool (to update an alert) and provides critical operational guidance: omitting fields leaves them unchanged, and it explicitly instructs to call list_alert_actions first for custom actions. It also details the two modes (patch vs override) and when to choose each, which is essential for correct usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

user_agent_infoUser Agent InfoA

Return request headers and context details for debugging.

Includes all HTTP headers (with sensitive values masked) and core context metadata.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses that sensitive values are masked)Skip useful detail. It doesn't mention read-only nature or any side effects (likely none). For a zero-param debug tool, this is acceptable but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, information-dense, front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an output schema, the description covers what it returns, mentions sensitive value masking, and debugging context. Could specify what 'core context metadata' includes, but sufficient for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has zero parameters, so description need not explain parameters. Base score 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns request headers and context details for debugging. The verb 'return' is specific, the resource is well-defined, and it distinguishes from the Splunk-centric sibling tools which all deal with searches, dashboards, or configs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for debugging, which gives context but does not explicitly state when not to use it or exclusions. However, since no sibling tool serves this purposeholistically, it's clear when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workflow_builderWorkflow BuilderA

Interactive tool for creating, editing, and validating custom workflows.

This tool provides comprehensive workflow development capabilities for creating custom troubleshooting workflows that integrate with the MCP Server for Splunk dynamic troubleshooting system. It supports multiple modes of operation to accommodate different workflow development needs.

Modes:

  • create: Interactive workflow creation with guided prompts

  • edit: Modify existing workflow definitions with validation

  • validate: Comprehensive validation of workflow structure and dependencies

  • template: Generate pre-built workflow templates for common use cases

  • process: Process and validate finished workflow definitions

Key Capabilities:

  • Step-by-step workflow creation with validation

  • Template generation for common workflow patterns

  • Comprehensive validation including dependency analysis

  • JSON output generation with proper formatting

  • Integration testing and compatibility verification

  • Processing of complete workflow definitions

Validation Features:

  • Schema compliance verification

  • Circular dependency detection

  • Tool availability checking

  • Context variable validation

  • Integration compatibility assessment

When to use

  • Use to create new workflows from templates or from scratch

  • Use to edit or validate an existing workflow JSON before contributing or running it

  • Use to generate templates and examples for standard categories (security, performance, data quality)

Arguments

  • mode (optional): "create", "edit", "validate", "template", or "process" (default: "create")

  • workflow_data (optional): JSON string or object when editing/validating/processing

  • template_type (optional): Template key when mode="template" (e.g., "minimal", "security")

  • file_path (optional): Path to workflow file when mode="validate"

Outputs

  • Structured results including validation summaries, templates, or processed workflow data

  • Ready-to-validate workflow JSON for discovery via list_workflows

Perfect for workflow contributors who need guided assistance in creating well-structured, validated workflows for contrib or core catalogs.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNocreate
file_pathNo
template_typeNominimal
workflow_dataNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It does disclose key behaviors: multiple modes, interactive creation, validation features (dependency analysis, circular detection), JSON output generation. However, it lacks specifics about side effects (e.g., does 'edit' modify in-place or return new JSON? does 'validate' require file system access?), authentication needs, and the exact output structure. The description adds moderate context beyond the bare schema, but leaves ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: Modes, Key Capabilities, Validation Features, When to use, Arguments, Outputs. Each section is concise and scannable. Sentences are direct and without fluff. It front-loads the core purpose and then details specifics. Length is appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 modes, 4 mixed parameters, no annotations, no output schema), the description covers the main dimensions: modes, capabilities, validation features, usage guidance, and parameter semantics. It doesn't specify exact response format or error handling, but the 'Outputs' section gives a general idea. The description is sufficient for an agent to understand what the tool does and when to invoke it, though edge cases (e.g., what if mode=edit without workflow_data?) are not clarified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides minimal info with 0% description coverage in schema. The description compensates reasonably by explaining each parameter: mode lists allowed values, workflow_data for editing/validating/processing, template_type for template mode, file_path for validate mode. It adds meaning ('JSON string or object'), but doesn't provide format details, allowed modes enum (though lists them in prose), or examples. Since schema coverage is low, the description's per-parameter details are valuable, hence a 3 rather than 2.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: an interactive tool for creating, editing, and validating custom workflows. It explicitly lists various modes and capabilities, and distinguishes itself from siblings by focusing on workflow construction rather than execution. The verb 'create/edit/validate' plus resource 'custom workflows' is specific, though it bundles multiple operations which slightly dulls clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a 'When to use' section with explicit use cases such as creating new workflows, editing/validating before contributing, and generating templates. It doesn't explicitly state when NOT to use it, but the sibling tools (e.g., list_workflows for discovery, run_splunk_search for execution) imply clear boundaries. The several 'use to' bullets are helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workflow_requirementsWorkflow RequirementsA

Get comprehensive requirements and schema information for creating custom workflows.

This tool provides detailed documentation for creating custom troubleshooting workflows that integrate with the MCP Server for Splunk dynamic troubleshooting system. It includes complete schema definitions, available tools, context variables, validation rules, and integration guidelines.

Output Formats:

  • detailed: Complete requirements with examples and explanations (default)

  • schema: JSON schema definitions for validation tools

  • quick: Quick reference for experienced contributors

  • examples: Example workflow structures and common patterns

Key Information Provided:

  • WorkflowDefinition and TaskDefinition schema structures

  • Complete list of available Splunk tools with descriptions

  • Context variables and their usage patterns

  • Validation rules and constraints

  • Integration points with dynamic troubleshoot agent

  • Best practices for workflow design and task creation

When to use

  • Use at the beginning of authoring to understand schemas and constraints

  • Use during development for quick reference to context variables and available tools

  • Use in CI/validation tooling to fetch schemas for automated checks

Arguments

  • format_type (optional): "detailed" (default), "schema", "quick", or "examples"

Outputs

  • Full schema and best practices (detailed), just schemas (schema), quick cheat sheet (quick), or examples

Perfect for workflow contributors who need to understand the requirements and structure for creating custom diagnostic workflows.

ParametersJSON Schema
NameRequiredDescriptionDefault
format_typeNodetailed

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It accurately implies this is a read-only informational tool by its non-mutating verbs ('Get', 'provides') and describes what it returns, but it does not explicitly state that it has no side effects, does not require special permissions, or any other behavioral constraints. For a documentation retrieval tool, this is adequate but not rich in behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections and bullet points, front-loading the main purpose. It is a bit lengthy but every sentence contributes to understanding the tool's capabilities, formats, and use cases. It avoids redundancy and maintains a clear flow, though it could be slightly tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema) and its role as a documentation provider, the description is exceptionally complete. It details output formats, key information, usage scenarios, parameters, and outputs, giving an agent everything needed to decide when and how to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines format_type with a default but no description (0% coverage). The description compensates fully by explaining the parameter and its allowed values: 'format_type (optional): "detailed" (default), "schema", "quick", or "examples".' This goes well beyond the schema by providing semantic meaning and valid options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get comprehensive requirements and schema information for creating custom workflows.' It uses a specific verb ('Get') and resource ('requirements and schema information'), and distinguishes itself from sibling tools like workflow_builder by focusing on documentation for workflow creation rather than actual building.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a 'When to use' section that explicitly lists three concrete scenarios: at the beginning of authoring, during development, and in CI/validation tooling. It does not mention when NOT to use it or name alternative tools, but the guidance is clear and useful, earning a strong 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.6.10
    • Addedcreate_alert
    • Addeddelete_alert
    • Changedget_studio_topic1 field changed
      • addedInput schema / properties / version
        Added value: +{
        +  "default": "10.2",
        +  "description": "Splunk version for live Help pages. Default 10.2. Supported: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0",
        +  "type": "string"
        +}
    • Addedlist_alert_actions
    • Addedupdate_alert
  2. 1 tool updatev0.6.9
    • Removedworkflow_runner
  3. 1 tool updatev0.6.5
    • Changedcreate_dashboard3 fields changed
      • changedInput schema / properties / theme / default
        Previous value: -"light"New value: +"auto"
      • changedInput schema / properties / theme / description
        Previous value: -"Dashboard Studio UI theme when the tool wraps JSON into XML: 'light' or 'dark' (default: 'light'). Ignored for Classic Simple XML and when you pass a pre-wrapped Studio XML string (already containing <dashboard>)."New value: +"Dashboard Studio UI theme when wrapping JSON: 'light', 'dark', or 'auto' (default: 'auto'). With 'auto', reads uiSettings.theme / theme from Studio JSON or pre-wrapped XML; falls back to 'dark'. Ignored for Classic Simple XML."
      • changedInput schema / properties / theme / enum
        Previous value: -[
        -  "light",
        -  "dark"
        -]New value: +[
        +  "light",
        +  "dark",
        +  "auto"
        +]
  4. 23 tool updatesv0.6.1
    • Changedcreate_config6 fields changed
      • addedInput schema / properties / app / description
        Added value: +"App namespace for the config (defaults to 'search' if not provided)."
      • addedInput schema / properties / conf_file / description
        Added value: +"Configuration file name without .conf (e.g., 'props', 'transforms')."
      • addedInput schema / properties / overwrite / description
        Added value: +"Overwrite existing keys if True; otherwise skip them."
      • addedInput schema / properties / owner / description
        Added value: +"Owner namespace (defaults to current session user if available)."
      • addedInput schema / properties / settings / description
        Added value: +"Key/value settings to apply in the stanza."
      • addedInput schema / properties / stanza / description
        Added value: +"Stanza name to create/update."
    • Changedcreate_dashboard13 fields changed
      • addedInput schema / properties / app / description
        Added value: +"App context. Default: 'search'"
      • addedInput schema / properties / dashboard_type / description
        Added value: +"'studio'|'classic'|'auto' (default: 'auto')"
      • addedInput schema / properties / definition / description
        Added value: +"Studio JSON (dict/string) or Classic XML (string) (required)"
      • removedInput schema / properties / definition / title
        Removed value: -"Definition"
      • addedInput schema / properties / description / description
        Added value: +"Dashboard description"
      • addedInput schema / properties / label / description
        Added value: +"Human label shown in UI"
      • addedInput schema / properties / name / description
        Added value: +"Dashboard name (required)"
      • addedInput schema / properties / overwrite / description
        Added value: +"If True, updates existing dashboard of same name"
      • addedInput schema / properties / owner / description
        Added value: +"Dashboard owner. Default: 'nobody'"
      • addedInput schema / properties / read_perms / description
        Added value: +"Roles/users granted read"
      • addedInput schema / properties / sharing / description
        Added value: +"'user'|'app'|'global'"
      • addedInput schema / properties / theme
        Added value: +{
        +  "default": "light",
        +  "description": "Dashboard Studio UI theme when the tool wraps JSON into XML: 'light' or 'dark' (default: 'light'). Ignored for Classic Simple XML and when you pass a pre-wrapped Studio XML string (already containing <dashboard>).",
        +  "enum": [
        +    "light",
        +    "dark"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / write_perms / description
        Added value: +"Roles/users granted write"
    • Changedcreate_kvstore_collection6 fields changed
      • addedInput schema / properties / accelerated_fields / description
        Added value: +"Index definitions for faster queries"
      • addedInput schema / properties / app / description
        Added value: +"Target Splunk application where the collection will be created. Examples:\n- 'search': Default search app\n- 'my_app': Custom application\n- 'splunk_monitoring_console': Monitoring console app"
      • addedInput schema / properties / collection / description
        Added value: +"Name for the new collection (alphanumeric and underscores only). Examples:\n- 'users': User information store\n- 'configurations': Application settings\n- 'lookup_table': Data enrichment table"
      • addedInput schema / properties / create_lookup_definition / description
        Added value: +"Also create a transforms.conf lookup definition (default: False)"
      • addedInput schema / properties / fields / description
        Added value: +"Field definitions specifying data types and constraints"
      • addedInput schema / properties / replicated / description
        Added value: +"Whether to replicate across cluster (default: True)"
    • Changedenhance_tool_description3 fields changed
      • addedInput schema / properties / generate_examples / description
        Added value: +"Whether to generate parameter examples based on the tool's signature and category. Defaults to True."
      • addedInput schema / properties / include_response_format / description
        Added value: +"Whether to analyze and include expected response format information. Defaults to True."
      • addedInput schema / properties / tool_name / description
        Added value: +"Name of the tool to enhance (e.g., 'get_configurations', 'list_indexes')"
    • Changedget_admin_guide3 fields changed
      • addedInput schema / properties / auto_detect_version / description
        Added value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True."
      • addedInput schema / properties / topic / description
        Added value: +"Administration topic. Use list_admin_topics() to see all available topics. Common topics include:\n- 'indexes' - Index management and configuration\n- 'authentication' - User authentication setup\n- 'users' - User management and roles\n- 'apps' - Application management\n- 'deployment' - Deployment configuration\n- 'monitoring' - System monitoring setup\n- 'performance' - Performance optimization\n- 'security' - Security configuration\n- 'forwarders' - Forwarder configuration\n- 'clustering' - Clustering setup"
      • addedInput schema / properties / version / description
        Added value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
    • Changedget_cim_reference2 fields changed
      • addedInput schema / properties / model / description
        Added value: +"CIM data model name. Use list_cim_data_models() to see all available models. Examples: 'authentication', 'network-traffic', 'malware'"
      • addedInput schema / properties / version / description
        Added value: +"CIM version (default: 'latest'). Options: '6.1', '6.0', '5.3', '5.2', '5.1', 'latest'"
    • Changedget_config_spec1 field changed
      • addedInput schema / properties / config / description
        Added value: +"Configuration file name (with or without .conf extension). Use list_config_files() to see common files. Examples: 'props.conf', 'transforms', 'indexes.conf'"
    • Changedget_configurations4 fields changed
      • addedInput schema / properties / app / description
        Added value: +"Filter results to stanzas owned by this app (namespace)."
      • addedInput schema / properties / conf_file / description
        Added value: +"Configuration file name without .conf extension (e.g., 'props', 'transforms', 'inputs', 'outputs', 'server', 'web')"
      • addedInput schema / properties / owner / description
        Added value: +"Filter results to stanzas owned by this owner (user)."
      • addedInput schema / properties / stanza / description
        Added value: +"Specific stanza name within the conf file to retrieve. If not provided, returns all stanzas in the file."
    • Changedget_dashboard_definition3 fields changed
      • addedInput schema / properties / app / description
        Added value: +"App context. Default: 'search'"
      • addedInput schema / properties / name / description
        Added value: +"Dashboard name (required)"
      • addedInput schema / properties / owner / description
        Added value: +"Dashboard owner. Default: 'nobody'"
    • Changedget_kvstore_data3 fields changed
      • addedInput schema / properties / app / description
        Added value: +"App where the collection resides (defaults to current/app context)"
      • addedInput schema / properties / collection / description
        Added value: +"Collection name"
      • addedInput schema / properties / query / description
        Added value: +"MongoDB-style filter object (e.g., {\"status\": \"active\"})"
    • Changedget_metadata5 fields changed
      • addedInput schema / properties / earliest_time / description
        Added value: +"Search start time (e.g., '-24h@h') (default: '-24h@h')"
      • addedInput schema / properties / field / description
        Added value: +"Metadata field to list values for. One of 'host', 'sourcetype', or 'source' (default: 'host')"
      • addedInput schema / properties / index / description
        Added value: +"Target index to inspect (e.g., 'main', 'security')"
      • addedInput schema / properties / latest_time / description
        Added value: +"Search end time (e.g., 'now') (default: 'now')"
      • addedInput schema / properties / limit / description
        Added value: +"Maximum number of distinct values to return (default: 100)"
    • Changedget_search_job_info2 fields changed
      • addedInput schema / properties / include_raw_content / description
        Added value: +"Include raw job.content for debugging (default: False)"
      • addedInput schema / properties / job_id / description
        Added value: +"Splunk search job id (sid)"
    • Changedget_spl_reference3 fields changed
      • addedInput schema / properties / auto_detect_version / description
        Added value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True."
      • addedInput schema / properties / command / description
        Added value: +"SPL command name. Use list_spl_commands() to see common commands. Examples:\n- 'stats' - Statistical aggregation command\n- 'eval' - Field calculation and manipulation\n- 'search' - Search filtering command\n- 'timechart' - Time-based charting\n- 'rex' - Regular expression field extraction\n- 'lookup' - Data enrichment from lookups"
      • addedInput schema / properties / version / description
        Added value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
    • Changedget_splunk_documentation2 fields changed
      • addedInput schema / properties / auto_detect_version / description
        Added value: +"Whether to auto-detect Splunk version for dynamic resources. Defaults to True."
      • addedInput schema / properties / doc_uri / description
        Added value: +"Documentation URI pattern. Use list_available_topics() to see all available URI patterns and topics. Examples:\n- 'splunk-docs://cheat-sheet' - Splunk SPL cheat sheet\n- 'splunk-docs://discovery' - Available documentation discovery\n- 'splunk-docs://9.4/spl-reference/stats' - SPL stats command\n- 'splunk-docs://latest/troubleshooting/metrics-log' - Troubleshooting guide\n- 'splunk-docs://9.3/admin/indexes' - Admin guide for indexes\n- 'splunk-cim://authentication' - CIM data model (latest version)\n- 'splunk-cim://6.1/network-traffic' - CIM data model (specific version)\n- 'splunk-cim://discovery' - CIM discovery index\n- 'dashboard-studio://cheatsheet' - Dashboard Studio cheatsheet\n- 'dashboard-studio://discovery' - Dashboard Studio discovery\n- 'splunk-spec://props.conf' - Config file specification"
    • Changedget_studio_topic1 field changed
      • addedInput schema / properties / topic / description
        Added value: +"Documentation topic. Use list_dashboard_studio_topics() to see available topics. Examples: 'cheatsheet', 'definition', 'visualizations', 'configuration', 'datasources', 'framework'"
    • Changedget_troubleshooting_guide3 fields changed
      • addedInput schema / properties / auto_detect_version / description
        Added value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True."
      • addedInput schema / properties / topic / description
        Added value: +"Troubleshooting topic. Use list_troubleshooting_topics() to see all available topics. Common topics include:\n- 'metrics-log' - About metrics.log for performance monitoring\n- 'splunk-logs' - What Splunk logs about itself\n- 'platform-instrumentation' - Platform instrumentation overview\n- 'search-problems' - Splunk web and search problems\n- 'indexing-performance' - Indexing performance issues\n- 'indexing-delay' - Event indexing delays\n- 'authentication-timeouts' - Authentication timeout issues"
      • addedInput schema / properties / version / description
        Added value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
    • Changedlist_dashboards8 fields changed
      • addedInput schema / properties / app / description
        Added value: +"Filter by app context. Default: '-' (all apps)"
      • addedInput schema / properties / count / description
        Added value: +"Max results to return. 0=all, default: 50 for performance"
      • addedInput schema / properties / my_dashboards_only / description
        Added value: +"If True, only return dashboards owned by the current user. Overrides 'owner' parameter. Default: False"
      • addedInput schema / properties / offset / description
        Added value: +"Result offset for pagination. Default: 0"
      • addedInput schema / properties / owner / description
        Added value: +"Filter by owner. Use 'me' for current user's dashboards, 'nobody' for shared dashboards, or a specific username. Default: 'nobody'"
      • addedInput schema / properties / private_only / description
        Added value: +"If True, only return private dashboards (sharing='user'). Works with any owner filter. Default: False"
      • addedInput schema / properties / search_filter / description
        Added value: +"Filter results (e.g., 'name=*security*')"
      • addedInput schema / properties / type_filter / description
        Added value: +"Filter by type: 'classic', 'studio', or 'any'. Default: 'any'"
    • Changedlist_lookup_definitions5 fields changed
      • addedInput schema / properties / app / description
        Added value: +"Filter by app context. Default: '-' (all apps)"
      • addedInput schema / properties / count / description
        Added value: +"Max results to return. 0=all, default: 50 for performance"
      • addedInput schema / properties / offset / description
        Added value: +"Result offset for pagination. Default: 0"
      • addedInput schema / properties / owner / description
        Added value: +"Filter by owner. Default: 'nobody' (all users)"
      • addedInput schema / properties / search_filter / description
        Added value: +"Filter results (e.g., 'filename=*.csv')"
    • Changedlist_lookup_files5 fields changed
      • addedInput schema / properties / app / description
        Added value: +"Filter by app context. Default: '-' (all apps)"
      • addedInput schema / properties / count / description
        Added value: +"Max results to return. 0=all, default: 50 for performance"
      • addedInput schema / properties / offset / description
        Added value: +"Result offset for pagination. Default: 0"
      • addedInput schema / properties / owner / description
        Added value: +"Filter by owner. Default: 'nobody' (all users)"
      • addedInput schema / properties / search_filter / description
        Added value: +"Filter results (e.g., 'name=*geo*')"
    • Changedlist_saved_searches4 fields changed
      • addedInput schema / properties / app / description
        Added value: +"Filter by application name (optional)"
      • addedInput schema / properties / include_disabled / description
        Added value: +"Include disabled saved searches (default: False)"
      • addedInput schema / properties / owner / description
        Added value: +"Filter by owner name (optional)"
      • addedInput schema / properties / sharing / description
        Added value: +"Filter by sharing level (optional)"
    • Changedlist_triggered_alerts4 fields changed
      • addedInput schema / properties / count / description
        Added value: +"Maximum number of alert groups to return (default: 50)"
      • addedInput schema / properties / earliest_time / description
        Added value: +"Advisory filter for earliest trigger time (default: '-24h@h')"
      • addedInput schema / properties / latest_time / description
        Added value: +"Advisory filter for latest trigger time (default: 'now')"
      • addedInput schema / properties / search / description
        Added value: +"Case-insensitive substring filter applied to alert group name"
    • Changedmanage_apps2 fields changed
      • addedInput schema / properties / action / description
        Added value: +"Management action to perform. Valid options:\n- 'enable': Activate the application\n- 'disable': Deactivate the application\n- 'restart': Disable then enable the application\n- 'reload': Refresh application configuration"
      • addedInput schema / properties / app_name / description
        Added value: +"Name of the Splunk application to manage. Examples:\n- 'search': Core Splunk Search app\n- 'splunk_monitoring_console': Monitoring Console\n- 'my_custom_app': Custom business applications"
    • Changedsentry_test2 fields changed
      • addedInput schema / properties / test_type / description
        Added value: +"Type of test to run:\n       - \"full\": Complete test with transaction, spans, and message\n       - \"trace\": Only create transaction and spans\n       - \"error\": Only trigger an error\n       - \"message\": Only send a test message"
      • addedInput schema / properties / trigger_error / description
        Added value: +"If True, triggers a test exception to verify error tracking."
  5. 53 tool updatesv0.5.1
    • Changedcreate_config1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedcreate_dashboard1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedcreate_kvstore_collection1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedcreate_saved_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changeddelete_saved_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changeddiscover_splunk_docs1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedenhance_tool_description1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedexecute_saved_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_admin_guide1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_cim_reference1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_config_spec1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_configurations1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_dashboard_definition1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_executed_workflows1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_kvstore_data1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_metadata1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_saved_search_details1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Addedget_search_job_info
    • Changedget_spl_reference1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_splunk_cheat_sheet1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_splunk_documentation1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_splunk_health1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_studio_topic1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_troubleshooting_guide1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_admin_topics1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_apps1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_available_topics1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_cim_data_models1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_config_files1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_dashboard_studio_topics1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_dashboards1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_indexes1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_kvstore_collections1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_lookup_definitions1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_lookup_files1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_saved_searches1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_sources1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_sourcetypes1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_spl_commands1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_triggered_alerts1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_troubleshooting_topics1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_users1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedlist_workflows1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedmanage_apps1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedme1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedrun_oneshot_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedrun_splunk_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedsentry_test1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedupdate_saved_search1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changeduser_agent_info5 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / properties
        Added value: +{
        +  "result": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "result"
        +]
      • addedOutput schema / x-fastmcp-wrap-result
        Added value: +true
    • Changedworkflow_builder1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedworkflow_requirements1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedworkflow_runner1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
  6. 52 tool updatesv0.5.0
    • First observedcreate_config
    • First observedcreate_dashboard
    • First observedcreate_kvstore_collection
    • First observedcreate_saved_search
    • First observeddelete_saved_search
    • First observeddiscover_splunk_docs
    • First observedenhance_tool_description
    • First observedexecute_saved_search
    • First observedget_admin_guide
    • First observedget_cim_reference
    • First observedget_config_spec
    • First observedget_configurations
    • First observedget_dashboard_definition
    • First observedget_executed_workflows
    • First observedget_kvstore_data
    • First observedget_metadata
    • First observedget_saved_search_details
    • First observedget_spl_reference
    • First observedget_splunk_cheat_sheet
    • First observedget_splunk_documentation
    • First observedget_splunk_health
    • First observedget_studio_topic
    • First observedget_troubleshooting_guide
    • First observedlist_admin_topics
    • First observedlist_apps
    • First observedlist_available_topics
    • First observedlist_cim_data_models
    • First observedlist_config_files
    • First observedlist_dashboard_studio_topics
    • First observedlist_dashboards
    • First observedlist_indexes
    • First observedlist_kvstore_collections
    • First observedlist_lookup_definitions
    • First observedlist_lookup_files
    • First observedlist_saved_searches
    • First observedlist_sources
    • First observedlist_sourcetypes
    • First observedlist_spl_commands
    • First observedlist_triggered_alerts
    • First observedlist_troubleshooting_topics
    • First observedlist_users
    • First observedlist_workflows
    • First observedmanage_apps
    • First observedme
    • First observedrun_oneshot_search
    • First observedrun_splunk_search
    • First observedsentry_test
    • First observedupdate_saved_search
    • First observeduser_agent_info
    • First observedworkflow_builder
    • First observedworkflow_requirements
    • First observedworkflow_runner

TDQS

A3.5/5.0
Disambiguation4/5

Most tools have clearly distinct purposes, but the documentation tools (e.g., discover_splunk_docs, list_available_topics, get_splunk_documentation) overlap significantly, causing potential confusion for an agent.

Naming Consistency4/5

The vast majority use a consistent verb_noun snake_case pattern (e.g., create_config, list_apps). However, the tool 'me' breaks the pattern by being a single word without a verb, making it an outlier.

Tool Count2/5

With 53 tools, the server is overly large for an MCP server. While Splunk is complex, many tools (especially documentation ones) could be consolidated, and the high count reduces coherence.

Completeness3/5

Core operations like saved searches and search execution are well covered, but notable gaps exist: no update/delete for dashboards or KV store collections, and no alert or lookup definition creation tools.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to interact with Splunk Enterprise and Splunk Cloud instances through standardized MCP interface. Supports executing SPL queries, managing indexes and saved searches, listing applications, and retrieving server information with flexible authentication options.
    -
  • A
    license
    B
    quality
    D
    maintenance
    Enables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.
    31
    1
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to search, manage, and analyze data in Splunk instances through the Model Context Protocol. Supports SPL queries, index management, alerts, dashboards, and more.
    1
    Apache 2.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/deslicer/mcp-for-splunk'

If you have feedback or need assistance with the MCP directory API, please join our Discord server