MCP Server for Splunk
The MCP Server for Splunk enables AI agents to interact with Splunk environments through the Model Context Protocol, offering comprehensive search, administration, monitoring, and troubleshooting capabilities.
Search & Analytics
Run ad-hoc (
run_oneshot_search) and tracked searches (run_splunk_search) with job monitoring and progress trackingManage saved searches (list, create, update, delete, execute) including scheduling and alert actions
Data Discovery
List indexes, sources, sourcetypes, and hosts to explore data structures and availability
Retrieve metadata for schema analysis within any index
Administration & Configuration
List, enable, disable, and manage Splunk apps and users
Read and write
.confconfiguration files; manage KV Store collections
Dashboards
List, retrieve raw definitions, and create Classic Simple XML and Dashboard Studio JSON dashboards
Lookups & Knowledge Objects
List lookup definitions and CSV lookup files; create and query KV Store collections
Health & Alerts
Check server health, connectivity, and version status
List triggered alerts with trigger details
ITSI (IT Service Intelligence)
Manage services, entities, KPIs, episodes, glass tables, deep dives, correlation searches, and aggregation policies via a dedicated companion server with 70+ tools
AI-Powered Workflows
Discover, run, and build intelligent troubleshooting workflows (e.g., missing data, performance analysis) with parallel task execution
Validate and template custom workflows; review executed workflow history
Documentation & Reference
Access SPL cheat sheets and command references, CIM data model specs, admin guides, troubleshooting topics,
.conffile specifications, and Dashboard Studio guides
Extensibility
Pluggable architecture for custom tools and entry-point plugins; multi-client support with session-based isolation and dynamic environment configuration without server restarts
Enables AI agents to interact with Splunk Enterprise/Cloud environments, providing comprehensive tools for search and analytics, data discovery, administration, health monitoring, and AI-powered troubleshooting workflows. Includes capabilities for natural language to SPL conversion, real-time search management, metadata exploration, user and app management, system health monitoring, and automated diagnostic procedures.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Server for Splunkshow me the top 5 error sources from the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Server for Splunk
Enable AI agents to interact seamlessly with Splunk environments through the Model Context Protocol (MCP)
Transform your Splunk instance into an AI-native platform. Our community-driven MCP server bridges Large Language Models and Splunk Enterprise/Cloud with 20+ tools, 16 resources (including CIM data models), and production-ready securityβall through a single, standardized protocol.
π Why This Matters
π Universal AI Connection: One protocol connects any AI to Splunk data
β‘ Zero Custom Integration: No more months of custom API development
π‘οΈ Production-Ready Security: Client-scoped access with no credential exposure
π€ AI-Powered Workflows: Intelligent troubleshooting agents that work like experts
π€ Community-Driven: Extensible framework with contribution examples
π NEW: AI-Powered Troubleshooting Workflows - Transform reactive firefighting into intelligent, systematic problem-solving with specialist AI workflows.
Related MCP server: Splunk MCP for SOC Operations
π Table of Contents
π Quick Start
Prerequisites
Python 3.10+ and UV package manager
Nodejs (optional used for mcp inspector)
Docker (optional but recommended for full stack)
Splunk instance with API access (or use included Docker Splunk)
π Complete Setup Guide: Installation Guide
Configuration
Before running the setup, configure your Splunk connection:
# Copy the example configuration
cp env.example .env
# Edit .env with your Splunk credentials
# - Use your existing Splunk instance (local, cloud, or Splunk Cloud)
# - OR use the included Docker Splunk (requires Docker)
# Optional HTTP transport defaults (local runs)
# - Stateless HTTP avoids sticky-session requirements
# - JSON responses improve compatibility with some clients
# These are already the defaults for local runs via `mcp-server --local`
echo "MCP_STATELESS_HTTP=true" >> .env
echo "MCP_JSON_RESPONSE=true" >> .envOne-Command Setup
Windows:
git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk
```python
# Start the MCP Server (project script)
uv run mcp-server --local --detached
# Verify the server
uv run mcp-server --test
# Optional: show detailed tools/resources and health output
uv run mcp-server --test --detailedmacOS/Linux:
git clone https://github.com/deslicer/mcp-for-splunk.git
cd mcp-for-splunk
# (Recommended) Preview what would be installed
./scripts/smart-install.sh --dry-run
# Install missing prerequisites (base: Python, uv, Git, Node)
./scripts/smart-install.sh
# Start the MCP Server (project script)
# Local runs default to HTTP stateless mode + JSON response
uv run mcp-server --local --detached
# Verify the server
uv run mcp-server --test
# Optional: show detailed tools/resources and health output
uv run mcp-server --test --detailedπ‘ Deployment Options: The
mcp-servercommand will prompt you to choose:
Docker (Option 1): Full stack with Splunk, Traefik, MCP Inspector - recommended if Docker is installed
Local (Option 2): Lightweight FastMCP server only - for users without Docker
Stopping services:
uv run mcp-server --stopstops only this project's compose services (dev/prod/splunk). It does not stop the Docker engine.
Note on Splunk licensing: When using the
so1Splunk container, you must supply your own Splunk Enterprise license if required. The compose files include a commented example mount:# - ./lic/splunk.lic:/tmp/license/splunk.lic:ro. Create alic/directory and mount your license file, or add the license via the Splunk Web UI after startup.
π― What You Can Do
π€ Workflow Discovery & Authoring
Discover and validate Splunk troubleshooting workflow definitions (JSON) without a built-in agent runner:
# Discover available troubleshooting workflows
result = await list_workflows.execute(ctx, format_type="summary")
# Returns: missing_data_troubleshooting, performance_analysis, custom_workflows...
# Author or validate a workflow definition
result = await workflow_builder.execute(
ctx=ctx,
mode="validate",
workflow_data={"workflow_id": "my_check", "tasks": [...]},
)OpenAI-based workflow_runner execution was removed in favor of FastMCP 4 / MCP SDK v2. Workflow JSON definitions remain available for discovery, validation, and external orchestration.
π Workflows Guide β for creation, templates, and contrib workflows.
π‘οΈ ITSI MCP Server (NEW!)
A dedicated Model Context Protocol server for Splunk IT Service Intelligence ships in this repo at mcp_itsi/, released independently to PyPI as mcp-itsi-server. It targets ITSI 4.21 and adds 70 tools, 9 documentation resources, and 3 workflow prompts for managing services, entities, KPIs, episodes, glass tables, deep dives, correlation searches, and aggregation policies.
# Standalone install
pip install mcp-itsi-server
# Together with the parent server
pip install "mcp-server-for-splunk[itsi]"You can deploy it two ways with identical capabilities:
Plugin of
mcp-for-splunkβ auto-registers via themcp_splunk.pluginsPython entry point. One process, one URL, one credential set.Standalone β its own FastMCP HTTP/stdio process, behind Traefik on
/itsi/mcp(Docker), viamcp-itsi-server(local Python), or as themcp_itsiDocker image (anywhere).
Both modes share the same per-request X-Splunk-* headers as the parent server (basic auth, bearer token, splunkd session token), plus optional X-ITSI-* overrides for app/user namespace.
π ITSI Getting Started β | ποΈ ITSI Deployment Guide β | π¦ Package README β
π Documentation Hub
Document | Purpose | Audience | Time |
Intelligent workflows powered by the workflow tools | All users | 5 min | |
Complete setup guide with prerequisites | New users | 15 min | |
Connect AI clients | Developers | 30 min | |
Sessionless vs session-scoped HTTP clients | Developers | 10 min | |
LLM-oriented guide for using the MCP server | Agents | 5 min | |
Instructions for coding agents working in this repo | Contributors / agents | 5 min | |
Production deployment | DevOps | 45 min | |
Discover, author, and validate workflow JSON | Developers | 10 min | |
Tool documentation | Integrators | Reference | |
Access CIM data models and Splunk docs | All users | Reference | |
Add your own tools | Contributors | 60 min | |
Complete contribution framework | Contributors | 15 min | |
Technical deep-dive | Architects | Reference | |
First success test steps | Developers | 2 min | |
Extend with entry-point plugins (separate package) | Integrators | 5 min | |
Zero-to-working ITSI MCP server in 15 minutes | ITSI users | 15 min | |
Standalone vs plugin, Docker, scaling, security | DevOps / Splunk admins | 20 min |
π§ Available Tools & Capabilities
π€ Workflow Tools
list_workflows: Discover available troubleshooting workflows (core + contrib)workflow_builder: Create, edit, and validate workflow JSON definitionsworkflow_requirements: Schema and authoring guidance for workflow contributorsBuilt-in Workflows: Missing data troubleshooting, performance analysis, and more
π Search & Analytics
Smart Search: Natural language to SPL conversion
Real-time Search: Background job management with progress tracking
Saved Searches: Create, execute, and manage search automation
π Data Discovery
Metadata Exploration: Discover indexes, sources, and sourcetypes
Schema Analysis: Understand your data structure
Usage Patterns: Identify data volume and access patterns
π₯ Administration
App Management: List, enable, disable Splunk applications
User Management: Comprehensive user and role administration
Configuration Access: Read and analyze Splunk configurations
π₯ Health Monitoring
System Health: Monitor Splunk infrastructure status
Degraded Feature Detection: Proactive issue identification
Alert Management: Track and analyze triggered alerts
π‘οΈ Splunk IT Service Intelligence (ITSI) β NEW!
The companion mcp_itsi server (standalone or plugin β see π‘οΈ ITSI MCP Server) adds 70 ITSI-specific tools:
Service Insights: services, service templates, KPI base searches, KPI threshold templates, glass tables, deep dives, home views β full CRUD plus
itsi_count_servicesanditsi_templatize_service.Entity Integration: entities, entity types, alias inventory; full CRUD with the documented schema quirks (alias fields must also live at the document root).
Event Analytics: notable events with
itsi_acknowledge_notable_event/itsi_close_notable_eventshortcuts, plus full CRUD on aggregation policies and correlation searches.Teams, maintenance windows, supported object types, and bundled docs as
itsi_*tools anditsi://docs/<slug>resources.
π¦ Browse the ITSI tool catalog β
π Client Integration Examples
πͺ Multi-Client Configuration Strength: One of the key advantages of this MCP Server for Splunk is its ability to support multiple client configurations simultaneously. You can run a single server instance and connect multiple clients with different Splunk environments, credentials, and configurations - all without restarting the server or managing separate processes.
π Multi-Client Benefits
Session-Based Isolation: Each client connection maintains its own Splunk session with independent authentication, preventing credential conflicts between different users or environments.
Dynamic Configuration: Switch between Splunk instances (on-premises, cloud, development, production) by simply changing headers - no server restart required.
Scalable Architecture: A single server can handle multiple concurrent clients, each with their own Splunk context, making it ideal for team environments, CI/CD pipelines, and multi-tenant deployments.
Resource Efficiency: Eliminates the need to run separate MCP server instances for each Splunk environment, reducing resource consumption and management overhead.
Cursor IDE
Single Tenant
{
"mcpServers": {
"splunk": {
"command": "fastmcp",
"args": ["run", "/path/to/src/server.py"],
"env": {
"MCP_SPLUNK_HOST": "your-splunk.com",
"MCP_SPLUNK_USERNAME": "your-user"
}
}
}
}Client Specified Tenant
Sessionless bearer-token (default HTTP mode) and session-scoped examples:
{
"mcpServers": {
"splunk-sessionless": {
"url": "http://localhost:8003/mcp/",
"headers": {
"X-Splunk-Host": "myorg.splunkcloud.com",
"X-Splunk-Port": "8089",
"X-Splunk-Token": "eyJraWQiOiJzcGx1bmsuc2VjcmV0...",
"X-Splunk-Scheme": "https",
"X-Splunk-Verify-SSL": "true"
}
},
"splunk-in-docker": {
"url": "http://localhost:8003/mcp/",
"headers": {
"X-Splunk-Host": "so1",
"X-Splunk-Port": "8089",
"X-Splunk-Username": "admin",
"X-Splunk-Password": "Chang3d!",
"X-Splunk-Scheme": "http",
"X-Splunk-Verify-SSL": "false",
"X-Session-ID": "splunk-in-docker-session"
}
}
}
}See HTTP Client Connection Modes for both approaches.
Google Agent Development Kit
from google.adk.tools.mcp_tool.mcp_toolset import MCPToolset
splunk_agent = LlmAgent(
model='gemini-2.0-flash',
tools=[MCPToolset(connection_params=StdioServerParameters(
command='fastmcp',
args=['run', '/path/to/src/server.py']
))]
)π€ Community & Contribution
Quick links: Contributing Β· Code of Conduct Β· Security Policy Β· Governance Β· License
π οΈ Create Your Own Tools & Extensions
π Quick Start for Contributors:
# Interactive tool generator (project script)
uv run generate-tool
# Browse existing tools for inspiration
./contrib/scripts/list_tools.py
# Validate your tool implementation (project script)
uv run validate-tools
# Test your contribution
./contrib/scripts/test_contrib.pyπ Complete Contributing Guide β - Everything you need to know about creating tools, resources, and workflows for the MCP Server for Splunk.
Contribution Categories
π‘οΈ Security Tools: Threat hunting, incident response, security analysis
βοΈ DevOps Tools: Monitoring, alerting, operations, SRE workflows
π Analytics Tools: Business intelligence, reporting, data analysis
π‘ Example Tools: Learning templates and patterns for new contributors
π§ Custom Workflows: AI-powered troubleshooting procedures for your organization
π Deployment Options
Development (Local)
Startup Time: ~10 seconds
Resource Usage: Minimal (single Python process)
Best For: Development, testing, stdio-based AI clients
HTTP Defaults: Local runs enable
MCP_STATELESS_HTTP=trueandMCP_JSON_RESPONSE=trueby default for Official MCP clients (no sticky sessions; JSON over SSE).Endpoint:
http://localhost:8003/mcp/Client headers:
Accept: application/json, text/event-streamplusX-Splunk-*(preferX-Splunk-Token; or username/password)Sessionless (default): omit
X-Session-ID/MCP-Session-IDSession-scoped: send a stable
X-Session-IDwhen you want cached config across requestsDetails: HTTP Client Connection Modes
Production (Docker)
Features: Load balancing, health checks, monitoring
Includes: Traefik, MCP Inspector, optional Splunk
Best For: Multi-client access, web-based AI agents
Session Routing: Traefik is configured with sticky sessions for streamable HTTP; alternatively, enable stateless HTTP for development scenarios.
Enterprise (Kubernetes)
Scalability: Horizontal scaling, high availability
Security: Pod-level isolation, secret management
Monitoring: Comprehensive observability stack
ITSI MCP Server
Plugin mode: Auto-loads into
mcp-for-splunkvia themcp_splunk.pluginsentry point β single process, single URL.Standalone mode: Dedicated FastMCP container behind Traefik at
/itsi/mcp, ormcp-itsi-serverconsole script for local Python, ormcp_itsiDocker image for any orchestrator.Auth parity: Same
X-Splunk-*headers as the parent server; optionalX-ITSI-App/X-ITSI-User-NS/X-ITSI-API-Versionfor ITSI-specific namespacing.Verification:
uv run python scripts/test_itsi_mcp_both_modes.pyexercises both modes end-to-end against any live ITSI cluster.
π Full ITSI deployment guide β
π Support & Community
π Issues: GitHub Issues
π¬ Discussions: GitHub Discussions
π Documentation: Complete guides and references
π§ Interactive Testing: MCP Inspector for real-time testing
Windows Support
Windows users get first-class support with PowerShell scripts and comprehensive troubleshooting guides. See our Windows Setup Guide.
π Project Stats
β 20+ Production Tools - Comprehensive Splunk operations
β 16 Rich Resources - System info, documentation, and CIM data models
β Comprehensive Test Suite - 170+ tests passing locally
β Multi-Platform - Windows, macOS, Linux support
β Community-Ready - Structured contribution framework
β Enterprise-Proven - Production deployment patterns
π― Ready to Get Started?
Choose your adventure:
π Quick Start - Get running in 15 minutes
π» Integration Examples - Connect your AI tools
ποΈ Architecture Guide - Understand the system
π€ Contribute - Add your own tools
Learn More: Model Context Protocol | FastMCP Framework
Available Tools
56 toolscreate_alertCreate AlertA
Create a Splunk alert (a scheduled saved search with trigger conditions). Actions can be any installed alert action, including custom ones, and more than one action is allowed. Call list_alert_actions first for custom action names and param keys.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App context (default: search) | |
| name | Yes | Unique alert name (required) | |
| search | Yes | SPL query (required) | |
| actions | No | [{name, params, enabled}]. Empty means track-only. Custom action params use keys from list_alert_actions. | |
| sharing | No | user|app|global (default: user) | user |
| alert_type | No | always|number of events|number of hosts|number of sources|custom (default: number of events) | number of events |
| is_visible | No | ||
| alert_track | No | Show in Triggered Alerts (default: true) | |
| description | No | Description | |
| latest_time | No | Dispatch latest time, e.g. 'now' | now |
| cron_schedule | Yes | Cron schedule, e.g. '*/5 * * * *' (required) | |
| earliest_time | No | Dispatch earliest time, e.g. '-15m' | -15m |
| alert_severity | No | 1-5 (default: 3) | |
| alert_condition | No | Required when alert_type is custom | |
| alert_threshold | No | Threshold value (default: 0) | 0 |
| alert_comparator | No | greater than|less than|equal to|not equal to (default: greater than) | greater than |
| alert_digest_mode | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry behavioral context. It does add valuable information: actions are not limited to built-in ones, multiple actions are allowed, and custom action names/keys come from list_alert_actions. However, it does not disclose what happens on duplicate alert names, whether any authorization is needed, or what the response indicates about success.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loads the core definition, and uses three sentences that each add value. The prerequisite instruction about list_alert_actions is included without clutter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there are no annotations and no output schema, the description leaves gaps about how to verify creation success and what happens on conflict or invalid configurations. It covers the key conceptual role well, but relies almost entirely on the schema for the rest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high at 88%, so the schema already explains most parameters. The description adds context around the actions parameter by saying custom actions are supported and pointing to list_alert_actions, but it does not enrich semantics for required parameters beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the specific operation: creating a Splunk alert, defined as a scheduled saved search with trigger conditions. This distinguishes it from create_saved_search, which creates saved searches without trigger conditions, and from update_alert, which modifies existing alerts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a useful prerequisite to call list_alert_actions first, but gives no guidance about when to use create_saved_search versus create_alert, or when to switch to update_alert. It does not mention any exclusions or alternatives by name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_configCreate ConfigA
Creates or updates a stanza in a Splunk .conf file at the app level. Uses REST first, with SDK fallback. Defaults to the current session owner and app 'search' when not provided. Will only overwrite existing keys when overwrite=true; otherwise, only new keys are added.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App namespace for the config (defaults to 'search' if not provided). | |
| owner | No | Owner namespace (defaults to current session user if available). | |
| stanza | Yes | Stanza name to create/update. | |
| settings | Yes | Key/value settings to apply in the stanza. | |
| conf_file | Yes | Configuration file name without .conf (e.g., 'props', 'transforms'). | |
| overwrite | No | Overwrite existing keys if True; otherwise skip them. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently explains the overwrite logic (only overwrites when overwrite=true, otherwise adds new keys), the default to current session owner and app 'search', and the fallback mechanism. It does not mention permission requirements or potential side effects beyond the stated behavior, but the core semantics are well covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences with each serving a purpose: what it does, implementation/defaults, and overwrite semantics. No fluff or redundant information. Perfectly front-loaded and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters, a nested object, no output schema, and no annotations, the description adequately explains the key behaviors: the overwrite policy, defaults, and fallback. It does not describe return values or failure modes, but for a configuration mutation tool, the essential context is present. Slightly more detail on authentication or side effects could be added, but it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and each parameter already has a description (conf_file, stanza, settings, app, owner, overwrite). The description repeats the defaults and overwrite behavior, which adds little beyond the schema. It does not elaborate on the settings object structure or edge cases, so it meets the baseline for well-documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates or updates a stanza in a Splunk .conf file at the app level. This is specific and distinguishes it from sibling read-only tools like get_configurations and get_config_spec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the implementation approach (REST first, SDK fallback), default behavior for owner and app, and the overwrite parameter semantics. While it does not explicitly name alternatives, the context clearly implies its use for writing config versus reading, and the defaults are useful. It lacks explicit when-not-to-use guidance but provides sufficient context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_dashboardCreate DashboardA
Create a new dashboard in Splunk. Accepts Classic Simple XML (string) or Dashboard Studio JSON (object/string) via eai:data. Optionally overwrite if it exists and set sharing/permissions (ACL).
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App context. Default: 'search' | search |
| name | Yes | Dashboard name (required) | |
| label | No | Human label shown in UI | |
| owner | No | Dashboard owner. Default: 'nobody' | nobody |
| theme | No | Dashboard Studio UI theme when wrapping JSON: 'light', 'dark', or 'auto' (default: 'auto'). With 'auto', reads uiSettings.theme / theme from Studio JSON or pre-wrapped XML; falls back to 'dark'. Ignored for Classic Simple XML. | auto |
| sharing | No | 'user'|'app'|'global' | |
| overwrite | No | If True, updates existing dashboard of same name | |
| definition | Yes | Studio JSON (dict/string) or Classic XML (string) (required) | |
| read_perms | No | Roles/users granted read | |
| description | No | Dashboard description | |
| write_perms | No | Roles/users granted write | |
| dashboard_type | No | 'studio'|'classic'|'auto' (default: 'auto') | auto |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but only discloses that it accepts two formats, can overwrite existing dashboards, and can set ACLs. It does not mention authentication requirements, error behavior when a dashboard already exists and overwrite is false, or what the response looks like, leaving significant behavioral aspects undeclared.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and each clause adds relevant detail (formats, overwrite, ACL) without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter tool with no annotations and no output schema, the description is adequate but incomplete. It fails to explain how dashboard_type auto-detection works, what the tool returns, or any prerequisites/error conditions, relying heavily on the schema for parameter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds some meaning by mentioning the eai:data transport mechanism and clarifying that definition can be a string or object, plus the ACL settings, but this adds limited value beyond the schema's own detailed parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a new dashboard in Splunk', providing a specific verb and resource. It distinguishes itself from sibling tools like get_dashboard_definition and list_dashboards by focusing on creation, and it adds key details about accepted formats and overwrite/ACL options.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool (creating a dashboard, with optional overwrite for existing ones) but does not explicitly name alternatives or exclusions. The overwrite option implies it can also be used for updates, and the sibling list includes related tools, but no explicit when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_kvstore_collectionCreate Kvstore CollectionA
Create a KV Store collection with optional fields and indexing. Use this to provision a new collection for lookups or persisted configuration in a specific app.
| Name | Required | Description | Default |
|---|---|---|---|
| app | Yes | Target Splunk application where the collection will be created. Examples: - 'search': Default search app - 'my_app': Custom application - 'splunk_monitoring_console': Monitoring console app | |
| fields | No | Field definitions specifying data types and constraints | |
| collection | Yes | Name for the new collection (alphanumeric and underscores only). Examples: - 'users': User information store - 'configurations': Application settings - 'lookup_table': Data enrichment table | |
| replicated | No | Whether to replicate across cluster (default: True) | |
| accelerated_fields | No | Index definitions for faster queries | |
| create_lookup_definition | No | Also create a transforms.conf lookup definition (default: False) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden for behavioral disclosure. It merely states the creation action but does not mention any side effects, permissions required, idempotency, or whether existing collections with the same name are overwritten. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and key details. It is appropriately sized and every sentence contributes meaning without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich schema with 100% parameter coverage and no output schema, the description is complete enough for an AI agent to understand the tool's purpose and usage. It lacks only minor behavioral details, but the overall context is sufficient for a straightforward creation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the parameters with detailed descriptions and examples, so the baseline is 3. The description adds no parameter-specific detail beyond what the schema already provides, but it does reinforce that fields and indexing are optional.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Create a KV Store collection') and the scope ('for lookups or persisted configuration in a specific app'). It differentiates from sibling tools like list_kvstore_collections and get_kvstore_data by focusing on the creation action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit use case: 'Use this to provision a new collection for lookups or persisted configuration in a specific app.' It does not enumerate alternatives or when-not-to-use, but the context is clear and sufficient for an agent to select this tool for creation tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_saved_searchCreate Saved SearchA
Create a saved search (report/automation) with optional scheduling and sharing. Use this to persist useful SPL queries and optionally schedule them via cron.\n\nOutputs: creation status and the applied configuration.\nSecurity: visibility and execution are constrained by permissions and chosen sharing level.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| name | Yes | ||
| search | Yes | ||
| sharing | No | user | |
| is_visible | No | ||
| description | No | ||
| latest_time | No | ||
| is_scheduled | No | ||
| cron_schedule | No | ||
| earliest_time | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral transparency. It discloses the output ('creation status and the applied configuration') and security constraints ('visibility and execution are constrained by permissions and chosen sharing level'). These add value beyond the schema and cover the key behavioral aspects, though it does not detail side effects such as overwriting existing searches.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, consisting of two sentences that immediately state the purpose and then provide output and security notes. It is well-structured, front-loaded, and free of unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 10 parameters and no output schema, the description is under-specified. It gives the purpose and some security context but does not explain scheduling syntax (cron), sharing level meanings, app assignment, or the role of time parameters. This leaves significant gaps for an agent invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0% for 10 parameters, so the description must compensate. However, it only vaguely mentions 'optional scheduling and sharing' without explaining the meaning of parameters like earliest_time, latest_time, app, description, or is_visible. It fails to provide sufficient meaning for most parameters, requiring the agent to infer or inspect the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a saved search with optional scheduling and sharing, using the verb 'create' and resource 'saved search'. It distinguishes from siblings like delete_saved_search, update_saved_search, execute_saved_search, and list_saved_searches by focusing on creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to persist useful SPL queries and optionally schedule them via cron,' providing clear context for when to use it. It does not explicitly mention alternatives or state when not to use it, but the create verb makes the usage scenario unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_alertDelete AlertA
Delete a Splunk alert. Alerts are saved searches, so this removes that saved search. Requires confirm=true. Use app and owner when the name exists in more than one namespace.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App context for lookup | |
| name | Yes | Alert name (required) | |
| owner | No | Owner context for lookup | |
| confirm | No | Must be true to delete (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full disclosure burden. It discloses the cascading destructive side effect ('this removes that saved search') and the confirm gate, which addresses the highest-risk behavioral trait. However, it does not state whether deletion is permanent/irreversible, what happens to dependent artifacts like triggered alerts, or what occurs if confirm is omitted β meaningful gaps for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each earning its place: the core action, the key domain fact linking alerts to saved searches, the mandatory flag, and the conditional namespace guidance. The action is front-loaded and there is zero filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema and no annotations, the description covers purpose, side-effect scope, the required safety flag, and namespace disambiguation β giving all four parameters contextual treatment. Minor gaps remain (return behavior, irreversibility), but nothing an agent needs to invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, setting the baseline at 3. The description adds genuine meaning beyond the schema: it explains the disambiguation role of app/owner ('when the name exists in more than one namespace'), going beyond 'App context for lookup', and reinforces confirm as a mandatory safety gate rather than just a default value. This elevates it above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action on a specific resource ('Delete a Splunk alert') and differentiates itself from sibling tools by explaining the alert/saved-search relationship ('Alerts are saved searches, so this removes that saved search'). This directly distinguishes it from delete_saved_search and clarifies what it is not, so an agent can select it correctly after one read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit invocation conditions: 'Requires confirm=true' states a mandatory precondition, and 'Use app and owner when the name exists in more than one namespace' gives a clear conditional for parameter selection. It stops short of a full routing contract β there is no explicit 'instead use X' or 'do not use when' β but the context is clear enough to use correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_saved_searchDelete Saved SearchC
Delete a saved search with confirmation and safety checks
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| name | Yes | ||
| owner | No | ||
| confirm | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing destructive behavior. It only vaguely says 'confirmation and safety checks' without describing what safety checks occur, whether deletion is reversible, what happens when confirm is false, or what permissions are needed. For a delete operation this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short, front-loaded sentence with no filler: 'Delete a saved search with confirmation and safety checks.' It earns its place by identifying the operation, but 'safety checks' is vague and could be replaced with concrete behavior without adding much length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter destructive tool with no annotations and no output schema, the description is incomplete. It should explain prerequisites, what the confirmation flag does, consequences of deletion, and possibly return behaviors. The vague 'safety checks' does not adequately cover the context needed for a destructive operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no details about the parameters app, name, owner, or confirm. The only indirect reference is 'confirmation', which loosely maps to confirm, but it does not explain semantics, defaults, required fields, or the roles of app and owner. The description provides no value beyond the schema's raw field names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action and resource: 'Delete a saved search'. This distinguishes it from siblings like list_saved_searches, update_saved_search, and create_saved_search. The additional mention of confirmation/safety checks hints at its distinct destructive behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is provided. The tool name alone implies it is for deleting saved searches, but the description does not clarify use cases vs alternatives like update_saved_search, list_saved_searches, or create_saved_search. 'With confirmation and safety checks' hints at conditions but does not explain them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
discover_splunk_docsDiscover Splunk DocsA
Discover all available Splunk documentation resources with examples and usage patterns. Returns a comprehensive guide showing available documentation types, URI patterns, and quick access links. Perfect for understanding what documentation is available and how to access it through the documentation tools.
Returns embedded resource with discovery guide including:
Static documentation resources (cheat sheet, etc.)
Dynamic documentation patterns (SPL reference, troubleshooting, admin guides)
Version support information
Quick access examples for common documentation needs
Usage patterns for agentic frameworks
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It states it 'Returns embedded resource with discovery guide' and lists contents, which is useful. However, it doesn't describe side effects (none expected), error handling, or any constraints. It's a simple discovery tool, so this level is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: a one-line summary, then a bullet list of what is returned. It's concise, no fluff, and front-loaded with the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, a simple discovery guide, it includes the key contents and usage patterns. It could mention that it's a starting point before using specific documentation tools, but the description already implies that. It's sufficiently complete for a zeroparameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters (%100 schema coverage vacuously), so the description doesn't need to explain parameters. It adds value by explaining what the returned guide contains, which is the only relevant semantic information here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Discover all available Splunk documentation resources' with a specific verb and resource. It distinguishes itself from sibling tools like get_admin_guide or get_spl_reference by focusing on discovery overview rather than specific content retrieval. The listed content types make its scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Perfect for understanding what documentation is available and how to access it through the documentation tools.' This gives clear context for when to use it. It doesn't explicitly mention when NOT to use it, but given the sibling tools (specific reference getters), the usage intent is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enhance_tool_descriptionEnhance Tool DescriptionA
Analyzes existing MCP tools and enhances their descriptions with detailed argument definitions, parameter examples, and usage patterns. Use this tool when you need to improve or generate better documentation for a tool, such as adding examples or clarifying parameters. This tool examines the current tool's metadata, inspects its execute method signature, and generates comprehensive documentation improvements.
| Name | Required | Description | Default |
|---|---|---|---|
| tool_name | Yes | Name of the tool to enhance (e.g., 'get_configurations', 'list_indexes') | |
| generate_examples | No | Whether to generate parameter examples based on the tool's signature and category. Defaults to True. | |
| include_response_format | No | Whether to analyze and include expected response format information. Defaults to True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While no annotations are provided, the description explains the internal process ("examines the current tool's metadata, inspects its execute method signature") and generation capabilities, which gives some transparency into behavior. However, it lacks details on edge cases, failure modes, or what happens when the tool cannot complete the enhancement, leaving some room for improvement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is composed of three well-structured sentences: the first introduces the tool's purpose, the second details usage scenarios, and the third describes the method. It is concise, informative, and avoids redundancy, effectively earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the lack of an output schema and annotations, the description sufficiently explains the tool's purpose, how it works, and what it produces. It covers the essential aspects needed for an agent to decide when to use it, though it could expand on potential limitations or errors. However, given the tool's complexity, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the parameters are well-documented in the schema itself, which is the baseline. The description doesn't add much semantic depth beyond the schema, but the schema is already clear on the parameters and their defaults, so the description doesn't need to repeat it, warranting the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool "Analyzes existing MCP tools and enhances their descriptions" with specific verbs and resources. It distinguishes itself by mentioning specific actions like adding examples, clarifying parameters, and inspecting the execute method signature, which differentiates it from general documentation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: "Use this tool when you need to improve or generate better documentation for a tool, such as adding examples or clarifying parameters." It clearly outlines the use cases and what the tool does (examines metadata, inspects execute method, generates documentation improvements), giving the agent clear guidance on when to apply it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_saved_searchExecute Saved SearchA
Run a saved search by name with optional time overrides and mode selection. Use this to execute existing reports/automations quickly. Choose 'oneshot' for immediate results or 'job' for progress tracking and large result sets.\n\nOutputs: results list (capped by max_results), mode used, timing, and job id (if job).\nSecurity: execution and results are constrained by the authenticated user's permissions.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| mode | No | oneshot | |
| name | Yes | ||
| owner | No | ||
| latest_time | No | ||
| max_results | No | ||
| earliest_time | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that results are capped by max_results, that mode and timing are output, and that execution is constrained by user permissions. However, it does not detail what happens with time overrides, how errors are handled, or whether the tool is read-only or mutating (though executing a search is generally read-only). The description adds some behavioral context but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core purpose. It uses two short paragraphs: one for usage and mode selection, another for outputs and security. Every sentence adds value, though the security note could be considered redundant with typical expectations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, no output schema, and no annotations, the description is moderately complete. It covers the main purpose, mode selection, outputs, and security, but lacks details on parameter semantics for several fields and does not explain the behavior of time overrides or how the 'job' mode differs in terms of polling or retrieval. It is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains the 'mode' parameter (oneshot vs job) and mentions 'max_results' caps the results list, but it does not explain 'app', 'owner', 'earliest_time', 'latest_time', or 'name' beyond what the schema shows. The description adds meaning for two of seven parameters, which is partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a saved search by name with optional time overrides and mode selection. It distinguishes itself from siblings like run_splunk_search and run_oneshot_search by focusing on executing existing saved searches, and mentions outputs and security constraints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use this tool: to execute existing reports/automations quickly. It explains the two modes ('oneshot' for immediate results, 'job' for progress tracking and large result sets), which helps the agent choose appropriately. However, it does not explicitly mention when not to use it or name alternative tools for different scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_admin_guideGet Admin GuideC
Get detailed Splunk administration documentation for specific topics. Returns comprehensive administration guides with configuration, management, and best practices as an embedded resource.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | Administration topic. Use list_admin_topics() to see all available topics. Common topics include: - 'indexes' - Index management and configuration - 'authentication' - User authentication setup - 'users' - User management and roles - 'apps' - Application management - 'deployment' - Deployment configuration - 'monitoring' - System monitoring setup - 'performance' - Performance optimization - 'security' - Security configuration - 'forwarders' - Forwarder configuration - 'clustering' - Clustering setup | |
| version | No | Splunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default) | latest |
| auto_detect_version | No | Whether to auto-detect Splunk version from connected instance. Defaults to True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It states it 'Returns... as an embedded resource' but does not disclose whether it is read-only, any error conditions (e.g., unknown topic), or if it requires authentication. Without annotations, this is insufficient for an agent to understand side effects or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded with the core purpose. It wastes no words and is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema or description of the returned content format (e.g., sections, length, structure). The description also does not help differentiate from the many similar documentation tools available, and given the lack of annotations, it leaves significant gaps for an agent to understand when this specific tool is appropriate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already provides detailed descriptions for each parameter, including common topics and version examples. The description adds no additional parameter semantics beyond what the schema provides, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves Splunk administration documentation for specific topics, with a clear verb (Get) and resource (administration documentation). While it distinguishes from generic docs tools like get_splunk_documentation by focusing on 'administration', it does not explicitly differentiate from similar tools like get_troubleshooting_guide or get_config_spec, so it's not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many sibling documentation tools (get_splunk_documentation, get_troubleshooting_guide, get_config_spec, etc.). The tool name suggests admin topics, but the description does not state any exclusions or alternatives, leaving the agent to infer usage from the name and schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cim_referenceGet Cim ReferenceB
Get detailed Splunk CIM data model documentation with field specifications and configuration examples. Returns comprehensive reference including field mappings, tagging requirements, and implementation guidance.
| Name | Required | Description | Default |
|---|---|---|---|
| model | Yes | CIM data model name. Use list_cim_data_models() to see all available models. Examples: 'authentication', 'network-traffic', 'malware' | |
| version | No | CIM version (default: 'latest'). Options: '6.1', '6.0', '5.3', '5.2', '5.1', 'latest' | latest |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose read-only vs. potentially heavy resource usage, nor what happens with invalid model names or version fallback. It claims 'comprehensive reference' but no caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence forming a tight, front-loaded description. No fluff; every phrase adds value (detailed, field specs, examples, mappings, tagging, implementation). Well-structured, though could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Two parameters, no output schema, no annotations β the description covers content but omits return format, error handling, or use cases. It's adequate for a documentation lookup but lacks completeness for an agent unfamiliar with CIM.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions, including model examples and version options. Parameter semantics are well-handled by the schema; description adds no additional parameter insight. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it retrieves Splunk CIM data model documentation with field specs and config examples. Its purpose is distinct from siblings like get_spl_reference or list_cim_data_models, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies use when needing CIM-specific reference, but lacks explicit guidance on when NOT to use it (e.g., for general Splunk docs). Sibling names suggest alternatives, but no direction is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_config_specGet Config SpecA
Get detailed Splunk configuration file specification documentation. Returns comprehensive reference with all configuration options, syntax, and examples.
| Name | Required | Description | Default |
|---|---|---|---|
| config | Yes | Configuration file name (with or without .conf extension). Use list_config_files() to see common files. Examples: 'props.conf', 'transforms', 'indexes.conf' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses the return content ('comprehensive reference with all configuration options, syntax, and examples') and the verb 'Get' implies a read-only operation, but it does not address potential errors, prerequisites, or scope limitations. A 3 reflects minimal transparency beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. The description front-loads the action and result; every phrase contributes to understanding what the tool returns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter documentation lookup tool, the description provides sufficient detail about the return value and uses the schema to handle the parameter. With no output schema or annotations, a little more specificity about the output format would improve completeness, but the low complexity keeps it adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% coverage, including format details and examples ('props.conf', 'transforms', 'indexes.conf'). The tool description adds no additional parameter semantics, but the schema fully compensates, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' and clearly identifies the resource as 'detailed Splunk configuration file specification documentation.' It distinguishes from siblings like list_config_files or get_configurations by stating it returns documentation rather than actual configs. Evidence: 'Returns comprehensive reference with all configuration options, syntax, and examples.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives, nor does it mention exclusions. It implies usage via the schema parameter hint to use list_config_files() to see common files, but the main description lacks a direct when-to-use/when-not-to-use framing. This is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_configurationsGet ConfigurationsA
Retrieves Splunk configuration settings from specified .conf files. Use this tool when you need to access or inspect Splunk configurations, such as for troubleshooting, auditing, or understanding settings in files like props.conf or inputs.conf. Access settings from any Splunk configuration file (props.conf, transforms.conf, inputs.conf, outputs.conf, etc.) either by entire file or specific stanza. Returns structured configuration data showing all settings and their values.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Filter results to stanzas owned by this app (namespace). | |
| owner | No | Filter results to stanzas owned by this owner (user). | |
| stanza | No | Specific stanza name within the conf file to retrieve. If not provided, returns all stanzas in the file. | |
| conf_file | Yes | Configuration file name without .conf extension (e.g., 'props', 'transforms', 'inputs', 'outputs', 'server', 'web') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full transparency burden. It discloses that the tool accesses any Splunk configuration file, can retrieve by entire file or specific stanza, and returns structured data with all settings and values. The word 'Retrieves' implies a read-only operation, and the return format is stated, though permissions and error behavior are not covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences and front-loaded with the core action. It efficiently covers usage context, scope, and return format without unnecessary filler. There is slight redundancy between 'Retrieves Splunk configuration settings' and 'Access settings from any Splunk configuration file,' but overall it is well-structured and appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description does a solid job covering purpose, scope, usage context, and return format for a read-only tool. It addresses the key behavioral aspects an agent needs to invoke it correctly. It does not cover edge cases like empty results or errors, but for a straightforward retrieval tool, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds minor context by mentioning 'entire file or specific stanza' and providing example conf files, but it largely relies on the schema's parameter descriptions. It does not meaningfully elaborate on app/owner parameters beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Retrieves Splunk configuration settings from specified .conf files,' a specific verb-resource pair that clearly states the tool's function. It distinguishes itself from siblings like create_config, list_config_files, and get_config_spec by focusing on reading actual settings from .conf files, and it reinforces the purpose with examples like props.conf and inputs.conf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this tool when you need to access or inspect Splunk configurations, such as for troubleshooting, auditing, or understanding settings.' This provides clear context for when to invoke the tool. However, it does not name alternatives or explicitly state when not to use it, so it misses the full 5-point bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_definitionGet Dashboard DefinitionA
Get the raw definition of a specific dashboard. Returns the complete dashboard source (Simple XML or Dashboard Studio JSON), type, app context, owner, and Splunk Web viewing URL.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App context. Default: 'search' | search |
| name | Yes | Dashboard name (required) | |
| owner | No | Dashboard owner. Default: 'nobody' | nobody |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It explicitly states what is returned: the complete dashboard source (Simple XML or Dashboard Studio JSON), type, app context, owner, and viewing URL. It does not mention permissions or error behavior, but it provides sufficient context about the operation's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose, and every sentence adds useful information. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple read tool with three fully documented parameters and no output schema. The description compensates well by listing the return contents and the resource type. It could note behavior on missing dashboards or permission requirements, but the current level is adequate for the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters and their defaults. The description adds minimal parameter-specific meaning, only reinforcing that it operates on a specific dashboard by name, which aligns with the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: "Get the raw definition of a specific dashboard," clearly distinguishing this from list_dashboards and create_dashboard. It also enumerates the returned data, making the tool's function unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies this is for retrieving the raw definition of a specific dashboard rather than listing dashboards, which contrasts with the sibling list_dashboards tool. It does not explicitly list alternatives or exclusions, but the context is clear enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_executed_workflowsGet Executed WorkflowsA
Retrieve executed workflows for the current session. If 'id' is provided, returns that single record (if it belongs to this session). If 'workflow_id' is provided, filters the list to that workflow. Otherwise returns a paginated list of latest results per workflow for this session.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ||
| limit | No | ||
| offset | No | ||
| workflow_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It transparently discloses session scoping, conditional filtering, and pagination, which adds context beyond the bare schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, no fluff. Every clause adds new behavioral detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema and no annotations, the description fully covers the tool's behavior for a retrieval function. It could mention authentication or error scenarios, but the core usage is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description directly explains the semantics of 'id' and 'workflow_id' parameters, which complements the schema. Since schema coverage is 0%, the description's contribution is valuable, though it could mention 'limit' and 'offset' explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description has a specific verb ('Retrieve') and a clear resource ('executed workflows for the current session'). It explains conditional behavior based on parameters, which distinguishes it from sibling tools like list_workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly explains when to use 'id', when to use 'workflow_id', and the default paginated behavior. It does not name alternative sibling tools, but the usage context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_kvstore_dataGet Kvstore DataA
Get documents from a KV Store collection with optional MongoDB-style query filtering. Use this to fetch lookup/configuration data or narrow results by field values.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App where the collection resides (defaults to current/app context) | |
| query | No | MongoDB-style filter object (e.g., {"status": "active"}) | |
| collection | Yes | Collection name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Get documents' and 'fetch' imply a read-only operation, and optional query filtering is disclosed, but there is no mention of default limits, pagination, empty-result behavior, or other side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences: the first front-loads the core operation, and the second adds practical usage context. No unnecessary detail or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple parameter set and complete schema descriptions, the description is reasonably adequate for invocation. However, there is no output schema and no mention of return shape, document limits, or error behavior, leaving moderate uncertainty for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter coverage with descriptions for collection, app defaulting to context, and the query example. The description mostly restates the MongoDB-style query filtering and adds the 'narrow results by field values' use case, adding minimal semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Get documents from a KV Store collection' with optional 'MongoDB-style query filtering', clearly identifying the operation, resource, and scope. It differentiates from sibling tools like list_kvstore_collections by focusing on retrieval of documents rather than collection listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to fetch lookup/configuration data or narrow results by field values', providing clear context for when to invoke the tool. It does not explicitly name alternatives to avoid, so it falls short of a full when-to-use vs when-not-to-use guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metadataGet MetadataA
Retrieve distinct metadata values for a given index to aid query construction. Use this tool when you need to discover which hosts, sourcetypes, or sources are present in an index within a recent time window. This is useful for building targeted searches or validating data availability. Results are constrained by your Splunk permissions.
| Name | Required | Description | Default |
|---|---|---|---|
| field | No | Metadata field to list values for. One of 'host', 'sourcetype', or 'source' (default: 'host') | host |
| index | Yes | Target index to inspect (e.g., 'main', 'security') | |
| limit | No | Maximum number of distinct values to return (default: 100) | |
| latest_time | No | Search end time (e.g., 'now') (default: 'now') | now |
| earliest_time | No | Search start time (e.g., '-24h@h') (default: '-24h@h') | -24h@h |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It adds useful context such as 'distinct values', 'recent time window', and 'Results are constrained by your Splunk permissions.' However, it does not mention any rate limits, response format, or what happens with no results, so it is moderately transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the main purpose, followed by usage context and a permission note. Every sentence earns its place, though the second and third sentences are somewhat complementary and could be merged without loss.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no annotations, the description provides sufficient context: it explains the purpose, usage, and a key behavioral constraint (permissions). It implicitly describes the return value as 'distinct metadata values.' It could mention pagination or the default field, but the schema covers those, so it is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds context that the tool is for 'query construction' and that the values are for 'hosts, sourcetypes, or sources,' but this is implicitly in the schema. It does not provide additional detail beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieve') and resource ('distinct metadata values for a given index'), clearly stating what the tool does. It differentiates from siblings like 'list_sources' and 'list_sourcetypes' by scoping to a specific index and time window.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool ('when you need to discover which hosts, sourcetypes, or sources are present in an index within a recent time window') and explains its utility ('building targeted searches or validating data availability'). It does not explicitly mention when not to use it or name alternatives, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_saved_search_detailsGet Saved Search DetailsA
Get comprehensive details about a specific saved search including configuration, metadata, scheduling, permissions, and alert actions. Returns detailed information about saved search properties, execution settings, and access control configuration. Essential for troubleshooting, auditing, and understanding saved search configurations.\n\nArgs:\n name (str): Name of the saved search to inspect (required)\n app (str, optional): Application context for saved search lookup\n owner (str, optional): Owner context for saved search lookup\n\nResponse Format:\nReturns dictionary with 'status', 'name', 'details', and 'retrieved_at' fields. The 'details' field contains comprehensive nested information including:\n- basic_info: Name, description, search query, visibility\n- scheduling: Schedule configuration and timing\n- dispatch: Time range and execution settings\n- permissions: Access control and sharing settings\n- actions: Email, script, and other alert actions\n- alert: Alert conditions and suppression settings\n- metadata: Creation timestamps and authorship
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| name | Yes | ||
| owner | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the exact response shape (dictionary with status, name, details, retrieved_at) and enumerates the nested detail categories, such as scheduling, permissions, and alert actions. It does not discuss auth requirements or errors, but it provides substantial runtime behavior beyond the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary, Args section, and Response Format section. It is longer than minimal but every section adds value. There is minor redundancy between the opening sentences and the Response Format breakdown, but the organization keeps it scannable and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description appropriately compensates by documenting the return structure and the contents of the nested 'details' object. Combined with parameter explanations, this gives an agent enough context to invoke the tool and interpret results. It could mention error cases or permission prerequisites, but it is reasonably complete for a read-only detail-fetch operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does by listing each parameter with a meaningful explanation: name is 'required', app is 'Application context for saved search lookup', and owner is 'Owner context for saved search lookup'. This adds practical lookup semantics that the bare JSON schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get comprehensive details about a specific saved search' and enumerates the included facets (configuration, metadata, scheduling, permissions, alert actions). This clearly distinguishes it from sibling tools like list_saved_searches, update_saved_search, or delete_saved_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context by stating it is 'Essential for troubleshooting, auditing, and understanding saved search configurations' and emphasizes 'a specific saved search.' It does not explicitly name alternatives or exclusions, but the context is enough to guide an agent toward single-item inspection rather than listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_search_job_infoGet Search Job InfoA
Get status/properties/messages for a Splunk search job by job id (sid). Use this after run_splunk_search returns a job_id when you want to poll progress or inspect errors without re-running the search.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Splunk search job id (sid) | |
| include_raw_content | No | Include raw job.content for debugging (default: False) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that this is a non-destructive read operation by saying 'without re-running the search' and listing the data retrieved (status, properties, messages). It also implies it can be polled, but it doesn't explicitly state read-only or cover edge cases like job expiration or missing job errors. Still, it adds meaningful context beyond the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences deliver the full purpose and usage context with zero fluff. The first sentence states the action and target, the second gives the trigger scenario. Perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (2 params, no output schema) and the description explains what it does, when to use it, and what it retrieves. It doesn't describe return format or error handling, but given the tool's simplicity and the clue that it returns 'status/properties/messages', it is sufficiently complete for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with job_id described as 'Splunk search job id (sid)' and include_raw_content as 'Include raw job.content for debugging (default: False)'. The tool description adds no additional parameter-level detail beyond referencing 'job id' in the purpose, so it doesn't exceed the baseline for fully documented schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' and a resource 'status/properties/messages for a Splunk search job by job id (sid)', clearly distinguishing it from sibling tools like run_splunk_search or run_oneshot_search. It immediately clarifies that this is for retrieving info about an existing job, not for starting one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Use this after run_splunk_search returns a job_id when you want to poll progress or inspect errors without re-running the search.' This gives a clear trigger (after run_splunk_search) and purpose (poll/inspect errors), and implies not to use it for starting searches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_spl_referenceGet Spl ReferenceB
Get detailed reference documentation for specific SPL (Search Processing Language) commands. Returns comprehensive documentation with syntax, examples, and usage patterns as an embedded resource.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | SPL command name. Use list_spl_commands() to see common commands. Examples: - 'stats' - Statistical aggregation command - 'eval' - Field calculation and manipulation - 'search' - Search filtering command - 'timechart' - Time-based charting - 'rex' - Regular expression field extraction - 'lookup' - Data enrichment from lookups | |
| version | No | Splunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default) | latest |
| auto_detect_version | No | Whether to auto-detect Splunk version from connected instance. Defaults to True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. While the tool is obviously a read-only documentation lookup, the description does not explicitly state that it has no side effects, requires no special permissions, or is safe. The only behavioral detail is that it 'Returns... as an embedded resource,' which is vague about the return format but adds minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose and a brief secondary sentence about return content. No fluff or redundant information, making it highly concise and effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity documentation retrieval tool, the description reasonably explains what is returned (syntax, examples, usage patterns) but leaves the exact output format vague with 'as an embedded resource.' Since there is no output schema, a bit more detail about the return structure could improve completeness, but overall it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers all three parameters (command, version, auto_detect_version) with detailed descriptions and examples. The tool description itself adds no parameter semantics, but given the schema coverage is 100%, the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get detailed reference documentation for specific SPL (Search Processing Language) commands.' It uses a specific verb (get) and resource (SPL command reference), and distinguishes itself from sibling tools like list_spl_commands by emphasizing detailed, per-command documentation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention that this is the tool to use for detailed command reference, nor does it reference sibling tools like list_spl_commands for command discovery or get_splunk_documentation for broader documentation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_splunk_cheat_sheetGet Splunk Cheat SheetA
Get the comprehensive Splunk SPL cheat sheet with commands, regex patterns, and usage examples. Returns the complete cheat sheet as an embedded resource with actual markdown content, perfect for quick reference during SPL query development and troubleshooting.
Returns embedded resource with complete SPL reference content including:
Core SPL commands and syntax
Regular expression patterns
Statistical functions
Time modifiers and formatting
Search optimization tips
Common use cases and examples
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It plainly states that the tool 'returns an embedded resource with actual markdown content' and lists the content categories, making the non-mutating retrieval behavior clear. It does not discuss potential limitations like stale content or response size, but for a static reference resource this is adequately transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear one-sentence summary and then uses a bullet list to enumerate the reference content. It is somewhat repetitive with 'comprehensive' and 'complete' in adjacent sentences, but the structure is scannable and every bullet adds useful detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (no parameters, no input schema complexity, no output schema), so the description does not need to explain return-value structures. It adequately covers what the cheat sheet includes and its intended use, making it sufficiently complete for an agent to decide whether to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema offers nothing to clarify. The baseline for 0-parameter tools is 4, and the description appropriately focuses on what the returned content contains rather than trying to explain nonexistent inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves a comprehensive Splunk SPL cheat sheet with commands, regex patterns, and usage examples. It names a specific resource type ('cheat sheet') but does not explicitly contrast itself with related siblings like get_spl_reference or list_spl_commands, so it loses one point for differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says the cheat sheet is 'perfect for quick reference during SPL query development and troubleshooting,' giving clear usage context. However, it does not mention when to prefer other SPL reference tools over this one or provide exclusions, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_splunk_documentationGet Splunk DocumentationA
Retrieve any Splunk documentation by URI pattern. This tool wraps existing documentation resources and returns embedded resources with actual content, making them compatible with agentic frameworks that don't support MCP resources natively. Supports all documentation types including cheat sheets, troubleshooting guides, SPL references, and admin guides.
| Name | Required | Description | Default |
|---|---|---|---|
| doc_uri | Yes | Documentation URI pattern. Use list_available_topics() to see all available URI patterns and topics. Examples: - 'splunk-docs://cheat-sheet' - Splunk SPL cheat sheet - 'splunk-docs://discovery' - Available documentation discovery - 'splunk-docs://9.4/spl-reference/stats' - SPL stats command - 'splunk-docs://latest/troubleshooting/metrics-log' - Troubleshooting guide - 'splunk-docs://9.3/admin/indexes' - Admin guide for indexes - 'splunk-cim://authentication' - CIM data model (latest version) - 'splunk-cim://6.1/network-traffic' - CIM data model (specific version) - 'splunk-cim://discovery' - CIM discovery index - 'dashboard-studio://cheatsheet' - Dashboard Studio cheatsheet - 'dashboard-studio://discovery' - Dashboard Studio discovery - 'splunk-spec://props.conf' - Config file specification | |
| auto_detect_version | No | Whether to auto-detect Splunk version for dynamic resources. Defaults to True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry full behavioral disclosure. It explains it returns embedded resources with actual content, which is helpful, but does not explicitly state read-only nature, side-effect-free, or potential failure modes. It adds some context but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded paragraph with zero waste. Every sentence earns its place, and it is appropriately sized for the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich parameter schema and no output schema, the description covers the tool's purpose and types adequately. It explains the wrapper behavior and supported categories, which is sufficient for the complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed descriptions and examples for both parameters. The description itself adds minimal parameter info beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves Splunk documentation by URI pattern, distinguishing it from sibling specific getters like get_admin_guide or get_spl_reference. The verb+resource+scope is specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says it supports all documentation types and even references list_available_topics() for discovering URIs, but does not explicitly state when to prefer this over specific sibling tools or when to avoid it. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_splunk_healthGet Splunk HealthA
Check Splunk server connectivity and return comprehensive health status information including server version, connection status, and system information. Supports both server-configured connections and custom connection parameters for testing different Splunk instances. Essential for connectivity troubleshooting and server validation.\n\nArgs:\n splunk_host (str, optional): Splunk server hostname or IP address (e.g., 'localhost', 'splunk.example.com', '10.1.1.100')\n splunk_port (int, optional): Splunk management port, typically 8089 (e.g., 8089, 8000, 9997)\n splunk_username (str, optional): Splunk username for authentication (e.g., 'admin', 'splunk', 'analyst')\n splunk_password (str, optional): Splunk password for authentication\n splunk_scheme (str, optional): Connection scheme - 'http' or 'https'\n splunk_verify_ssl (bool, optional): Whether to verify SSL certificates\n\nNote: If connection parameters are not provided, uses the server's configured connection.\n\nResponse Format:\nReturns dictionary with 'status', 'version', 'server_name', and 'connection_source' fields. Status can be 'connected' or 'error'.
| Name | Required | Description | Default |
|---|---|---|---|
| splunk_host | No | ||
| splunk_port | No | ||
| splunk_scheme | No | ||
| splunk_password | No | ||
| splunk_username | No | ||
| splunk_verify_ssl | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the key behavior: if connection parameters are not provided, the server's configured connection is used; it also outlines possible status values ('connected' or 'error') and response fields. This conveys auth and connection aspects beyond the schema, though it could detail more edge cases or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is logically structured with a one-sentence summary, a categorized Args section, and a concise Response Format section. It includes exactly the details needed without unnecessary filler, and the important usage statement is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity of six optional parameters and zero annotation or output schema, the description is complete. It explains the tool's fallback behavior, connection customization approach, and example response fields with status/version/server_name/connection_source, giving an agent everything needed to call it correctly and interpret its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description fully compensates. It explicitly documents all six parameters with types, optionality, and realistic examples (e.g., hostname 'localhost', port '8089', usernames like 'admin'). This goes beyond the bare schema and gives an agent actionable onboarding for each parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific action ('Check Splunk server connectivity') and clearly identifies the resource and scope (Splunk health status, version, connection info). It distinguishes itself from the sibling tools by focusing on a health/connectivity operation rather than searches, saved searches, app management, or dashboards. The mention of 'connectivity troubleshooting and server validation' reinforces its distinct purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context, stating it is 'Essential for connectivity troubleshooting and server validation' and explaining when custom connection parameters are useful ('testing different Splunk instances'). It does not explicitly enumerate when not to use it or name alternative tools, but the context is sufficiently clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_studio_topicGet Studio TopicA
Get Dashboard Studio documentation for a specific topic. Returns comprehensive documentation with examples, schema details, and best practices.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | Documentation topic. Use list_dashboard_studio_topics() to see available topics. Examples: 'cheatsheet', 'definition', 'visualizations', 'configuration', 'datasources', 'framework' | |
| version | No | Splunk version for live Help pages. Default 10.2. Supported: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0 | 10.2 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden. It states that the tool returns 'comprehensive documentation with examples, schema details, and best practices', which is helpful. However, it does not disclose whether the tool accesses the internet (e.g., for live Help pages), any potential latency or network dependencies, or what happens if the topic is invalid. The version parameter is described as 'for live Help pages', which hints at an external lookup, but it could be more explicit about the live fetch behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the main purpose. It wastes no words, though it could benefit from a note about how version affects the output, but given the schema covers that, this is appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, so the description should compensate. It mentions return content (examples, schema details, best practices) but does not specify the return format (e.g., Markdown, JSON), error handling, or whether the content is static or fetched from live help pages. Given the tool's moderate complexity (version parameter for live pages), more detail about the live fetching and failure modes would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, providing detailed descriptions for both parameters, including defaults and allowed versions. The description adds little beyond the schema, but the schema already fully defines the parameters. The description's mention of 'comprehensive documentation' reinforces the output purpose, but it does not explain how version affects the response beyond 'live Help pages'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'Dashboard Studio documentation', and the purpose 'for a specific topic'. It is distinct from siblings like list_dashboard_studio_topics because it retrieves content for one topic rather than listing topics, though it does not explicitly name a sibling to differentiate from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies its use case: when an agent needs specific topic documentation. It references list_dashboard_studio_topics() for available topics, which provides a clear prerequisite. However, it does not state when NOT to use it, such as when the agent needs a full documentation reference or a different product's docs, which would be handled by siblings like get_splunk_documentation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_troubleshooting_guideGet Troubleshooting GuideB
Get detailed Splunk troubleshooting documentation for specific topics. Returns comprehensive troubleshooting guides with diagnostics, solutions, and best practices as an embedded resource.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | Troubleshooting topic. Use list_troubleshooting_topics() to see all available topics. Common topics include: - 'metrics-log' - About metrics.log for performance monitoring - 'splunk-logs' - What Splunk logs about itself - 'platform-instrumentation' - Platform instrumentation overview - 'search-problems' - Splunk web and search problems - 'indexing-performance' - Indexing performance issues - 'indexing-delay' - Event indexing delays - 'authentication-timeouts' - Authentication timeout issues | |
| version | No | Splunk version for documentation. Examples: - '9.4' - Splunk 9.4 documentation - '9.3' - Splunk 9.3 documentation - 'latest' - Latest version (default) | latest |
| auto_detect_version | No | Whether to auto-detect Splunk version from connected instance. Defaults to True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It mentions the resource is 'embedded' and describes content (diagnostics, solutions, best practices) but does not disclose behavior like whether it performs network calls, caching, or error handling. It also doesn't mention if it mutates anything or requires special permissions. For a read-only documentation tool, this is somewhat acceptable but still limited.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and front-loaded with the core action. It efficiently conveys the purpose without redundancy. While it lacks explicit usage guidelines, that is a separate dimension; in terms of structure and length, it is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 3 parameters with full schema descriptions and no output schema, so the description doesn't need to explain return values. However, for a documentation retrieval tool, it could benefit from mentioning the format of the returned resource and any version-specific behavior. The tool is moderately simple, but the lack of behavioral details and alternative guidance leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all parameters, including the topic and version fields with rich examples and defaults. The description itself adds no extra parameter info beyond what's in the schema, so the baseline of 3 applies. It doesn't elaborate on interactions or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches detailed Splunk troubleshooting documentation for specific topics, with a specific verb ('get') and resource ('troubleshooting guide'). It distinguishes from siblings like get_splunk_documentation and get_admin_guide by focusing on troubleshooting, though it could more explicitly differentiate from get_splunk_documentation which might overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool vs alternatives like list_troubleshooting_topics or get_splunk_documentation. However, the context of returning 'detailed troubleshooting guides' implies it's for in-depth problem-solving content, but no clear exclusions or alternatives are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_admin_topicsList Admin TopicsA
List all available admin guide topics with descriptions. Returns a structured list of administration topics that can be used with the get_admin_guide tool. Each topic includes:
Topic key for use in API calls
Description of what the topic covers
Example usage
Use this tool to discover what admin documentation is available before calling get_admin_guide with specific topics.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden of behavioral disclosure. It responsibly discloses what the response contains (topic key, description, example usage) and the tool's role as a prerequisite discovery step for get_admin_guide. Given there's no output schema, disclosing the three returned fields provides meaningful transparency. Could add error handling info or an explicit note that it returns all topics without pagination, but for a list operation this is strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Efficiently written at roughly 60 words with no wasted language. The structure is well-organized: opening declarative statement, scannable bulleted list of included fields, and a closing usage directive. Every element earns its place in the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter documentation discovery tool, this is well-scoped. It covers what it returns, the structure of each topic entry, and how to use it with get_admin_guide. A minor gap: given multiple similarly-named siblings (list_available_topics, list_troubleshooting_topics), a one-word clarification of what makes 'admin' topics distinct could have further reduced ambiguity. Otherwise quite complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, which per the calibration rubric establishes a baseline of 4. The description appropriately avoids inventing parameters and doesn't waste space discussing parameters. The description's focus on return schema (topic key, description, example usage) is appropriate given the parameter-free interface.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource construction: 'List all available admin guide topics with descriptions.' It goes beyond a generic statement by differentiating itself from sibling tools like list_available_topics and list_troubleshooting_topics through explicit 'admin guide' scoping. It also anchors itself to a companion tool (get_admin_guide), which clearly positions it within the tool family.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use guidance is provided: 'Use this tool to discover what admin documentation is available before calling get_admin_guide with specific topics.' While it clearly names the companion tool, it doesn't explicitly contrast itself with other similar listing siblings like list_available_topics or list_troubleshooting_topics, which would have been useful given their near-identical naming patterns.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_alert_actionsList Alert ActionsA
List alert actions installed on the connected Splunk instance, including custom actions. Returns name, label, description, is_custom, app, and param_keys. Call this before create_alert or update_alert when using a custom action so you pass the correct action name and param keys.
Outputs: 'alert_actions' array and 'count'. Security: results are constrained by the authenticated user's permissions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states results are constrained by the authenticated user's permissions and that it lists both standard and custom actions, which gives useful context about scope and security. However, it does not explicitly state that the operation is read-only or has no side effects, though the verb 'list' strongly implies this.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: it opens with the tool's purpose and scope, then lists the returned fields, gives a usage tip, and closes with output and security notes. Every sentence adds distinct value, and the structure makes it easy to skim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has no parameters and no output schema, the description covers everything an agent needs for correct invocation: it lists the return keys ('alert_actions' array and 'count'), explains why to call it (before create/update with custom actions), and notes permission constraints. No critical information is missing for this list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there are no parameter meanings to explain. According to the rubric, a baseline of 4 applies for 0 params. The description appropriately devotes no space to parameters and instead focuses on outputs and usage context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists alert actions installed on the connected Splunk instance, including custom actions, and enumerates the returned fields. This is a specific verb+resource combination that leaves no ambiguity about what the tool does. It inherently distinguishes itself from sibling tools like list_triggered_alerts or list_saved_searches by naming the resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs when to call this tool: before create_alert or update_alert when using a custom action, so the correct action name and param keys are passed. This gives a concrete condition and references alternative tools, providing clear guidance on when to use this tool versus other actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_appsList AppsA
Retrieve comprehensive inventory of all installed Splunk applications including metadata (name, label, version, description, author, visibility status). Use this tool when you need to list all apps in the Splunk environment, such as for auditing, management, or troubleshooting compatibility. This tool requires no arguments.
Returns detailed app catalog with 54+ apps typically found in enterprise environments, including core Splunk apps, add-ons (TAs), custom applications, and third-party integrations.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns a detailed catalog with typical counts (54+ apps), content types (core apps, add-ons, custom, third-party), and metadata fields (name, label, version, description, author, visibility). This goes beyond a generic 'list' and gives concrete behavioral expectations. It implies a read-only operation, but does not explicitly state safety. Overall, it adds meaningful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short paragraphs, front-loaded with the primary purpose. The first sentence immediately says what it does and what it returns. The second paragraph adds useful details about typical contents and volume. Every sentence contributes relevant information without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description provides clear expectations for the return: metadata fields, app categories, and approximate count. It also explains the tool's role in auditing/management. For a simple list operation with no parameters, this is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and the description explicitly states 'This tool requires no arguments', reinforcing the schema's empty property set. The instruction indicates a baseline of 4 for zero-parameter tools. The description adds value by confirming the no-argument requirement, though it is already implied by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve comprehensive inventory of all installed Splunk applications including metadata', specifying the action (Retrieve), resource (inventory of apps), and scope (all installed). It distinguishes from siblings like list_indexes or list_users by explicitly mentioning apps and their metadata. The verb is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states 'Use this tool when you need to list all apps in the Splunk environment, such as for auditing, management, or troubleshooting compatibility', providing clear use cases. It does not explicitly mention when not to use it or name alternatives, but the context is sufficient for typical scenarios. It also notes that it requires no arguments, which is an important usage guideline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_available_topicsList Available TopicsA
List all available documentation topics and URI patterns for discovery. This tool helps LLMs and agentic frameworks understand what documentation topics are available across different categories:
Returns structured information about:
Available troubleshooting topics with descriptions
Available admin guide topics
Common SPL commands with examples
URI patterns for accessing documentation
Version support information
Use this tool first to discover what documentation is available before requesting specific topics.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey side effects and behavior. It clearly states it returns structured information and lists content categories, implying a read-only discovery operation. It lacks an explicit 'no side effects' statement, but given its nature, a score of 4 is fair.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with bullet points, but is slightly verbose. It could be more concise while keeping key information, but it earns a 4.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given it has no output schema, the description thoroughly explains what is returned (topics, descriptions, URI patterns) and provides usage context. For a discovery tool with no params, it is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the description doesn't need to explain parameters. The rule says baseline 4 for 0 params, and this is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb-resource pair: 'List all available documentation topics and URI patterns for discovery.' It clearly differentiates from sibling tools like list_troubleshooting_topics and list_admin_topics by covering all topics across categories. The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using this tool first to discover documentation before requesting specific topics, which distinguishes it from sibling access tools like get_splunk_documentation or list_troubleshooting_topics. This provides clear when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_cim_data_modelsList Cim Data ModelsA
List all available Splunk Common Information Model (CIM) data models. Returns structured information about all 26 CIM data models including name, description, use cases, required tags, and deprecation status. Use this to discover what CIM models are available before calling get_cim_reference.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns 'structured information' and lists specific fields (name, description, use cases, required tags, deprecation status), which is useful behavioral context. It doesn't cover auth, errors, or other runtime aspects, but for a list operation this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentencesβone for purpose, one for usage guidance and return details. No wasted words; the description is front-loaded and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description is complete: it specifies the scope (26 models), the type of output (structured information), and the expected contents. It also gives a practical use case, ensuring the agent knows exactly when to invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is no parameter documentation needed since the schema is empty. The description adds no parameter info, but none is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'List all available Splunk Common Information Model (CIM) data models' with a specific verb and resource. It also differentiates the scope by mentioning 'all 26' and details what information is returned, plus explicitly references the sibling tool 'get_cim_reference' to distinguish its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use the tool: 'before calling get_cim_reference.' This is clear context for a specific use case. However, it doesn't discuss alternatives or when not to use it, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_config_filesList Config FilesA
List common Splunk configuration files (.conf) with descriptions. Returns structured information about configuration files that can be used with get_config_spec() to retrieve detailed specification documentation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description is the sole source of behavioral information. It states that the tool lists 'common' configuration files, implying a scope, and that it returns structured information. It does not mention any side effects (none likely), permissions, or error conditions, but for a read-only listing operation the provided details are reasonable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences. It includes the core function and a note on its relationship to get_config_spec, with no redundant or filler content. Well-structured and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description is complete. It clarifies what it does, the scope ('common'), and the return type ('structured information'), and even indicates how to use the result. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so schema coverage is complete. There is nothing to explain, and the description adds no unnecessary parameter details. This is ideal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List common Splunk configuration files (.conf) with descriptions.' It uses a specific verb ('List') and resource ('configuration files'), and distinguishes from the sibling get_config_spec by indicating that returned info can be used with that tool for detailed specs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool by noting that the returned structured information can be used with get_config_spec() for detailed documentation. This suggests it is for obtaining an overview before drilling down. However, it does not explicitly state alternatives or when not to use it, so it is slightly less than perfect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dashboardsList DashboardsA
List dashboards in Splunk (Simple XML and Dashboard Studio). Returns metadata including name, label, type (classic/studio), app, owner, permissions, sharing level, last updated, and Splunk Web viewing URLs.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Filter by app context. Default: '-' (all apps) | - |
| count | No | Max results to return. 0=all, default: 50 for performance | |
| owner | No | Filter by owner. Use 'me' for current user's dashboards, 'nobody' for shared dashboards, or a specific username. Default: 'nobody' | nobody |
| offset | No | Result offset for pagination. Default: 0 | |
| type_filter | No | Filter by type: 'classic', 'studio', or 'any'. Default: 'any' | any |
| private_only | No | If True, only return private dashboards (sharing='user'). Works with any owner filter. Default: False | |
| search_filter | No | Filter results (e.g., 'name=*security*') | |
| my_dashboards_only | No | If True, only return dashboards owned by the current user. Overrides 'owner' parameter. Default: False |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It does disclose the return scope (classic/studio dashboards) and the metadata fields, but does not mention pagination behavior, permission requirements, or performance implications (e.g., the 'count' parameter default for performance). The description is informative but not fully transparent about edge behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, with the action stated upfront. Every phrase earns its place: it names the target, the scope, and the key return fields without redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with no output schema, the description provides a clear list of return metadata and the scope. It does not mention filtering or pagination in the description, but the schema covers those. The description is sufficiently complete for an agent to understand the tool's primary function and expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each of the 8 parameters having a meaningful description. The description adds no parameter-specific semantics beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('List dashboards in Splunk') and distinguishes the scope (Simple XML and Dashboard Studio). It clearly differentiates from sibling list tools like list_indexes and list_apps by naming the resource and even listing the metadata fields returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a listing use case but does not explicitly state when to use this tool vs alternatives like get_dashboard_definition (for a single dashboard's definition) or create_dashboard. No exclusion or comparison to sibling tools is given, leaving usage context implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dashboard_studio_topicsList Dashboard Studio TopicsA
List all available Dashboard Studio documentation topics. Returns structured information about available topics including cheatsheet, definition schema, visualizations guide, and configuration options. Use this to discover what Dashboard Studio documentation is available.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description implies a read-only listing operation but does not explicitly state side effects or lack thereof. It provides no detail on potential edge cases or rate limits, which would be beneficial given the lack of annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences convey the purpose, the content returned, and a usage hint. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
As a simple listing tool with no parameters and no output schema, the description provides enough context about what topics are covered. It could optionally mention the format of the returned structure, but that is not essential for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters and the schema has full coverage (0 params), so there is no additional meaning to add. The description appropriately does not elaborate on non-existent parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all available Dashboard Studio documentation topics, specifying distinct categories such as cheatsheet, definition schema, visualizations guide, and configuration options. This distinguishes it from sibling list_* tools that target other domains.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises when to use the tool ('Use this to discover what Dashboard Studio documentation is available'). Does not explicitly mention when not to use, but the specificity to Dashboard Studio makes the context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_indexesList IndexesA
Retrieve all accessible data indexes from the Splunk instance. Use this to discover which indexes you can query when building searches or troubleshooting data availability. Returns customer indexes (excludes internal system indexes like _internal and _audit for readability). Results are constrained by the current user's permissions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses that it excludes internal system indexes and that results are permission-constrained. This adds useful behavioral context beyond just 'list indexes'. It's not super detailed but sufficient for a listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, then specifics. No fluff, each sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, zero-output-schema tool, the description provides key context: what it returns, what it excludes, and permission constraints. Missing explicit return structure but adequate given no schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameters to describe. The schema coverage is 100% (trivially). The description adds no parameter-specific info because there is none needed. Baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Retrieve all accessible data indexes' with a specific resource (data indexes) and scope (accessible). It distinguishes from sibling tools like run_splunk_search or list_saved_searches by focusing on index discovery for querying. The verb 'Retrieve' and resource 'data indexes' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states when to use it ('when building searches or queries') and explains context (returns only customer indexes). It doesn't explicitly discuss when NOT to use it or name alternatives, but given the siblings are mostly search/configuration tools, the purpose is clear enough. It could explicitly say 'use this to find the right index before querying' but implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_kvstore_collectionsList Kvstore CollectionsA
List KV Store collections with basic schema details. Use this to discover available KV stores for lookups, configuration, or caching, optionally filtering by app.
Outputs: array of collections with name, fields, accelerated_fields, replicated; and total count. Security: results are constrained by the authenticated user's permissions.Args: app (str, optional): Optional app name to filter collections
| Name | Required | Description | Default |
|---|---|---|---|
| app | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses security constraint and outputs, but is silent on pagination, rate limits, or whether it is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise with an intro, outputs, security note, and argument description. Slight duplication in the args section.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, outputs, security, and filter param. However, no info on pagination or error cases, but those may not be critical for a list operation. Good given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It mentions the app param and its purpose, but no details on accepted values or behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists KV Store collections with schema details aggregates. It distinguishes from siblings like list_indexes by naming the resource type. It also mentions selective filter by app.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It suggests use for discovery, lookups, configuration, or caching, but does not explicitly tell when to use it versus alternatives. Could be improved by mentioning when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_lookup_definitionsList Lookup DefinitionsB
List lookup definitions (transforms) in Splunk. Returns metadata including name, type, associated filename, fields configuration, app, owner, and permissions. Lookup definitions specify how CSV files or external lookups are used in searches.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Filter by app context. Default: '-' (all apps) | - |
| count | No | Max results to return. 0=all, default: 50 for performance | |
| owner | No | Filter by owner. Default: 'nobody' (all users) | nobody |
| offset | No | Result offset for pagination. Default: 0 | |
| search_filter | No | Filter results (e.g., 'filename=*.csv') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It offers some transparency by stating that the tool 'returns metadata including name, type, associated filename, ... permissions', which tells the agent the nature and content of the result. However, it does not explicitly state that the operation is read-only, nor describe pagination behavior, authentication needs, or possible error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, consisting of three targeted sentences that state the purpose, define the resource type, and list expected return fields. It is well-structured and free of filler, though it could be slightly tighter if it omitted the final explanatory sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a listing tool, the description captures the core purpose and key outputs, but it does not clarify the relationship to similar sibling tools or explain how filtering/pagination parameters affect behavior. Given there is no output schema and no annotations, the description is adequate but misses opportunities to give the agent fuller operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% description coverage, so each parameter already has clear semantics and defaults. The description supplies domain context about lookup definitions but does not deepen the meaning of specific parameters like app, owner, or search_filter beyond what the schema already says, so the baseline score of 3 is maintained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('List lookup definitions') and resource ('transforms in Splunk'), so it has specificity beyond a tautology. However, it does not explicitly distinguish this tool from the closely related sibling 'list_lookup_files', so it falls short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given about when to use this tool versus alternatives such as list_lookup_files or run_splunk_search. The description only states what the tool does, leaving the agent to infer appropriate use cases without exclusionary or comparative context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_lookup_filesList Lookup FilesA
List CSV lookup table files in Splunk. Returns metadata including name, filename, app, owner, sharing/permissions, and last updated time. Use this to discover available lookup files. To view the actual CSV content, use run_splunk_search with '| inputlookup '.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Filter by app context. Default: '-' (all apps) | - |
| count | No | Max results to return. 0=all, default: 50 for performance | |
| owner | No | Filter by owner. Default: 'nobody' (all users) | nobody |
| offset | No | Result offset for pagination. Default: 0 | |
| search_filter | No | Filter results (e.g., 'name=*geo*') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It does describe the output metadata, but does not disclose whether the operation has side effects (it appears read-only) or any permission requirements. Since it's a list operation, the risk is low, but the description does not explicitly state its non-destructive nature. This is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of three short sentences that pack purpose, output summary, usage guidance, and an alternative. There is no fluff, and the most important information (the listing action) is front-loaded. Each sentence contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with no output schema and fully described parameters, the description is complete. It informs the agent what the tool returns, when to use it, and how to get more detailed content. No critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes all 5 parameters with descriptions and default values, achieving 100% coverage. The description does not add parameter-specific details beyond what the schema provides, but it does mention the purpose of filtering via 'discover available lookup files' implying the need for filters. Baseline 3 is appropriate since schema covers the parameters fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: 'List CSV lookup table files in Splunk' and specifies the returned metadata fields (name, filename, app, owner, permissions, last updated). It is specific and unambiguous, distinguishing it from generic listing tools by focusing on lookup files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context ('Use this to discover available lookup files') and directs to an alternative tool for viewing content ('use run_splunk_search with '| inputlookup <filename>''). It lacks explicit 'when not to use' guidance, but the alternative is clearly stated, making it easy for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_saved_searchesList Saved SearchesA
List saved searches with ownership, schedule, visibility, and permission metadata. Use this to discover available reports/automations and to filter by owner/app/sharing. Results reflect only saved searches the current user can access.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Filter by application name (optional) | |
| owner | No | Filter by owner name (optional) | |
| sharing | No | Filter by sharing level (optional) | |
| include_disabled | No | Include disabled saved searches (default: False) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It adds meaningful context: results include ownership, schedule, visibility, and permission metadata, and results are limited to saved searches the current user can access. It does not mention pagination, ordering, or output shape, but for a list tool this is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences and immediately states the core purpose. Every sentence adds value: what is listed, how to use it, and the access limitation. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a straightforward list operation with four optional well-documented parameters and no output schema. The description covers purpose, filters, metadata returned, and access scope, which is sufficient for an agent to select and invoke it correctly. Some minor gaps remain around pagination and exact return formatting, but they are not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already explains all four parameters. The description mostly restates filtering by owner/app/sharing, which adds little beyond the schema. The baseline of 3 applies because the structured fields carry the semantic weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('saved searches') and enriches it with metadata types (ownership, schedule, visibility, permission). It distinguishes itself from siblings like get_saved_search_details or run_splunk_search by focusing on discovery and filtering of saved searches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use the tool: 'Use this to discover available reports/automations and to filter by owner/app/sharing.' It also communicates an access boundary, but does not name alternative tools for different use cases (e.g., get_saved_search_details for a single saved search).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sourcesList SourcesA
Discover and enumerate all available data sources from the configured Splunk instance using the metadata command. This tool provides a comprehensive inventory of data sources across all indexes, helping with data discovery, troubleshooting, and understanding the data landscape in your Splunk environment. Sources represent the origin points of data such as log files, network streams, databases, and other data inputs.
Use Cases:
Data discovery and cataloging
Troubleshooting missing data sources
Understanding data flow and origins
Planning data retention and archival
Security analysis and audit trails
Response Format: Returns a dictionary with 'status' field and 'data' containing:
sources: Sorted array of all data source paths/identifiers
count: Total number of unique sources discovered
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden. It does well by revealing the underlying command ('metadata'), framing the operation as a read-only discovery, and detailing the response structure (dictionary with status, data.sources sorted array, and count). However, it doesn't describe error handling, empty-result behavior, potential performance cost of the metadata command, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with clear sections (overview, use cases, response format) and scannable bullet points. The key information is front-loaded. It's slightly verbose with the five-item use-case list, but every section earns its place and the response-format section is genuinely useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with no output schema or annotations, this description covers all bases: it explains what the tool does, why it exists, the exact response structure, and typical use cases. The inline response format effectively substitutes for a formal output schema. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which sets a baseline of 4 per the rubric. There's nothing more the description needs to explain about parameters, and the schema is vacuous (empty object), so no information is missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource: 'Discover and enumerate all available data sources from the configured Splunk instance using the metadata command.' It clearly scopes to 'all indexes' and defines what sources are (origin points like log files, network streams). However, it doesn't explicitly distinguish itself from conceptually similar siblings like list_indexes or list_sourcetypes, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear list of use cases (data discovery, troubleshooting missing sources, retention planning, security analysis) that tell an agent when to invoke this tool. However, it doesn't mention alternatives or exclusion criteria β it never says when NOT to use it or how it differs from similar list_* siblings β so it gets a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sourcetypesList SourcetypesA
Discover and enumerate all available sourcetypes from the configured Splunk instance using the metadata command. Sourcetypes define how Splunk interprets and processes different types of data, controlling parsing rules, field extractions, and indexing behavior. This tool returns a comprehensive list of sourcetypes present in your Splunk environment, essential for data modeling and search optimization.
Use Cases:
Data modeling and CIM compliance
Understanding data variety and formats
Troubleshooting parsing and extraction issues
Planning data preprocessing and transformations
Security analysis and event correlation
Building comprehensive search queries
Response Format: Returns a dictionary with 'status' field and 'data' containing:
sourcetypes: Sorted array of all sourcetype identifiers
count: Total number of unique sourcetypes discovered
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It discloses that the tool uses the metadata command and specifies the exact response shape: a dictionary with 'status' and 'data' containing a sorted sourcetypes array and count. This makes the read-only, list-producing behavior clear, though it does not discuss auth or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an opening summary, a bulleted Use Cases section, and a Response Format section. It is easy to scan and front-loaded, though some bullets are generic and slightly redundant with the opening mention of data modeling and search optimization.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, zero-parameter tool with no output schema, the description is fully self-contained. It explains what sourcetypes are, when the tool is useful, how it works, and exactly what the returned data will contain, so an agent has enough context to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty schema, so there is no parameter-level meaning to add. The baseline for a no-parameter tool is 4, and the description instead adds value by explaining the response payload, which helps the agent understand what to expect after invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence clearly states the tool's purpose: 'Discover and enumerate all available sourcetypes from the configured Splunk instance using the metadata command.' It names a specific resource (sourcetypes), an action (list/enumerate), and distinguishes itself from sibling tools like list_sources or list_indexes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a dedicated 'Use Cases' section covering data modeling, CIM compliance, parsing troubleshooting, and search query building, which gives the agent clear context for when to use this tool. It does not explicitly mention when not to use it or name alternative tools, so it stops short of full exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_spl_commandsList Spl CommandsA
List common SPL (Search Processing Language) commands with descriptions. Returns a structured list of SPL commands that can be used with the get_spl_reference tool. Each command includes:
Command name for use in API calls
Description of what the command does
Example usage
Note: This list includes the most common commands, but get_spl_reference supports many more SPL commands beyond those listed here.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it reveals the return structure (fields), indicates the list is not exhaustive ('most common'), and explains the purpose of the output. This sets accurate expectations for the agent without hiding the limitation of coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with a clear lead sentence followed by a scannable bullet list and a short note. Every sentence adds value, and the structure is easy to parse. It earns a high score for efficiency, though it could be slightly tighter by removing the 'Note:' phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description covers the essentials: what it does, what it returns, and how it relates to get_spl_reference. It could mention whether authentication is needed or return size limits, but those are likely not critical for a list command. The note about coverage is a nice touch that prevents over-reliance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters in the schema, so the baseline is 4. The description does not need to add parameter-level details since there are none. The description's mention of the output structure (command name, description, example) is helpful but not required for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists common SPL commands with descriptions, but it could be more specific about its relationship to the sibling get_spl_reference tool. The verb 'list' plus resource is clear, and the output structure (command name, description, example) is described. It distinguishes itself from siblings by noting it's a curated subset for use with get_spl_reference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions the tool can be used with get_spl_reference, providing context on when to use it. It also notes that get_spl_reference supports more commands, helping users decide between the two. However, it does not explicitly contrast with other list_* tools or state 'use this when...'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_triggered_alertsList Triggered AlertsA
List fired alerts and their details. Use this to review recent triggered alerts, including saved search name, trigger time, owner/app, and trigger reason. Supports a name filter and a max results cap. Note: Splunk's fired alerts feed may not strictly filter by time; earliest/latest are advisory.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Maximum number of alert groups to return (default: 50) | |
| search | No | Case-insensitive substring filter applied to alert group name | |
| latest_time | No | Advisory filter for latest trigger time (default: 'now') | now |
| earliest_time | No | Advisory filter for earliest trigger time (default: '-24h@h') | -24h@h |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does well by disclosing a non-obvious behavioral quirk: Splunk's fired alerts feed may not strictly filter by time, and earliest/latest are advisory. It also mentions the max results cap. It does not detail permissions or response shape, but the key operational caveat is transparently surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the core purpose, followed by practical use context and an important caveat. Every sentence earns its place, and there is no redundant restating of the tool name or schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with no output schema or annotations, the description provides sufficient context: what is returned, how to filter, and the advisory nature of time constraints. It stops short of describing result format or edge cases, but it is complete enough for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing baseline meaning for all four parameters. The description adds value by clarifying that 'search' is a name filter, 'count' is a max results cap, and the time parameters are only advisoryβbeyond what the schema states. This enriches the parameter semantics meaningfully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('fired alerts'), and clearly distinguishes the tool from siblings like list_saved_searches or run_splunk_search by focusing on triggered alert details. The listed fields (saved search name, trigger time, owner/app, trigger reason) make the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Use this to review recent triggered alerts' provides clear context for when the tool is appropriate. It does not explicitly name alternatives or exclusions, but the purpose is distinct enough from sibling tools that the usage guidance is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_troubleshooting_topicsList Troubleshooting TopicsA
List all available troubleshooting topics with descriptions. Returns a structured list of troubleshooting topics that can be used with the get_troubleshooting_guide tool. Each topic includes:
Topic key for use in API calls
Human-readable title
Description of what the topic covers
Example usage
Use this tool to discover what troubleshooting documentation is available before calling get_troubleshooting_guide with specific topics.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses that the tool returns a structured list with specific fields (topic key, title, description, example usage) and that it is read-only in nature (listing). However, it does not mention potential pagination, rate limits, or whether the list is exhaustive, which would be useful for a listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured. It opens with a clear one-sentence summary, then uses a bulleted list to detail the return fields, and ends with a usage directive. Every sentence adds value, and the structure is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description provides sufficient context: it explains the return fields, the purpose, and the workflow with get_troubleshooting_guide. It could be slightly more complete by noting whether the list is sorted or if there are any limitations, but for a simple listing tool, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (empty schema). The description adds value by explaining the return structure and the purpose of the topic keys, which is essential for using the output with get_troubleshooting_guide. Since there are no parameters, the description's explanation of the output fields compensates for the lack of parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all available troubleshooting topics with descriptions, and explicitly notes it returns a structured list for use with get_troubleshooting_guide. This distinguishes it from sibling tools like list_admin_topics and list_available_topics by specifying the troubleshooting domain and its integration with a specific companion tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'Use this tool to discover what troubleshooting documentation is available before calling get_troubleshooting_guide with specific topics.' This provides clear usage context and names the alternative tool, making the workflow explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_usersList UsersA
Retrieve comprehensive inventory of all Splunk users and their properties. Use this tool when you need to list all users in the Splunk environment, such as for security audits, user management, or understanding access patterns. This tool requires no arguments.
Response Format: Returns a dictionary with 'status' field indicating success/error and 'data' containing:
count: Total number of users found
users: Array of user objects with username, realname, email, roles, type, and defaultApp
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It explains that the tool returns a dictionary with a 'status' field and 'data' containing 'count' and 'users' array with properties (username, realname, email, roles, type, defaultApp). This clarifies output format and the nature of the operation (a retrieval). However, it does not mention potential limitations like pagination or permission requirements, but for a simple list operation, the disclosed behavior is adequate for agent decision-making.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear first sentence stating purpose, followed by explicit usage guidance, and a separate 'Response Format' section. It is not overly verbose, though the enumeration of use cases adds a bit of extra length. Overall, it is efficiently written and front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description is quite complete. It covers the purpose, usage context, and details the return format (including the structure of the 'users' array). The only minor gap is the absence of note about potential large responses or error cases, but that is not critical for this straightforward operation. It satisfies the requirements for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description explicitly states 'This tool requires no arguments.' With schema description coverage at 100% (since there are no properties), there is nothing technical to clarify. The baseline for zero parameters is 4, and the description reinforces that fact, earning the full score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Retrieve comprehensive inventory of all Splunk users and their properties.' It uses a specific verb ('Retrieve') and resource ('all Splunk users'), and it distinguishes itself from siblings by listing the exact use cases (security audits, user management, access patterns). No other sibling tool appears to focus on listing users, so it stands apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'Use this tool when you need to list all users in the Splunk environment, such as for security audits, user management, or understanding access patterns.' It also notes that it requires no arguments, which is useful for an agent deciding to call it. There are no explicit alternatives mentioned, but none exist among the siblings, so the guidance is complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflowsList WorkflowsA
List all available workflows from core and contrib sources.
This tool provides a comprehensive listing of troubleshooting workflows available in the MCP Server for Splunk system. It discovers and lists both built-in core workflows and user-contributed workflows from the contrib directory.
Output Formats:
detailed: Complete workflow information with descriptions and metadata (default)
summary: Brief overview with workflow IDs, names, and basic statistics
ids_only: Simple list of workflow IDs for programmatic use
by_category: Workflows organized by category (security, performance, etc.)
Workflow Sources:
Core Workflows: Built-in system workflows (missing_data_troubleshooting, performance_analysis)
Contrib Workflows: User-contributed workflows from contrib/workflows/ directory
Key Information Provided:
Workflow ID and human-readable name
Description and purpose of each workflow
Number of tasks and dependency information
Source (core vs contrib) and validation status
Category and organizational information
Integration instructions for dynamic troubleshoot agent
When to use
Use when you need to discover which workflows exist before running one
Use to filter by category or get just workflow IDs for programmatic selection
Arguments
format_type (optional): "detailed" (default), "summary", "ids_only", or "by_category"
include_core (optional): Include built-in workflows (default: true)
include_contrib (optional): Include contrib workflows (default: true)
category_filter (optional): Filter by category (e.g., "security", "performance")
Outputs
Workflow listings in the requested format, discovery metadata, and category summaries
Note: Only workflows available in this server are listed (core + any contrib present)
Perfect for discovering available troubleshooting capabilities and selecting the right workflow for specific Splunk problems.
| Name | Required | Description | Default |
|---|---|---|---|
| format_type | No | detailed | |
| include_core | No | ||
| category_filter | No | ||
| include_contrib | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly explains what the tool does: lists workflows from core and contrib, supports multiple output formats, and notes that 'Only workflows available in this server are listed.' It does not explicitly state it is a read-only operation, but that is implied by the listing nature. It adds significant context beyond mere existence, covering output formats, sources, and included information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured with clear headers (Output Formats, Workflow Sources, Key Information, When to use, Arguments, Outputs). It front-loads the primary purpose and uses organized sections. While every sentence contributes information, there is some redundancy (e.g., the 'Outputs' section partially duplicates earlier mentions), but overall it is efficient for the level of detail provided.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters, no output schema, and no annotations, the description is exceptionally complete. It details all parameter options, expected return content, sources, and integration context. The agent can select and invoke the tool with full understanding of its behavior and outputs. This is a model of thorough contextual disclosure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description fully compensates by explaining each parameter in detail. For example, it specifies format_type with allowed values ('detailed', 'summary', 'ids_only', 'by_category') and defaults, and similarly describes include_core, include_contrib, and category_filter with usage context. This adds meaning far beyond the raw schema, making it highly actionable for the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List all available workflows from core and contrib sources.' It uses a specific verb ('list') and resource ('workflows') with scope, and it distinguishes itself from sibling tools by focusing specifically on workflows (vs indexes, apps, etc.). The detailed breakdown of output formats and sources reinforces purpose clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a dedicated 'When to use' section with explicit guidance: 'Use when you need to discover which workflows exist before running one' and 'Use to filter by category or get just workflow IDs for programmatic selection.' It provides clear context, though it does not explicitly state exclusions or alternatives. This is strong but lacks a 'when not to use' clause, so a 4 is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage_appsManage AppsA
Manage Splunk application lifecycle operations including enable, disable, restart, and reload actions. Use this tool when you need to change the state of a Splunk app, such as enabling a disabled app, restarting for configuration changes, or troubleshooting issues. This tool provides essential app management capabilities for maintaining Splunk environments, troubleshooting app issues, and controlling app availability. Operations affect app state and may require Splunk restart for some changes to take effect.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Management action to perform. Valid options: - 'enable': Activate the application - 'disable': Deactivate the application - 'restart': Disable then enable the application - 'reload': Refresh application configuration | |
| app_name | Yes | Name of the Splunk application to manage. Examples: - 'search': Core Splunk Search app - 'splunk_monitoring_console': Monitoring Console - 'my_custom_app': Custom business applications |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It mentions that some changes may require Splunk restart, which is useful behavioral info. However, it doesn't disclose other potential side effects like downtime, permission requirements, or whether operations are synchronous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core purpose. Four sentences with information density, but the middle sentence about 'maintaining Splunk environments' is generic filler that could be trimmed. Still well-structured overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the schema covers parameters well and there's no output schema, the description is adequate but not thorough. It misses potential caveats like permissions required or impact on running search heads. The restart note helps, but more behavioral context would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% - both parameters have rich descriptions including enum values and examples. The description adds little beyond restating the actions. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Manage Splunk application lifecycle operations' with specific actions (enable, disable, restart, reload), making the tool's purpose immediately obvious and distinguishing it from sibling tools like list_apps or get_configurations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this tool when you need to change the state of a Splunk app' and gives examples. It implies when not to use (i.e., for listing or viewing) but doesn't name alternative tools. Good context, could be more explicit about exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
meMeA
Retrieve information about the currently authenticated Splunk user. Use this tool whenever you need to check the current user's details, permissions, roles, or capabilities, such as for debugging access issues, understanding available actions, or verifying user context in Splunk environments. This tool requires no arguments.
Response Format: Returns a dictionary with 'status' field indicating success/error and 'data' containing:
username: Current authenticated username
realname: Full display name
email: Email address
roles: Array of assigned role names
type: User type (e.g., 'Splunk')
defaultApp: Default application for the user
capabilities: Array of capabilities granted through roles
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden. It clearly states this is a read operation ('Retrieve information') and outlines the response format, which implies no side effects. It doesn't explicitly state 'read-only' or 'no destructive effects,' but the language is unambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise but comprehensive: purpose, usage scenarios, and detailed response format. Every sentence serves a purpose, front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool with no output schema, the description fully covers what it does, when to use it, and what it returns. It's complete for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters-newline(schema with no properties), so the baseline is 3. The description explicitly states 'requires no arguments,' which adds clarity. No parameter details needed since there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve information about the currently authenticated Splunk user' β a specific verb and resource. It distinguishes itself from siblings like list_users (which likely lists all users) by explicitly focusing on the current user.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance: 'whenever you need to check the current user's details, permissions, roles, or capabilities, such as for debugging access issues, understanding available actions, or verifying user context in Splunk environments.' This clearly directs when to invoke this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_oneshot_searchRun Oneshot SearchA
Run a Splunk search and return results immediately (no job created). Use this when you need a quick lookup or small result set (typically under ~30s) such as simple stats, adβhoc checks, or previews. Do not use for longβrunning or heavy searchesβprefer run_splunk_search in those cases.
Outputs: returns up to 'max_results' events or rows with timing and the executed query. Security: results are constrained by the authenticated user's permissions.Args: query (str): The Splunk search query (SPL) to execute. Can be any valid SPL command or pipeline. The 'search' command is automatically prepended if needed. Examples: 'index=main error', '| metadata type=hosts', '| stats count by sourcetype' earliest_time (str, optional): Search start time in Splunk time format. Examples: '-15m', '-1h', '-1d@d', '2023-01-01T00:00:00' Default: '-15m' latest_time (str, optional): Search end time in Splunk time format. Examples: 'now', '-1h', '2023-01-01T23:59:59' Default: 'now' max_results (int, optional): Maximum number of results to return. Higher values may cause longer execution times. Range: 1-10000. Default: 100
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| latest_time | No | now | |
| max_results | No | ||
| earliest_time | No | -15m |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It covers key aspects: immediate return, no job creation, maximum result limit, timing and executed query in output, permission constraints, and automatic prepending of the 'search' command. It lacks explicit details on failure handling or rate limits, but the disclosed behaviors are comprehensive for a read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with distinct sections for usage, outputs, security, and parameters. It is slightly verbose due to the parameter examples, but every sentence carries useful information. The front-loading of purpose and usage aids quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations and an output schema, the description is remarkably complete. It covers what the tool does, when to use it, semantics of parameters, what output to expect, security constraints, and the automatic 'search' prepending. It even contrasts with the sibling tool. No critical gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema itself has no descriptions (0% coverage), the description's 'Args' section thoroughly documents all four parameters: query (by valid SPL and examples), earliest_time and latest_time (with format examples and defaults), and max_results (with range and impact). This fully compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: it runs a Splunk search and returns results immediately without creating a job. It explicitly contrasts itself with run_splunk_search, distinguishing the oneshot nature and immediate execution. This is a specific verb+resource with clear scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool (quick lookups, small result sets, ad-hoc checks) and when not to use it (long-running or heavy searches), and even names the preferred alternative (run_splunk_search). This leaves no ambiguity for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_splunk_searchRun Splunk SearchA
Run a Splunk search as a tracked job with progress and stats. Use this for complex or longβrunning queries (joins, transforms, large scans) where you need job status, scan/event counts, and reliable result retrieval. Prefer this over oneshot when the query may exceed ~30s or requires progress visibility.
Outputs: job id, results (JSON), counts, timing, and job status. Security: results are constrained by the authenticated user's permissions.Args: query (str): The Splunk search query (SPL) to execute. Can be any valid SPL command or pipeline. Supports complex searches with transforming commands, joins, and subsearches. Examples: 'index=* | stats count by sourcetype', 'search error | eval severity=case(...)' earliest_time (str, optional): Search start time in Splunk time format. Examples: '-24h', '-7d@d', '2023-01-01T00:00:00' Default: '-24h' latest_time (str, optional): Search end time in Splunk time format. Examples: 'now', '-1h', '@d', '2023-01-01T23:59:59' Default: 'now'
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| latest_time | No | now | |
| earliest_time | No | -24h |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses that searches run as tracked jobs, that progress and counts are available, that results are constrained by user permissions, and that outputs include job id, status, counts, and timing. It lacks details about job lifetime, cancellation, or resource consumption, but the key operational behaviors are clearly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with purpose, then moves into usage, outputs, security, and arguments. The inline parameter examples are useful but make the description somewhat longer than strictly needed. Overall, every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with no output schema, the description provides an excellent overview of when to use it, how it behaves, what it returns (job id, results, counts, timing, status), and per-parameter capabilities. It is self-sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description fully compensates. Each parameter is described with type, optionality, defaults, and concrete Splunk time examples. query receives detailed guidance and examples. This goes well beyond the bare property names and types in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Run a Splunk search as a tracked job with progress and stats.' It clearly distinguishes this from run_oneshot_search by emphasizing long-running and complex queries, and explicitly names outputs, making the tool purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: 'Use this for complex or long-running queries... Prefer this over oneshot when the query may exceed ~30s or requires progress visibility.' This directly addresses when and why to use this tool versus its sibling run_oneshot_search.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sentry_testSentry TestA
Test Sentry integration by sending traces, spans, and optionally errors.
This tool creates a complete transaction with nested spans to verify that tracing is working correctly in your Sentry dashboard.
| Name | Required | Description | Default |
|---|---|---|---|
| test_type | No | Type of test to run: - "full": Complete test with transaction, spans, and message - "trace": Only create transaction and spans - "error": Only trigger an error - "message": Only send a test message | full |
| trigger_error | No | If True, triggers a test exception to verify error tracking. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden of behavioral disclosure. It clearly states that the tool sends traces, spans, and optionally errors, and creates a transaction with nested spans. It could mention side effects more thoroughly, such as duplicate events or permission requirements, but the primary behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence states the verb and purpose, and the second adds useful context about the transaction structure. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two optional parameters, full schema coverage, and an output schema, the description is complete. It explains what the tool does, why it is used, and what the user can expect to verify in the Sentry dashboard.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with descriptive parameter explanations for test_type and trigger_error. The description only adds general context about optional errors, so it does not substantially improve parameter understanding beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Test Sentry integration') and clearly names the resource and actions: sending traces, spans, and optionally errors. It further clarifies that a complete transaction with nested spans is created, which distinguishes it from the unrelated Splunk sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: to verify that tracing is working correctly in the Sentry dashboard. It does not provide explicit exclusions or alternative tool mentions, but no Sentry alternatives exist among the sibling tools, so this is acceptable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_alertUpdate AlertA
Update an existing Splunk alert (a scheduled saved search with trigger conditions and optional actions). Omit any field you do not want to change. Search, schedule, trigger, and tracking fields are always patched.
actions_mode (only applies when actions is sent): patch (default): Change only the listed actions and params. Other actions and unspecified params on those actions stay as they are. Use this to change one setting (for example only email.to). Set enabled=false on an action to turn that action off without touching the others. override: The actions list becomes the full set. Listed actions are enabled with the given params; any action currently on the alert but missing from the list is disabled. Use this when you want the alert to have exactly these actions.
Call list_alert_actions first for custom actions and their param names.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App context for lookup | |
| name | Yes | Alert name (required) | |
| owner | No | Owner context for lookup | |
| search | No | New SPL query | |
| actions | No | [{name, params, enabled}] | |
| alert_type | No | Trigger type | |
| is_visible | No | ||
| alert_track | No | Show in Triggered Alerts | |
| description | No | New description | |
| latest_time | No | New dispatch latest time | |
| actions_mode | No | patch|override (default: patch) | patch |
| cron_schedule | No | New cron schedule | |
| earliest_time | No | New dispatch earliest time | |
| alert_severity | No | 1-5 | |
| alert_condition | No | Custom trigger search | |
| alert_threshold | No | Threshold | |
| alert_comparator | No | Comparator | |
| alert_digest_mode | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states that certain fields are always patched and explains the update semantics for actions (partial vs full replacement). It also implicitly warns that actions_mode only applies when actions is sent. While it doesn't specify response format or error handling, it covers the key behavioral nuances well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, using line breaks to separate the main function from the details of actions_mode. It is front-loaded with the core purpose and then provides necessary elaboration without redundancy. Every sentence contributes to understanding the tool's behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (18 parameters, update semantics, and no output schema), the description is quite complete. It explains the patching behavior, actions modes, and necessary prerequisites. However, it doesn't explicitly state what the tool returns (e.g., success indicator), though this might be inferred. It also could mention potential errors (e.g., alert not found), but overall it's comprehensive for an update operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (89%), so the description doesn't need to re-explain each parameter. It adds value by explaining the actions_mode parameter in detail, which the schema only briefly covers as 'patch|override'. The description's note that actions_mode only applies when actions is sent is additional semantic clarity not in the schema, earning a baseline 3 with modest enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool updates an existing Splunk alert, specifying it as a scheduled saved search with trigger conditions and actions. It distinguishes it from similar operations like create_alert and update_saved_search, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (to update an alert) and provides critical operational guidance: omitting fields leaves them unchanged, and it explicitly instructs to call list_alert_actions first for custom actions. It also details the two modes (patch vs override) and when to choose each, which is essential for correct usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_saved_searchUpdate Saved SearchA
Update an existing saved search's configuration including query, scheduling, and other properties. Allows selective modification of saved search parameters while preserving unchanged settings. Supports updating search logic, time ranges, scheduling configuration, and visibility settings for flexible search management.\n\nArgs:\n name (str): Name of the saved search to update (required)\n search (str, optional): New SPL search query\n description (str, optional): New description text\n earliest_time (str, optional): New default earliest time (e.g., '-24h@h', '-7d', '2024-01-01T00:00:00')\n latest_time (str, optional): New default latest time (e.g., 'now', '@d', '2024-01-02T00:00:00')\n is_scheduled (bool, optional): Enable or disable scheduled execution\n cron_schedule (str, optional): New cron expression for scheduling\n is_visible (bool, optional): Show or hide in Splunk UI\n app (str, optional): Application context for saved search lookup\n owner (str, optional): Owner context for saved search lookup\n\nResponse Format:\nReturns dictionary with 'status', 'name', 'updated', 'changes_made', and 'updated_at' fields.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| name | Yes | ||
| owner | No | ||
| search | No | ||
| is_visible | No | ||
| description | No | ||
| latest_time | No | ||
| is_scheduled | No | ||
| cron_schedule | No | ||
| earliest_time | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It explains that changes are selective and preserve unchanged settings, which is useful. However, it does not mention side effects, permissions, idempotency, or error behavior. The response format is provided but not what 'status' values mean or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear summary, an Args section with per-parameter explanations, and a Response Format section. It is front-loaded with the main purpose. While it is somewhat long due to the parameter list, that is necessary given the 10 parameters. No unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, no output schema, no annotations), the description covers the purpose, usage, parameters with examples, and response format. It is comprehensive enough for an agent to understand how to invoke the tool correctly. It could mention edge cases or permission requirements, but for a typical update operation it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so thoroughly by listing each parameter with a meaningful description, including examples for time ranges (e.g., '-24h@h'). This adds significant value beyond the raw schema, making it clear what each parameter controls.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Update an existing saved search's configuration including query, scheduling, and other properties.' It uses a specific verb (update) and resource (saved search), and distinguishes itself from create/delete siblings by emphasizing selective modification while preserving unchanged settings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you need to modify an existing saved search without recreating it. It mentions selective modification and preserving unchanged settings, which clarifies usage context. However, it does not explicitly contrast with create_saved_search or delete_saved_search, though the distinction is inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_agent_infoUser Agent InfoA
Return request headers and context details for debugging.
Includes all HTTP headers (with sensitive values masked) and core context metadata.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses that sensitive values are masked)Skip useful detail. It doesn't mention read-only nature or any side effects (likely none). For a zero-param debug tool, this is acceptable but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, information-dense, front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an output schema, the description covers what it returns, mentions sensitive value masking, and debugging context. Could specify what 'core context metadata' includes, but sufficient for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has zero parameters, so description need not explain parameters. Base score 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns request headers and context details for debugging. The verb 'return' is specific, the resource is well-defined, and it distinguishes from the Splunk-centric sibling tools which all deal with searches, dashboards, or configs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging, which gives context but does not explicitly state when not to use it or exclusions. However, since no sibling tool serves this purposeholistically, it's clear when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workflow_builderWorkflow BuilderA
Interactive tool for creating, editing, and validating custom workflows.
This tool provides comprehensive workflow development capabilities for creating custom troubleshooting workflows that integrate with the MCP Server for Splunk dynamic troubleshooting system. It supports multiple modes of operation to accommodate different workflow development needs.
Modes:
create: Interactive workflow creation with guided prompts
edit: Modify existing workflow definitions with validation
validate: Comprehensive validation of workflow structure and dependencies
template: Generate pre-built workflow templates for common use cases
process: Process and validate finished workflow definitions
Key Capabilities:
Step-by-step workflow creation with validation
Template generation for common workflow patterns
Comprehensive validation including dependency analysis
JSON output generation with proper formatting
Integration testing and compatibility verification
Processing of complete workflow definitions
Validation Features:
Schema compliance verification
Circular dependency detection
Tool availability checking
Context variable validation
Integration compatibility assessment
When to use
Use to create new workflows from templates or from scratch
Use to edit or validate an existing workflow JSON before contributing or running it
Use to generate templates and examples for standard categories (security, performance, data quality)
Arguments
mode (optional): "create", "edit", "validate", "template", or "process" (default: "create")
workflow_data (optional): JSON string or object when editing/validating/processing
template_type (optional): Template key when
mode="template"(e.g., "minimal", "security")file_path (optional): Path to workflow file when
mode="validate"
Outputs
Structured results including validation summaries, templates, or processed workflow data
Ready-to-validate workflow JSON for discovery via
list_workflows
Perfect for workflow contributors who need guided assistance in creating well-structured, validated workflows for contrib or core catalogs.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | create | |
| file_path | No | ||
| template_type | No | minimal | |
| workflow_data | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It does disclose key behaviors: multiple modes, interactive creation, validation features (dependency analysis, circular detection), JSON output generation. However, it lacks specifics about side effects (e.g., does 'edit' modify in-place or return new JSON? does 'validate' require file system access?), authentication needs, and the exact output structure. The description adds moderate context beyond the bare schema, but leaves ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: Modes, Key Capabilities, Validation Features, When to use, Arguments, Outputs. Each section is concise and scannable. Sentences are direct and without fluff. It front-loads the core purpose and then details specifics. Length is appropriate for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 modes, 4 mixed parameters, no annotations, no output schema), the description covers the main dimensions: modes, capabilities, validation features, usage guidance, and parameter semantics. It doesn't specify exact response format or error handling, but the 'Outputs' section gives a general idea. The description is sufficient for an agent to understand what the tool does and when to invoke it, though edge cases (e.g., what if mode=edit without workflow_data?) are not clarified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides minimal info with 0% description coverage in schema. The description compensates reasonably by explaining each parameter: mode lists allowed values, workflow_data for editing/validating/processing, template_type for template mode, file_path for validate mode. It adds meaning ('JSON string or object'), but doesn't provide format details, allowed modes enum (though lists them in prose), or examples. Since schema coverage is low, the description's per-parameter details are valuable, hence a 3 rather than 2.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: an interactive tool for creating, editing, and validating custom workflows. It explicitly lists various modes and capabilities, and distinguishes itself from siblings by focusing on workflow construction rather than execution. The verb 'create/edit/validate' plus resource 'custom workflows' is specific, though it bundles multiple operations which slightly dulls clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a 'When to use' section with explicit use cases such as creating new workflows, editing/validating before contributing, and generating templates. It doesn't explicitly state when NOT to use it, but the sibling tools (e.g., list_workflows for discovery, run_splunk_search for execution) imply clear boundaries. The several 'use to' bullets are helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workflow_requirementsWorkflow RequirementsA
Get comprehensive requirements and schema information for creating custom workflows.
This tool provides detailed documentation for creating custom troubleshooting workflows that integrate with the MCP Server for Splunk dynamic troubleshooting system. It includes complete schema definitions, available tools, context variables, validation rules, and integration guidelines.
Output Formats:
detailed: Complete requirements with examples and explanations (default)
schema: JSON schema definitions for validation tools
quick: Quick reference for experienced contributors
examples: Example workflow structures and common patterns
Key Information Provided:
WorkflowDefinition and TaskDefinition schema structures
Complete list of available Splunk tools with descriptions
Context variables and their usage patterns
Validation rules and constraints
Integration points with dynamic troubleshoot agent
Best practices for workflow design and task creation
When to use
Use at the beginning of authoring to understand schemas and constraints
Use during development for quick reference to context variables and available tools
Use in CI/validation tooling to fetch schemas for automated checks
Arguments
format_type (optional): "detailed" (default), "schema", "quick", or "examples"
Outputs
Full schema and best practices (detailed), just schemas (schema), quick cheat sheet (quick), or examples
Perfect for workflow contributors who need to understand the requirements and structure for creating custom diagnostic workflows.
| Name | Required | Description | Default |
|---|---|---|---|
| format_type | No | detailed |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden. It accurately implies this is a read-only informational tool by its non-mutating verbs ('Get', 'provides') and describes what it returns, but it does not explicitly state that it has no side effects, does not require special permissions, or any other behavioral constraints. For a documentation retrieval tool, this is adequate but not rich in behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections and bullet points, front-loading the main purpose. It is a bit lengthy but every sentence contributes to understanding the tool's capabilities, formats, and use cases. It avoids redundancy and maintains a clear flow, though it could be slightly tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema) and its role as a documentation provider, the description is exceptionally complete. It details output formats, key information, usage scenarios, parameters, and outputs, giving an agent everything needed to decide when and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only defines format_type with a default but no description (0% coverage). The description compensates fully by explaining the parameter and its allowed values: 'format_type (optional): "detailed" (default), "schema", "quick", or "examples".' This goes well beyond the schema by providing semantic meaning and valid options.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get comprehensive requirements and schema information for creating custom workflows.' It uses a specific verb ('Get') and resource ('requirements and schema information'), and distinguishes itself from sibling tools like workflow_builder by focusing on documentation for workflow creation rather than actual building.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a 'When to use' section that explicitly lists three concrete scenarios: at the beginning of authoring, during development, and in CI/validation tooling. It does not mention when NOT to use it or name alternative tools, but the guidance is clear and useful, earning a strong 4 rather than 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v0.6.10- Added
create_alert - Added
delete_alert - Changed
get_studio_topic1 field changed- added
Input schema / properties / versionAdded value: +{ + "default": "10.2", + "description": "Splunk version for live Help pages. Default 10.2. Supported: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0", + "type": "string" +}
- Added
list_alert_actions - Added
update_alert
1 tool update
v0.6.9- Removed
workflow_runner
1 tool update
v0.6.5- Changed
create_dashboard3 fields changed- changed
Input schema / properties / theme / defaultPrevious value: -"light"New value: +"auto" - changed
Input schema / properties / theme / descriptionPrevious value: -"Dashboard Studio UI theme when the tool wraps JSON into XML: 'light' or 'dark' (default: 'light'). Ignored for Classic Simple XML and when you pass a pre-wrapped Studio XML string (already containing <dashboard>)."New value: +"Dashboard Studio UI theme when wrapping JSON: 'light', 'dark', or 'auto' (default: 'auto'). With 'auto', reads uiSettings.theme / theme from Studio JSON or pre-wrapped XML; falls back to 'dark'. Ignored for Classic Simple XML." - changed
Input schema / properties / theme / enumPrevious value: -[ - "light", - "dark" -]New value: +[ + "light", + "dark", + "auto" +]
23 tool updates
v0.6.1- Changed
create_config6 fields changed- added
Input schema / properties / app / descriptionAdded value: +"App namespace for the config (defaults to 'search' if not provided)." - added
Input schema / properties / conf_file / descriptionAdded value: +"Configuration file name without .conf (e.g., 'props', 'transforms')." - added
Input schema / properties / overwrite / descriptionAdded value: +"Overwrite existing keys if True; otherwise skip them." - added
Input schema / properties / owner / descriptionAdded value: +"Owner namespace (defaults to current session user if available)." - added
Input schema / properties / settings / descriptionAdded value: +"Key/value settings to apply in the stanza." - added
Input schema / properties / stanza / descriptionAdded value: +"Stanza name to create/update."
- Changed
create_dashboard13 fields changed- added
Input schema / properties / app / descriptionAdded value: +"App context. Default: 'search'" - added
Input schema / properties / dashboard_type / descriptionAdded value: +"'studio'|'classic'|'auto' (default: 'auto')" - added
Input schema / properties / definition / descriptionAdded value: +"Studio JSON (dict/string) or Classic XML (string) (required)" - removed
Input schema / properties / definition / titleRemoved value: -"Definition" - added
Input schema / properties / description / descriptionAdded value: +"Dashboard description" - added
Input schema / properties / label / descriptionAdded value: +"Human label shown in UI" - added
Input schema / properties / name / descriptionAdded value: +"Dashboard name (required)" - added
Input schema / properties / overwrite / descriptionAdded value: +"If True, updates existing dashboard of same name" - added
Input schema / properties / owner / descriptionAdded value: +"Dashboard owner. Default: 'nobody'" - added
Input schema / properties / read_perms / descriptionAdded value: +"Roles/users granted read" - added
Input schema / properties / sharing / descriptionAdded value: +"'user'|'app'|'global'" - added
Input schema / properties / themeAdded value: +{ + "default": "light", + "description": "Dashboard Studio UI theme when the tool wraps JSON into XML: 'light' or 'dark' (default: 'light'). Ignored for Classic Simple XML and when you pass a pre-wrapped Studio XML string (already containing <dashboard>).", + "enum": [ + "light", + "dark" + ], + "type": "string" +} - added
Input schema / properties / write_perms / descriptionAdded value: +"Roles/users granted write"
- Changed
create_kvstore_collection6 fields changed- added
Input schema / properties / accelerated_fields / descriptionAdded value: +"Index definitions for faster queries" - added
Input schema / properties / app / descriptionAdded value: +"Target Splunk application where the collection will be created. Examples:\n- 'search': Default search app\n- 'my_app': Custom application\n- 'splunk_monitoring_console': Monitoring console app" - added
Input schema / properties / collection / descriptionAdded value: +"Name for the new collection (alphanumeric and underscores only). Examples:\n- 'users': User information store\n- 'configurations': Application settings\n- 'lookup_table': Data enrichment table" - added
Input schema / properties / create_lookup_definition / descriptionAdded value: +"Also create a transforms.conf lookup definition (default: False)" - added
Input schema / properties / fields / descriptionAdded value: +"Field definitions specifying data types and constraints" - added
Input schema / properties / replicated / descriptionAdded value: +"Whether to replicate across cluster (default: True)"
- Changed
enhance_tool_description3 fields changed- added
Input schema / properties / generate_examples / descriptionAdded value: +"Whether to generate parameter examples based on the tool's signature and category. Defaults to True." - added
Input schema / properties / include_response_format / descriptionAdded value: +"Whether to analyze and include expected response format information. Defaults to True." - added
Input schema / properties / tool_name / descriptionAdded value: +"Name of the tool to enhance (e.g., 'get_configurations', 'list_indexes')"
- Changed
get_admin_guide3 fields changed- added
Input schema / properties / auto_detect_version / descriptionAdded value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True." - added
Input schema / properties / topic / descriptionAdded value: +"Administration topic. Use list_admin_topics() to see all available topics. Common topics include:\n- 'indexes' - Index management and configuration\n- 'authentication' - User authentication setup\n- 'users' - User management and roles\n- 'apps' - Application management\n- 'deployment' - Deployment configuration\n- 'monitoring' - System monitoring setup\n- 'performance' - Performance optimization\n- 'security' - Security configuration\n- 'forwarders' - Forwarder configuration\n- 'clustering' - Clustering setup" - added
Input schema / properties / version / descriptionAdded value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
- Changed
get_cim_reference2 fields changed- added
Input schema / properties / model / descriptionAdded value: +"CIM data model name. Use list_cim_data_models() to see all available models. Examples: 'authentication', 'network-traffic', 'malware'" - added
Input schema / properties / version / descriptionAdded value: +"CIM version (default: 'latest'). Options: '6.1', '6.0', '5.3', '5.2', '5.1', 'latest'"
- Changed
get_config_spec1 field changed- added
Input schema / properties / config / descriptionAdded value: +"Configuration file name (with or without .conf extension). Use list_config_files() to see common files. Examples: 'props.conf', 'transforms', 'indexes.conf'"
- Changed
get_configurations4 fields changed- added
Input schema / properties / app / descriptionAdded value: +"Filter results to stanzas owned by this app (namespace)." - added
Input schema / properties / conf_file / descriptionAdded value: +"Configuration file name without .conf extension (e.g., 'props', 'transforms', 'inputs', 'outputs', 'server', 'web')" - added
Input schema / properties / owner / descriptionAdded value: +"Filter results to stanzas owned by this owner (user)." - added
Input schema / properties / stanza / descriptionAdded value: +"Specific stanza name within the conf file to retrieve. If not provided, returns all stanzas in the file."
- Changed
get_dashboard_definition3 fields changed- added
Input schema / properties / app / descriptionAdded value: +"App context. Default: 'search'" - added
Input schema / properties / name / descriptionAdded value: +"Dashboard name (required)" - added
Input schema / properties / owner / descriptionAdded value: +"Dashboard owner. Default: 'nobody'"
- Changed
get_kvstore_data3 fields changed- added
Input schema / properties / app / descriptionAdded value: +"App where the collection resides (defaults to current/app context)" - added
Input schema / properties / collection / descriptionAdded value: +"Collection name" - added
Input schema / properties / query / descriptionAdded value: +"MongoDB-style filter object (e.g., {\"status\": \"active\"})"
- Changed
get_metadata5 fields changed- added
Input schema / properties / earliest_time / descriptionAdded value: +"Search start time (e.g., '-24h@h') (default: '-24h@h')" - added
Input schema / properties / field / descriptionAdded value: +"Metadata field to list values for. One of 'host', 'sourcetype', or 'source' (default: 'host')" - added
Input schema / properties / index / descriptionAdded value: +"Target index to inspect (e.g., 'main', 'security')" - added
Input schema / properties / latest_time / descriptionAdded value: +"Search end time (e.g., 'now') (default: 'now')" - added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of distinct values to return (default: 100)"
- Changed
get_search_job_info2 fields changed- added
Input schema / properties / include_raw_content / descriptionAdded value: +"Include raw job.content for debugging (default: False)" - added
Input schema / properties / job_id / descriptionAdded value: +"Splunk search job id (sid)"
- Changed
get_spl_reference3 fields changed- added
Input schema / properties / auto_detect_version / descriptionAdded value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True." - added
Input schema / properties / command / descriptionAdded value: +"SPL command name. Use list_spl_commands() to see common commands. Examples:\n- 'stats' - Statistical aggregation command\n- 'eval' - Field calculation and manipulation\n- 'search' - Search filtering command\n- 'timechart' - Time-based charting\n- 'rex' - Regular expression field extraction\n- 'lookup' - Data enrichment from lookups" - added
Input schema / properties / version / descriptionAdded value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
- Changed
get_splunk_documentation2 fields changed- added
Input schema / properties / auto_detect_version / descriptionAdded value: +"Whether to auto-detect Splunk version for dynamic resources. Defaults to True." - added
Input schema / properties / doc_uri / descriptionAdded value: +"Documentation URI pattern. Use list_available_topics() to see all available URI patterns and topics. Examples:\n- 'splunk-docs://cheat-sheet' - Splunk SPL cheat sheet\n- 'splunk-docs://discovery' - Available documentation discovery\n- 'splunk-docs://9.4/spl-reference/stats' - SPL stats command\n- 'splunk-docs://latest/troubleshooting/metrics-log' - Troubleshooting guide\n- 'splunk-docs://9.3/admin/indexes' - Admin guide for indexes\n- 'splunk-cim://authentication' - CIM data model (latest version)\n- 'splunk-cim://6.1/network-traffic' - CIM data model (specific version)\n- 'splunk-cim://discovery' - CIM discovery index\n- 'dashboard-studio://cheatsheet' - Dashboard Studio cheatsheet\n- 'dashboard-studio://discovery' - Dashboard Studio discovery\n- 'splunk-spec://props.conf' - Config file specification"
- Changed
get_studio_topic1 field changed- added
Input schema / properties / topic / descriptionAdded value: +"Documentation topic. Use list_dashboard_studio_topics() to see available topics. Examples: 'cheatsheet', 'definition', 'visualizations', 'configuration', 'datasources', 'framework'"
- Changed
get_troubleshooting_guide3 fields changed- added
Input schema / properties / auto_detect_version / descriptionAdded value: +"Whether to auto-detect Splunk version from connected instance. Defaults to True." - added
Input schema / properties / topic / descriptionAdded value: +"Troubleshooting topic. Use list_troubleshooting_topics() to see all available topics. Common topics include:\n- 'metrics-log' - About metrics.log for performance monitoring\n- 'splunk-logs' - What Splunk logs about itself\n- 'platform-instrumentation' - Platform instrumentation overview\n- 'search-problems' - Splunk web and search problems\n- 'indexing-performance' - Indexing performance issues\n- 'indexing-delay' - Event indexing delays\n- 'authentication-timeouts' - Authentication timeout issues" - added
Input schema / properties / version / descriptionAdded value: +"Splunk version for documentation. Examples:\n- '9.4' - Splunk 9.4 documentation\n- '9.3' - Splunk 9.3 documentation\n- 'latest' - Latest version (default)"
- Changed
list_dashboards8 fields changed- added
Input schema / properties / app / descriptionAdded value: +"Filter by app context. Default: '-' (all apps)" - added
Input schema / properties / count / descriptionAdded value: +"Max results to return. 0=all, default: 50 for performance" - added
Input schema / properties / my_dashboards_only / descriptionAdded value: +"If True, only return dashboards owned by the current user. Overrides 'owner' parameter. Default: False" - added
Input schema / properties / offset / descriptionAdded value: +"Result offset for pagination. Default: 0" - added
Input schema / properties / owner / descriptionAdded value: +"Filter by owner. Use 'me' for current user's dashboards, 'nobody' for shared dashboards, or a specific username. Default: 'nobody'" - added
Input schema / properties / private_only / descriptionAdded value: +"If True, only return private dashboards (sharing='user'). Works with any owner filter. Default: False" - added
Input schema / properties / search_filter / descriptionAdded value: +"Filter results (e.g., 'name=*security*')" - added
Input schema / properties / type_filter / descriptionAdded value: +"Filter by type: 'classic', 'studio', or 'any'. Default: 'any'"
- Changed
list_lookup_definitions5 fields changed- added
Input schema / properties / app / descriptionAdded value: +"Filter by app context. Default: '-' (all apps)" - added
Input schema / properties / count / descriptionAdded value: +"Max results to return. 0=all, default: 50 for performance" - added
Input schema / properties / offset / descriptionAdded value: +"Result offset for pagination. Default: 0" - added
Input schema / properties / owner / descriptionAdded value: +"Filter by owner. Default: 'nobody' (all users)" - added
Input schema / properties / search_filter / descriptionAdded value: +"Filter results (e.g., 'filename=*.csv')"
- Changed
list_lookup_files5 fields changed- added
Input schema / properties / app / descriptionAdded value: +"Filter by app context. Default: '-' (all apps)" - added
Input schema / properties / count / descriptionAdded value: +"Max results to return. 0=all, default: 50 for performance" - added
Input schema / properties / offset / descriptionAdded value: +"Result offset for pagination. Default: 0" - added
Input schema / properties / owner / descriptionAdded value: +"Filter by owner. Default: 'nobody' (all users)" - added
Input schema / properties / search_filter / descriptionAdded value: +"Filter results (e.g., 'name=*geo*')"
- Changed
list_saved_searches4 fields changed- added
Input schema / properties / app / descriptionAdded value: +"Filter by application name (optional)" - added
Input schema / properties / include_disabled / descriptionAdded value: +"Include disabled saved searches (default: False)" - added
Input schema / properties / owner / descriptionAdded value: +"Filter by owner name (optional)" - added
Input schema / properties / sharing / descriptionAdded value: +"Filter by sharing level (optional)"
- Changed
list_triggered_alerts4 fields changed- added
Input schema / properties / count / descriptionAdded value: +"Maximum number of alert groups to return (default: 50)" - added
Input schema / properties / earliest_time / descriptionAdded value: +"Advisory filter for earliest trigger time (default: '-24h@h')" - added
Input schema / properties / latest_time / descriptionAdded value: +"Advisory filter for latest trigger time (default: 'now')" - added
Input schema / properties / search / descriptionAdded value: +"Case-insensitive substring filter applied to alert group name"
- Changed
manage_apps2 fields changed- added
Input schema / properties / action / descriptionAdded value: +"Management action to perform. Valid options:\n- 'enable': Activate the application\n- 'disable': Deactivate the application\n- 'restart': Disable then enable the application\n- 'reload': Refresh application configuration" - added
Input schema / properties / app_name / descriptionAdded value: +"Name of the Splunk application to manage. Examples:\n- 'search': Core Splunk Search app\n- 'splunk_monitoring_console': Monitoring Console\n- 'my_custom_app': Custom business applications"
- Changed
sentry_test2 fields changed- added
Input schema / properties / test_type / descriptionAdded value: +"Type of test to run:\n - \"full\": Complete test with transaction, spans, and message\n - \"trace\": Only create transaction and spans\n - \"error\": Only trigger an error\n - \"message\": Only send a test message" - added
Input schema / properties / trigger_error / descriptionAdded value: +"If True, triggers a test exception to verify error tracking."
53 tool updates
v0.5.1- Changed
create_config1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
create_dashboard1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
create_kvstore_collection1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
create_saved_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
delete_saved_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
discover_splunk_docs1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
enhance_tool_description1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
execute_saved_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_admin_guide1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_cim_reference1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_config_spec1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_configurations1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_dashboard_definition1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_executed_workflows1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_kvstore_data1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_metadata1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_saved_search_details1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Added
get_search_job_info - Changed
get_spl_reference1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_splunk_cheat_sheet1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_splunk_documentation1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_splunk_health1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_studio_topic1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
get_troubleshooting_guide1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_admin_topics1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_apps1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_available_topics1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_cim_data_models1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_config_files1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_dashboard_studio_topics1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_dashboards1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_indexes1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_kvstore_collections1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_lookup_definitions1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_lookup_files1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_saved_searches1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_sources1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_sourcetypes1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_spl_commands1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_triggered_alerts1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_troubleshooting_topics1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_users1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
list_workflows1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
manage_apps1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
me1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
run_oneshot_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
run_splunk_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
sentry_test1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
update_saved_search1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
user_agent_info5 fields changed- added
Input schema / additionalPropertiesAdded value: +false - removed
Output schema / additionalPropertiesRemoved value: -true - added
Output schema / propertiesAdded value: +{ + "result": { + "type": "string" + } +} - added
Output schema / requiredAdded value: +[ + "result" +] - added
Output schema / x-fastmcp-wrap-resultAdded value: +true
- Changed
workflow_builder1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
workflow_requirements1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
workflow_runner1 field changed- added
Input schema / additionalPropertiesAdded value: +false
52 tool updates
v0.5.0- First observed
create_config - First observed
create_dashboard - First observed
create_kvstore_collection - First observed
create_saved_search - First observed
delete_saved_search - First observed
discover_splunk_docs - First observed
enhance_tool_description - First observed
execute_saved_search - First observed
get_admin_guide - First observed
get_cim_reference - First observed
get_config_spec - First observed
get_configurations - First observed
get_dashboard_definition - First observed
get_executed_workflows - First observed
get_kvstore_data - First observed
get_metadata - First observed
get_saved_search_details - First observed
get_spl_reference - First observed
get_splunk_cheat_sheet - First observed
get_splunk_documentation - First observed
get_splunk_health - First observed
get_studio_topic - First observed
get_troubleshooting_guide - First observed
list_admin_topics - First observed
list_apps - First observed
list_available_topics - First observed
list_cim_data_models - First observed
list_config_files - First observed
list_dashboard_studio_topics - First observed
list_dashboards - First observed
list_indexes - First observed
list_kvstore_collections - First observed
list_lookup_definitions - First observed
list_lookup_files - First observed
list_saved_searches - First observed
list_sources - First observed
list_sourcetypes - First observed
list_spl_commands - First observed
list_triggered_alerts - First observed
list_troubleshooting_topics - First observed
list_users - First observed
list_workflows - First observed
manage_apps - First observed
me - First observed
run_oneshot_search - First observed
run_splunk_search - First observed
sentry_test - First observed
update_saved_search - First observed
user_agent_info - First observed
workflow_builder - First observed
workflow_requirements - First observed
workflow_runner
TDQS
Most tools have clearly distinct purposes, but the documentation tools (e.g., discover_splunk_docs, list_available_topics, get_splunk_documentation) overlap significantly, causing potential confusion for an agent.
The vast majority use a consistent verb_noun snake_case pattern (e.g., create_config, list_apps). However, the tool 'me' breaks the pattern by being a single word without a verb, making it an outlier.
With 53 tools, the server is overly large for an MCP server. While Splunk is complex, many tools (especially documentation ones) could be consolidated, and the high count reduces coherence.
Core operations like saved searches and search execution are well covered, but notable gaps exist: no update/delete for dashboards or KV store collections, and no alert or lookup definition creation tools.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Agent-native security, trust, reliability, data and procurement tools for AI workflows.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Build, validate, and deploy multi-agent AI solutions from any AI environment.
AI agent run monitoring with incident replay and SLA receipts.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Splunk Enterprise and Splunk Cloud instances through standardized MCP interface. Supports executing SPL queries, managing indexes and saved searches, listing applications, and retrieving server information with flexible authentication options.-
- AlicenseBqualityDmaintenanceEnables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.311Apache 2.0
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to search, manage, and analyze data in Splunk instances through the Model Context Protocol. Supports SPL queries, index management, alerts, dashboards, and more.1Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/deslicer/mcp-for-splunk'
If you have feedback or need assistance with the MCP directory API, please join our Discord server