Connecting to the MCP Server and settings

Splunk MCP Server provides a standardized, secure interface for connecting AI assistants, agents, and other intelligent systems to data in the Splunk platform.

To connect an MCP client, you need an encrypted MCP token and the MCP Server endpoint. Users with the required permissions can create their own encrypted MCP tokens in the Splunk MCP Server app.

Administrators can also manage the tools available to MCP clients, configure server limits and rate controls, and manage allowed SPL commands.

For more information about available tools and tool namespacing, see Tool namespacing in the MCP Server tools topic.

Connect and use an MCP client

Complete the following steps to connect to and use an MCP client.

Step 1: Create an encrypted token for your MCP client

Splunk MCP Server requires encrypted tokens to authenticate MCP clients. These tokens are intended for MCP authentication and cannot be used for direct Splunk API calls.

Users with the required permissions can create and manage their own encrypted MCP tokens in the Splunk MCP Server app without requiring an administrator to provision each token.

For prerequisites and instructions on creating an encrypted MCP token, see Manage encrypted tokens for Splunk MCP Server.

About tokens

Keep the following considerations in mind when using encrypted MCP tokens:

  • Encrypted MCP tokens are authentication credentials. Store them securely and share them only with trusted MCP clients that require access.

  • Each user must use their own encrypted MCP token to authenticate with the MCP Server.

  • Encrypted MCP tokens are intended exclusively for MCP authentication and cannot be used for direct Splunk API calls.

  • Users with the required permissions can create, activate, deactivate, and delete their own encrypted MCP tokens in the Splunk MCP Server app.

  • Encrypted MCP tokens are also Splunk tokens and can be viewed on the main Splunk Tokens page.

Step 2: Configure your MCP client

After the MCP Server has been configured for your Splunk platform deployment, authorized users can connect using a compatible MCP client that supports the streamable HTTP protocol.

Get your MCP server endpoint and configuration

When you create an encrypted MCP token, the Splunk MCP Server app provides a JSON configuration example containing the MCP Server endpoint and your generated token.

Copy the configuration and use it to configure your MCP client, making any adjustments required for your client and operating system.

If you are configuring a client manually, use the sample JSON configuration that follows and replace the endpoint and encrypted-token placeholders with your own values.

See the following sample client configuration in JSON:

JSON 
{ 
 "mcpServers": { 
   "splunk-mcp-server": { 
     "command": "npx", 
     "args": [ 
       "-y", 
       "mcp-remote", 
       "https://<MCP_SERVER_ENDPOINT>", 
       "--header", 
       "Authorization: Bearer <YOUR_ENCRYPTED_TOKEN>" 
     ] 
   }
Note: MCP client configuration can vary depending on the client and operating system. Your MCP client might have additional dependencies such as Node.js and mcp-remote that are not owned by Splunk.

Replace placeholders

If you use the sample configuration from the previous section, replace the following placeholders with your own information as follows:
Placeholder Replace with this value
<MCP_SERVER_ENDPOINT> Your endpoint URL from the Splunk MCP Server app.
<YOUR_ENCRYPTED_TOKEN> The encrypted token generated in Step 1.

MCP Server settings

Administrators with the mcp_tool_admin capability can manage MCP Server settings, including server limits, rate controls, and allowed SPL commands.

In the Splunk MCP Server app, select Setting, and then choose the appropriate tab:

  • Server: View and edit server limits and rate controls for MCP tool execution.

  • Commands: View and manage allowed SPL commands that run through Splunk MCP Server.

  • Tools: View and manage MCP tools available in the Splunk instance.

For more information about configuring rate limits, see MCP Server rate limiting.

Configure self-signed certificates (non-production only)

The MCP server can be configured to connect with Splunk using self-signed certificates for testing purposes.

CAUTION: Do not use self-signed certificates in production environments.

Navigate to mcp.conf, and configure the ssl_verify setting, using the following parameters:

Parameter value Description
true Enables SSL verification. Default, recommended for production.
false Disables SSL verification. Testing only.
certificate_path Uses a specific certificate file
The ssl_verify setting only applies to the MCP server connection. The rest of your Splunk deployment continues to respect default SSL verification settings.

See the following sample of a client configuration:
JSON 
{ 

 "mcpServers": { 
   "splunk-mcp-server": { 
     "args": [ 
       "-y", 
       "mcp-remote", 
       "https://<MCP_SERVER_ENDPOINT>", 
       "--header", 
       "Authorization: Bearer <YOUR_ENCRYPTED_TOKEN>" 
     ], 
     "command": "npx", 
     "env": { 
       "NODE_TLS_REJECT_UNAUTHORIZED": "0" 
     } 
   } 
 } 
}

Server limits and rate controls

Server limits and rate controls govern MCP tool execution. Administrators with the mcp_tool_admin capability can modify these settings.

In the Splunk MCP Server app, select Setting, and then Server to view the available settings.

The following table describes the server settings:

Server setting Description
Timeout Maximum seconds before a tool call times out.
Splunk AI Assistant timeout Maximum seconds before a Splunk AI Assistant tool call times out.
Default row limit Rows returned when the caller does not specify a limit.
Rate limit window Duration of the counting window; all global and per-tool limits are measured over this period.
Global rate limit Maximum number of tool calls permitted across all tools during the configured rate-limit window. The count resets at the window boundary.

Add SPL commands

Splunk MCP Server version 1.3 and higher allows administrators to add custom SPL commands to the allowed command list. These changes are made locally and do not modify the default list of built-in commands.

Note:

You must have the mcp_tool_admin capability to manage allowed SPL commands.

Complete the following steps:

  1. In the Splunk MCP Server app, select Setting, and then Commands.

  2. To add a command, select Add command.

  3. In the resulting window, enter the command name. Use letters and numbers. The name must start with a letter.

  4. Select Add to complete the operation.