Configure and validate ITSI MCP tools

Use the following steps to prepare the environment, register the predefined tools, configure access, and validate direct MCP workflows.

1. Prepare the Splunk and ITSI environment.
   1. Verify that ITSI 5.0.1 or later is installed and episode data is available for validation.
   2. Verify that Splunk MCP Server 1.3.0 or later is installed and available.
   3. Confirm that users or service identities used for tool calls can access the relevant ITSI episode data.
   4. Confirm that the MCP-compatible client can reach the Splunk MCP Server endpoint.
2. Review predefined ITSI tools for MCP Server.

   ITSI 5.0.1 ships with predefined MCP tool definitions in tools.conf. You do not need to define or create ITSI MCP tools manually.

   If you need to define custom tools for other use cases, see the Splunk MCP Server documentation. For the ITSI workflow, use the predefined SA-ITOA_* tools.

3. Register ITSI tools with Splunk MCP Server.

   ITSI 5.0.1 includes a modular input that handles MCP tool registration. Use one of the following methods to trigger registration.

   1. In Splunk, navigate to the Manage Apps page.
   2. Find the SA-ITOA app.
   3. Click Register MCP Tools near the app actions, such as the Uninstall button.
   4. Confirm that the SA-ITOA_* tools appear in Splunk MCP Server.
   5. Open the Splunk MCP Server app, go to the SA-ITOA tools, and click Enable all tools for the intended server and user context.

   If you need to validate registration through REST, use SA-ITOA as the app name and external app identifier.

   SHELLCopy

   curl -k -u admin \ -X POST "https://localhost:8089/services/mcp/tool_registration" \ -H "content-type: application/json" \ --data '{"app_name":"SA-ITOA"}'

   curl -k -u admin \
     -X POST "https://localhost:8089/services/mcp/tool_registration" \
     -H "content-type: application/json" \
     --data '{"app_name":"SA-ITOA"}'

   SHELLCopy

   curl -k -u admin \ "https://localhost:8089/services/mcp_tools?external_app_id=SA-ITOA&output_mode=json"

   curl -k -u admin \
     "https://localhost:8089/services/mcp_tools?external_app_id=SA-ITOA&output_mode=json"

   SHELLCopy

   curl --request POST \ --url https://<splunk_url>:8089/services/mcp \ --header 'authorization: Bearer <encrypted_token>' \ --header 'content-type: application/json' \ --data '{ "jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": { "name": "SA-ITOA_get_episodes", "arguments": { "lookback": "24h", "count": 10, "sort_by": "severity" } } }'

   curl --request POST \
     --url https://<splunk_url>:8089/services/mcp \
     --header 'authorization: Bearer <encrypted_token>' \
     --header 'content-type: application/json' \
     --data '{
       "jsonrpc": "2.0",
       "id": 3,
       "method": "tools/call",
       "params": {
         "name": "SA-ITOA_get_episodes",
         "arguments": {
           "lookback": "24h",
           "count": 10,
           "sort_by": "severity"
         }
       }
     }'

4. Configure authentication and authorization for direct MCP access. For encrypted token setup and MCP client authentication configuration, see Connecting to the MCP Server and settings. For OAuth 2.1 browser-based authentication (MCP Server 1.2+), see OAuth for MCP Server. The itoa_admin role includes the mcp_tool_execute capability by default. Non-admin users require explicit assignment. Confirm that tool calls only return ITSI data that the requesting identity is authorized to access. Object-level access in ITSI still applies through MCP.
5. Validate MCP workflows.
   1. Call tools/list and confirm that the SA-ITOA_* tools are visible.
   2. Call SA-ITOA_get_episodes to retrieve active or recent episodes.
   3. Select an episode ID and retrieve episode details, impacted objects, external links, similar episodes, and summarization as applicable.
   4. Verify that the tool responses match the source ITSI episode.
   5. Confirm that unavailable optional data, such as external links or stored summarization, is handled gracefully.
6. Use the following suggested validation prompts and tool calls to confirm end-to-end functionality.
   • Show active critical ITSI episodes from the last 24 hours.
   • Get details for episode <episode_id>.
   • What services, KPIs, and entities are impacted by episode <episode_id>?
   • Are there external tickets or runbooks linked to episode <episode_id>?
   • Has this episode happened before?
   • Summarize episode <episode_id> and list suspected root causes.

   For MCP tool examples, see ITSI MCP tools usage examples.