Beta preview: OAuth for MCP Server

Sign in to Splunk Web as an administrator.

Go to Settings and then choose Authentication methods.

Open Splunk OAuth Clients (preview).

Select New OAuth Client and provide the following:

1. Client Name. A descriptive label, for example claude-code, cursor, or mcp-inspector.

2. Redirect URIs. The callback URL the MCP client will listen on after the user signs in. Choose the pattern that matches your MCP client type:

   1. For local MCP clients (running on the user's workstation, for example Claude Code, Cursor, MCP Inspector):

      1. http://localhost:<callback-port>/callback

      2. Replace <callback-port> with the port the MCP client will listen on (for example, 8787). The port value must match exactly between the Splunk Redirect URI and the MCP client configuration.

   2. For Web based / Hosted MCP clients (running as a hosted service, not on the user's workstation):

      1. https://<domain>/oauth/callback

      2. https://<domain>/api/mcp/auth_callback

      3. Use the exact callback URI documented by your MCP client. The path varies by product. Confirm with the client's documentation before saving.

Select Save.

Register the Splunk MCP Server in your client, using HTTP transport and the MCP endpoint URL.

Configure the OAuth section with your Client ID, callback port, and scopes (openid offline_access). Enter the client secret when prompted.

Trigger the authentication flow from the client. Your browser opens the Splunk sign-in page.

Sign in and approve access for the application.

The browser redirects to http://localhost:<callback-port>/callback and the client completes authentication.

List available tools in the client to confirm the connection.

Register the Splunk MCP Server.

1. Run the following command on your workstation. Replace the placeholders with the values from your administrator:

   CODECopy

   claude mcp add --transport http \ --callback-port <callback-port> \ --client-id <client-id> \ --client-secret \ splunk-mcp <mcp-endpoint>

   claude mcp add --transport http \ 
      --callback-port <callback-port> \ 
      --client-id <client-id> \ 
      --client-secret \ 
      splunk-mcp <mcp-endpoint>

2. When prompted, paste the Client secret:

   1. The <callback-port> must exactly match the port in the Redirect URI your administrator configured in Splunk.

   2. The <client-id> is the Client ID from the Splunk OAuth client.

   3. The <mcp-endpoint> is the HTTP endpoint of the Splunk MCP Server.

Restrict OAuth scopes. Open Claude Code's configuration file (~/.claude.json) and locate the splunk-mcp entry. Add a scopes field inside the oauth block, set to openid offline_access:

"splunk-mcp": { 
   "type": "http", 
   "url": "<mcp-endpoint>", 
   "oauth": { 
     "clientId": "<client-id>", 
     "callbackPort": <callback-port>, 
     "scopes": "openid offline_access" 
   } 
}

Authenticate:

1. Start Claude Code: claude

2. From inside Claude Code, run: /mcp

3. Your browser opens to the Splunk sign-in page.

4. Sign in with your Splunk credentials and approve access for the Claude Code application.

5. The browser redirects to http://localhost:<callback-port>/callback and Claude Code completes authentication.

Verify tools:

1. Run /mcp again to confirm splunk-mcp is connected.

2. Review the list of tools exposed by the Splunk MCP Server.

3. Invoke any tool to validate end-to-end connectivity. For example, a read-only search tool.