MCP

Expose the read-only tools and investigate / triage / explain / generate to external agents (Claude Desktop, Cursor, your own): Streamable HTTP, tokens issued per role, the same gates and audit as the UI. Since 1.9.0.

The MCP server is a resident process that starts and stops with splunkd (bin/copilot_mcp_server.py, a scripted input with interval=-1). Off by default; the switch on Settings → MCP takes effect immediately.

MCP

Switch and address

Item	Default	Notes
Enabled	off	On starts the process, off stops it
Bind	`127.0.0.1`	Loopback / `0.0.0.0` / `::1` only. For other machines put a TLS reverse proxy in front and do access control there; the server itself has no TLS
Port	`18100`
Protocol	MCP Streamable HTTP	`http://<bind>:<port>/mcp`; `GET /health` is unauthenticated

Tokens and roles

Every request carries Authorization: Bearer rsk_…. Tokens are issued on this page, the plaintext is shown once, the KV store keeps a sha256 only; revocation is immediate. A token is bound to a role tier and an issuer cannot issue above their own:

Tier	Tools
viewer	`list_indexes` `list_sourcetypes` `get_fields` `run_spl` `search_kb` `lookup_asset` `threat_intel` `generate_spl` `explain_event`
analyst	Above + `investigate_alert` `triage_alerts`
admin	Above (reserved)

Missing / wrong / revoked token → 401; insufficient tier → the tool returns {"error":"forbidden"} (MCP has no per-tool 403). Rate limiting reuses [limits] rate_per_min / burst, per token.

Token issued

Tools

Tool	Notes
`list_indexes()`	Indexes with event counts, allow-listed only
`list_sourcetypes(index)`	Sourcetypes of an index
`get_fields(index, sourcetype)`	Real field names from the last 24h with masked samples
`run_spl(spl)`	Read-only SPL, up to 20 rows, masked; `delete / collect / outputlookup / sendemail / script / rest …` refused
`search_kb(query, k)`	Runbook / knowledge-base retrieval (including synced Splunk objects)
`lookup_asset(entity, kind)`	Asset / identity context
`threat_intel(indicator, kind)`	Threat intel (egresses only with `[threat_intel]` configured)
`generate_spl(question, index, sourcetype)`	Natural language → read-only SPL, same engine as the home page
`explain_event(event, sourcetype)`	Single-event explanation
`investigate_alert(alert, context, sourcetype)`	Alert investigation (timeline / MITRE / impact / FP verdict)
`triage_alerts(alerts[], max_clusters)`	Batch triage clustering and scoring

Resources: copilot://kb/{id}, copilot://reports/latest; prompt template: investigate.

Security boundary

Read-only: every Splunk-side call goes through the bin/tools.py gates: read-only command filter, [limits] agentic_index_whitelist, [masking] mode.
Licence and roles are the UI's: paid tools without a licence return license_required.
One audit event per call (via=mcp), filterable in Audit log.
The process searches as splunk-system-user (absent under a Splunk Free licence, so MCP gets no session there).

Connecting

Claude Desktop / Cursor (mcpServers):

{
  "mcpServers": {
    "splunk-ai-copilot": {
      "url": "http://127.0.0.1:18100/mcp",
      "headers": { "Authorization": "Bearer <TOKEN>" }
    }
  }
}

Claude Code:

claude mcp add --transport http splunk-ai-copilot http://127.0.0.1:18100/mcp \
  --header "Authorization: Bearer <TOKEN>"

Troubleshooting

Symptom	Where to look
Enabled but "not responding"	`index=_internal sourcetype=copilot:mcp` / `copilot_mcp_server` in `splunkd.log`; usually the port is taken or `splunk-system-user` does not exist
Everything 401	Token revoked / missing `Bearer` prefix
Tool returns `forbidden`	Tier too low; use an analyst token
`license_required`	Not activated or licence expired
`refused: index … not in the allowed set`	`[limits] agentic_index_whitelist` omits that index