Is it possible to use the Splunk MCP Server APP on-premises?

[hk_baek]

Hello,
I have a question regarding the Splunk MCP Server APP provided by Splunkbase.

After configuring Splunk Enterprise On-Prem as below and proceeding with the setup, an error occurs.

Splunk Enterprise On-Prem
a. We have installed Splunk Enterprise 9.4.4 with the Splunk MCP Server APP.
b. Roles, users, and tokens have been created.
c. When configuring the MCP server in Claude and running it,
the following error occurs:

Is there any additional step I should take?

Thank you.          

[livehybrid]

Hi @hk_baek 

Are you using a trusted SSL certificate on your Splunk mgmt port? If not you may need to configure mcp-remote to disable SSL verification:

"remote-example": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://remote.mcp.server/sse"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }

Was the URL you are using provided by the MCP app in Splunk?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[hk_baek]

hi @livehybrid

1. The MCP server I used was downloaded from https://splunkbase.splunk.com/app/7931.

2. I configured it as shown below, but the same error still occurs..

{

  "mcpServers": {

    "splunk-mcp-server": {

      "command": "npx",

      "args": [

        "-y",

        "mcp-remote",

        "https://192.168.235.130:8089/services/mcp",

        "--header",

        "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2..."

      ],

      "env": {

        "NODE_TLS_REJECT_UNAUTHORIZED": "0"

      }

    }

  }

}

3. Splunk was installed in a VMware instance running on a desktop PC.

Thank you.

[xvalette]

Did you try to use a token with a "mcp" audience ?

[hk_baek]

Yes, I’m using MCP.
I tried following this YouTube video: MCP Server on Splunk Cloud Platform Demo

Does it work well on your side, xvalette?

[xvalette]

Yes it does @hk_baek (after some work) 🙂,

Let's first check connectivity between your MCP Client and your Splunk MCP Server,

If you perform such request, what do you get ?

xvalette@XVALETTE-M-06WY ~ % curl -k \
  -H "Authorization: Bearer <YOUR_TOKEN>" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"client":"curl","version":"0.1"}}' \
  https://<YOUR_IP_AND_PORT>/services/mcp

In my working environment, the response is :

{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"tools":{}},"serverInfo":{"name":"Splunk_MCP_Server","version":"0.2.2"}}}%      

 Happy to help!

[hk_baek]

@xvalette Thank you for your response.

As you can see from the image below, the result is the same as what you mentioned.

I configured Claude as shown below.
Is there anything I might have set up incorrectly?

{
  "mcpServers": {
    "splunk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<IP ADDR>:8089/services/mcp",
        "--header",
        "Authorization: Bearer <TOKEN>"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }
}

[xvalette]

Hey @hk_baek,

On your laptop where Claude Desktop is installed, can you perform :

tail -f ~/Library/Logs/Claude/mcp*.log

Then launch Claude Desktop, you should have some logs that can help, feel free to share it here !

[hk_baek]

The response was delayed.

It seems to be an issue with Claude.

It works properly with the same configuration in Cursor.

{
  "mcpServers": {
    "splunk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "[SPLUNK_SERVER IP:PORT/service/mcp]",
        "--header",
        "Authorization: Bearer eyJraWQiOiJzcGx..."
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }
}
Thanks

[hk_baek]

There are additional settings.

authorize.conf

[role_mcp_user]
mcp_tool_admin = enabled
mcp_tool_execute = enabled