Splunk MCP Server certificate error

[ericaooi]

Hi,

We have installed the Splunk MCP application from the Splunkbase link (https://splunkbase.splunk.com/app/7931) and configured the client side to use the provided MCP Configuration to establish a connection with the hosted Splunk MCP Server.

The Splunk MCP App indicates that the "Server is active," and we have successfully retrieved agents through the Splunk MCP Server and invoking the agent through github co-pilot in VS code. However, when attempting to utilize agents such as "#get_indexes," we encounter the following error:

Error Description: The issue appears to be related to SSL certificate hostname verification. The Splunk server is attempting to connect to localhost:8089, but the SSL certificate is issued for different hostnames including xxx.com and various domain servers. This is a typical problem that occurs when connecting to Splunk instances where the SSL certificates don't match the connection hostname.

Given that the MCP configuration provided by Splunk operates under stdio type which runs locally on the machine, we would appreciate your assistance with the following questions:

1. Where is the host located after the MCP Client and Server setup is completed?

2. How can I find the host?

3. What is the method to identify or locate the host?

3. How can we properly configure the host to resolve this error?

4. Are there specific configurations required to properly set up the MCP instance?

Thank you.

[livehybrid]

Hi @ericaooi 

you may need to configure mcp-remote to disable SSL verification as the error is suggests that SSL validation is causing the failure - Add the 'NODE_TLS_REJECT_UNAUTHORIZED' env variable = 0 like this:

"remote-example": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://remote.mcp.server/sse"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ericaooi]

Hi @livehybrid ,

I have already enabled that but the error still flagged. Following are my configurations:

The URL and args comes from Splunk MCP Server app.

{
"servers": {
"splunk_agent": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://<splunk_link>/services/mcp",
"--header",
"Authorization: Bearer <TOKEN>",
"--verbose"
],
"env": {
"http_proxy": "xxx",
"https_proxy": "xxx",
"HTTP_PROXY": "xxx",
"HTTPS_PROXY": "xxx",
"NO_PROXY": "xxx",
"no_proxy": "xxx",
"NODE_TLS_REJECT_UNAUTHORIZED": "0",
"NPM_CONFIG_CACHE": "/tmp/npm-cache",
"NPM_CONFIG_STRICT_SSL": "false",
},
"keep_alive": true
}
}
}

Is there any other configurations that I can add to make it work or not pointing to localhost?

Thank you.

[ed86]

@ericaooi 

in SPLUNK MCP APP configuration : $SPLUNK_HOME\etc\apps\Splunk_MCP_Server\default\mcp.conf 

You need to uncomment or add the "ssl_verify = false" variable. See below


# SSL verification behavior for requests to Splunk.
# Accepted values:
# true : Verify SSL certificates using system CAs (default)
# false : Disable verification (NOT recommended for production)
# <path> : Path to a custom CA bundle or self-signed certificate (PEM/CRT)
# none : Ignore this setting and fall back to PYTHONHTTPSVERIFY or default
# Examples:
# ssl_verify = true
ssl_verify = false
# ssl_verify = /opt/splunk/etc/auth/myCA.pem
# If not set or set to 'none', the application honors PYTHONHTTPSVERIFY env var, else defaults to true.
# ssl_verify = true