I have experienced the same thing. The results presented by Claude Desktop are mostly inaccurate; however, it sometimes combines some valid field values. For example, the splunk_get_info tool data is completely wrong, while the splunk_get_knowledge_objects for type=apps returns an inaccurate list of apps but specifies a valid splunk_server value. If I look in the Claude MCP logs, it does show a truncated entry with correct values. Claude Desktop just doesn't use that data in what it returns in the UI. I set up the MCP in Claude Code, and everything is returned correctly. I wondered if this was because it was using Opus as opposed to Sonnet in Claude Desktop. I tried using Opus in Claude Desktop but still got the same hallucinatory data returned. This makes it seem more like a Claude Desktop issue as opposed to an LLM issue, but I am not really sure. We are using Splunk Cloud. I don't know if this is a coincidence or just bad timing, but it seemed to work OK with the previous versions of Splunk MCP before version 1.x with the MCP hosted separate from our SHC with a URI if https://[stack].api.scs.splunk.com/[stack]/mcp/v1/. I may try using that old URI to see if it still works and has the same issues. If I have time I am going to try some other MCP Clients to see if they behave the same way. I will post any findings here.
... View more
