Is this an official Splunk MCP server?

No. It is Memtro's MCP server with Memtro's Splunk connector behind it: the connector reads Splunk through its API with the credentials you connect on Dashboard → Connections, and Splunk publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Splunk?

Only when you ask, and only what it has been granted: create a saved search, report or scheduled alert (email alerts only to named addresses); edit a saved search: its SPL, schedule, time range, alert condition or email recipients, or disable it; delete a saved search permanently; set when a scheduled saved search next runs; run a saved search now, optionally firing its alert actions; cancel, finalize, pause or resume a running search job. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

MCP server · Engineering and operations

Splunk MCP server

Splunk in any MCP client, through Memtro: Splunk does not publish this server. Memtro's Splunk connector reads Splunk through its API with the credentials you connect, and one endpoint hands those tools, every other system you connect and Memtro's memory tools to Claude Code, Cursor, Claude Desktop or anything else that speaks Streamable HTTP, as you.

What the model can do

Splunk Cloud Platform or Splunk Enterprise over the REST API: run a time-bounded search (SPL) and read the rows, list saved searches and alerts, alerts that have fired, and indexes with their event counts. Can create, edit, delete, reschedule and run a saved search or alert, and cancel, finalize, pause or resume a search job.

Reads

splunk_searchRun a Splunk search (SPL) over a time window and return its rows.
splunk_saved_searchesSaved searches and alerts defined in Splunk: name, app, the SPL (cut short), whether scheduled and on what cron…
splunk_fired_alertsAlerts that have fired in Splunk, grouped by the saved search that raised them, with how many times each has triggered…
splunk_indexesSplunk indexes the token's user can see: name, event count, size in MB, the earliest and latest event time, and whether disabled.

Acts, when you ask

These change something in Splunk. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

splunk_create_saved_searchCreates a saved search (a report, or a scheduled alert when cron_schedule and alert are given) in a Splunk app, owned by the named owner.
splunk_update_saved_searchChanges an existing Splunk saved search, report or alert in place: its SPL, description, time range, cron schedule, alert condition…
splunk_delete_saved_searchPermanently deletes a Splunk saved search, report or alert definition.
splunk_reschedule_saved_searchSets when a scheduled Splunk saved search next runs; it then continues on its cron schedule.
splunk_dispatch_saved_searchRuns a Splunk saved search or report now and returns the search job id (sid).
splunk_cancel_search_jobControls a running Splunk search job by its sid.

Connect it

First connect Splunk on Dashboard → Connections, then add Memtro to your client once. The Splunk tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

Claude Code

The Memtro plugin registers the server and a skill for when to use it; the tools are then available in every session.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

Cursor

Add the server to .cursor/mcp.json in the project, or to the global file under ~/.cursor/.

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Claude Desktop

Create a personal API key on Dashboard → Profile → API keys. In Claude Desktop add an MCP server of type HTTP with URL https://platform.memtro.com/api/mcp and the header Authorization: Bearer sk-memtro-…

OpenCode

A remote server in opencode.json.

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Pi

One command: pi mcp add memtro --url https://platform.memtro.com/api/mcp --bearer-token-env-var MEMTRO_API_KEY. Tools arrive as mcp__memtro__*. The pi-memtro extension registers it for you, alongside Memtro as the model.

Any other client

Add an MCP server of type HTTP (Streamable HTTP, stateless) at https://platform.memtro.com/api/mcp with the header Authorization: Bearer sk-memtro-.... Codex, Zed, Windsurf, Cline and the SDKs all take a remote server this way.

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Splunk connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

› How many 500s did the checkout service log yesterday?
› Which hosts logged errors in the last hour?
› Which Splunk alerts went off this week?
› What is the saved search behind the failed logins alert?
› Disable the noisy disk space alert until Monday

Questions

Is this an official Splunk MCP server?: No. It is Memtro's MCP server with Memtro's Splunk connector behind it: the connector reads Splunk through its API with the credentials you connect on Dashboard → Connections, and Splunk publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.
What does it cost?: Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.
Can it change anything in Splunk?: Only when you ask, and only what it has been granted: create a saved search, report or scheduled alert (email alerts only to named addresses); edit a saved search: its SPL, schedule, time range, alert condition or email recipients, or disable it; delete a saved search permanently; set when a scheduled saved search next runs; run a saved search now, optionally firing its alert actions; cancel, finalize, pause or resume a running search job. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.
Which clients work?: Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.