[{"id":124968,"app":7931,"name":"2.1.0","product":{"name":"splunk","display_name":"Splunk"},"release_notes":"**Splunk MCP Server 2.1.0**\n\nSplunk MCP Server 2.1.0 adds tools for retrieving fired alert results, checking alert action status, and finding silent alerts. It also introduces self-service encrypted token management, updated management pages, stronger authentication, and improved telemetry.\n\n**What's New**\n\n**Alert Investigation**\n\nAdded three tools for investigating Splunk alerts:\n\n* splunk_get_fired_alert_results\n* splunk_get_alert_action_status\n* splunk_find_silent_alerts\n\nUse these tools to retrieve retained search results for a specific alert firing, check recorded alert action outcomes, and find enabled alerts with no recorded firings.\nFired alert results and silent alert discovery support pagination. Silent alert discovery also supports app filtering and a lookback window of up to 90 days.\n\n**Encrypted Token Management**\n\n* Added self-service token management for non-admin users with the mcp_edit_tokens_own capability. Creating, activating, deactivating, and deleting tokens also requires Splunk’s edit_tokens_own capability.\n* Users can create, list, activate, deactivate, and delete tokens they create for themselves, and view token status, expiration, and recorded last-use information.\n* Administrators can manage tokens across users, subject to native Splunk token permissions, and generate or delete the shared encryption key pair.\n* All encrypted MCP tokens use the public key from this administrator-managed key pair.\n* Added configurable key expiration, with a default validity of 180 days and a maximum of 365 days. Newly created tokens cannot outlive the key.\n\n **Management Interface Improvements**\n\n* Updated the Tools page with search, sorting, filters, and bulk activation and deactivation.\n* Updated the Usage dashboard and changed its default time range to 7 days.\n* Moved allowed SPL commands and server settings into separate Commands and Server pages.\n* Added support for Splunk light and dark themes.\n\n **Security and Telemetry Improvements**\n\n* Strengthened authentication for tool-management operations.\n* Added token audit events and more context to administrative logs.\n* Improved logging for SPL errors and failed tool calls.\n\n **Issues Fixed**\n\n* Fixed splunk_get_indexes to include search-peer indexes while preserving pagination.\n* Fixed Gemini compatibility with alert severity schemas.\n* Fixed request recovery after increasing the MCP request timeout.\n* Fixed an endpoint URL locale mismatch that affected OAuth connections.\n* Fixed cleanup after failed encrypted-token registration.\n\n **Upgrade Considerations**\n\n* Direct MCP bearer-token connections now require credentials encrypted with the current server key. Plaintext and previous-key support are removed, along with the require_encrypted_token and legacy_token_grace_days settings.\n* Existing keys without expiration receive 180-day validity when initialized after upgrade. Existing expiration dates are preserved.\n* Deactivate all non-expired registered tokens before deleting the shared encryption key pair. After generating a replacement pair, issue new tokens and update clients.\n* Non-admin users need mcp_edit_tokens_own to access self-service token management and edit_tokens_own to create, activate, deactivate, or delete their own tokens.\n* Existing tokens are not automatically added to the new registry. The self-service token list shows tokens created by the current user.\n* Token API integrations must use /services/mcp_token/tokens and /services/mcp_token/key-pair instead of the previous creation and rotation operations at /services/mcp_token.\n* splunk_find_silent_alerts requires access to \\_audit. splunk_get_alert_action_status requires access to the relevant \\_internal action logs.\n* splunk_get_fired_alert_results requires retained search-job results. Expired results are reported as unavailable.","CIM_versions":[],"product_versions":["10.7","10.6","10.5","10.4","10.3","10.2","10.1","10.0","9.4","9.3"],"created_datetime":"2026-10-24T04:30:51.241075Z","published_datetime":"2026-10-24T04:30:51.240552Z","size":3541705,"filename":"splunk-mcp-server_210.tgz","platform":"independent","install_method_single":"simple","install_method_distributed":"appmgmt_phase","fedramp_validation":"no","fips_compatibility":false,"cloud_compatible":true},{"id":123926,"app":7931,"name":"2.0.0","product":{"name":"splunk","display_name":"Splunk"},"release_notes":"**Splunk MCP Server 2.0.0**\n\nSplunk MCP Server 2.0.0 adds tools for investigating alerts and discovering sourcetypes. It also introduces paginated results, improved MCP and OAuth compatibility, stronger security for custom tools, and enhanced telemetry.\n\n**What's New**\n\n**Alert Investigation**\n\nAdded six tools for investigating Splunk alerts:\n\n* splunk\\_list\\_alerts\n* splunk\\_get\\_alert\\_details\n* splunk\\_list\\_fired\\_alerts\n* splunk\\_get\\_fired\\_alert\\_details\n* splunk\\_get\\_alert\\_throttle\n* splunk\\_list\\_active\\_throttles\n\nUse these tools to find alerts, investigate fired alerts, and view configured or active alert throttles.\n\n**Sourcetype Discovery**\n\n* Added the splunk\\_get\\_sourcetypes tool for discovering sourcetypes that contain indexed data.\n* Results include event counts, time coverage, indexes, and configuration details. You can filter results by index and time range.\n\n**Paginated Results**\n\nAdded pagination to the following tools:\n\n* splunk\\_get\\_indexes\n* splunk\\_get\\_sourcetypes\n* splunk\\_list\\_alerts\n* splunk\\_list\\_fired\\_alerts\n* splunk\\_get\\_fired\\_alert\\_details\n* splunk\\_list\\_active\\_throttles\n\nPaginated responses include the total number of results, offset, and page size. They also follow the configured default and maximum row limits.\n\n**MCP and OAuth Improvements**\n\n* Improved MCP-compatible tool error responses.\n* Added the openid scope to OAuth discovery.\n* Added the openWorldHint annotation to all built-in tools.\n\n**Search and Splunk AI Assistant Improvements**\n\n* Increased the maximum prompt and query length to 10,000 characters for splunk\\_run\\_query and Splunk AI Assistant tools.\n* Changed the default splunk\\_run\\_query time range from 24 hours to 6 hours.\n\n**Issues Fixed**\n\n* Fixed saved search arguments that contain escaped nested quotes.\n* Fixed an incompatible authentication scheme used by detached searches.\n* Improved error messages for missing MCP capabilities, search timeouts, and Splunk AI Assistant data discovery tool.\n\n**Upgrade Considerations**\n\n* splunk\\_get\\_metadata no longer supports sourcetype discovery. Use splunk\\_get\\_sourcetypes instead.\n* Calls to splunk\\_run\\_query without a time range now search the last 6 hours instead of the last 24 hours.\n* splunk\\_get\\_indexes now returns paginated results and uses name instead of title for the index identifier.\n* The Splunk AI Assistant data discovery tool requires Splunk AI Assistant 2.2.0 or later with Agent Mode enabled.","CIM_versions":[],"product_versions":["10.7","10.6","10.5","10.4","10.3","10.2","10.1","10.0","9.4","9.3"],"created_datetime":"2026-09-03T05:01:28.154080Z","published_datetime":"2026-09-03T05:01:28.153683Z","size":4195181,"filename":"splunk-mcp-server_200.tgz","platform":"independent","install_method_single":"simple","install_method_distributed":"appmgmt_phase","fedramp_validation":"no","fips_compatibility":false,"cloud_compatible":true},{"id":123191,"app":7931,"name":"1.3.1","product":{"name":"splunk","display_name":"Splunk"},"release_notes":"

App improvements and bug fixes.

Updated MCP protocol version to 2025-11-25","CIM_versions":[],"product_versions":["10.7","10.6","10.5","10.4","10.3","10.2","10.1","10.0","9.4","9.3"],"created_datetime":"2026-08-03T07:12:48.147044Z","published_datetime":"2026-08-03T07:12:48.146703Z","size":4167485,"filename":"splunk-mcp-server_131.tgz","platform":"independent","install_method_single":"simple","install_method_distributed":"appmgmt_phase","fedramp_validation":"no","fips_compatibility":false,"cloud_compatible":true},{"id":122879,"app":7931,"name":"1.3.0","product":{"name":"splunk","display_name":"Splunk"},"release_notes":"Splunk MCP Server App 1.3 introduces Allowed SPL Commands management, a Custom Tools UI for creating and managing user-defined tools, Role-Based Access Control for MCP tools, and multiple UI and dashboard improvements.\n\n**What's New**\n\nAllowed SPL Commands Management\n\nAdded a new Allowed SPL Commands section within the Guardrails tab. Administrators can add or remove SPL commands that are permitted for MCP tool execution. Non-admin users see a read-only view of Splunk Native, Custom, and Builtin commands.\n\n\n\n**Custom Tools UI**\n\nAdministrators can now create, update, enable, disable, and delete custom MCP tools directly from the UI. Supports both SPL-type and API-type custom tools. Custom tools are grouped by app for easier navigation. Users without the mcp\\_tool\\_admin capability see the Create tool button disabled.\n\n\n\n**Role-Based Access Control for MCP Tools**\n\nMCP tools now support role-based access control, ensuring tools are only accessible to users with the appropriate roles and permissions.\n\n\n\n**App Parameter in run\\_splunk\\_query**\n\nAdded an app parameter to run\\_splunk\\_query tool arguments, allowing users to specify the app context for query execution.\n\n\n\n**Saved Search Descriptions in Knowledge Objects**\n\nThe get\\_knowledge\\_objects tool now returns saved search descriptions when querying saved searches.\n\n\n\n**Workload Management Support for run\\_splunk\\_query**\n\nMCP tool run\\_splunk\\_query now supports Splunk workload pool assignment for better resource management.\n\n\n\n**SAIA Data Discovery Tool**\n\nAdded a new SAIA data discovery tool. This tool requires Splunk AI Assistant version 2.2.0 or later.\n\n\n\n**MCP Dashboard Updates**\n\nAdded a new tools and roles panel in the Governance tab to show tool access by role. \n\n\n\n**UI Updates**\n\nMCP version is now displayed on the Configuration page.\n\nAdded MCP Tool Annotations to identify read-only and write-capable tools.\n\nRow limit and Time range rows are no longer shown per tool.\n\nUsers cannot set a per-tool rate limit beyond the global rate limit.\n\nUsers cannot set the global rate limit below an existing per-tool rate limit.\n\nAdded an MCP Server heartbeat modular input to prevent Splunk from recycling the MCP handler process.\n\n\n\n**Issues Fixed**\n\nFixed an issue where custom \\`mcp.conf\\` settings were not replicated correctly across search head cluster members.\n\n\n\n**Notes and Considerations**\n\nAdministrators who previously managed SPL command restrictions through manual configuration should review the new Allowed SPL Commands section in the Guardrails tab.","CIM_versions":[],"product_versions":["10.7","10.6","10.5","10.4","10.3","10.2","10.1","10.0","9.4","9.3"],"created_datetime":"2026-07-23T05:37:32.708692Z","published_datetime":"2026-07-23T05:37:32.708350Z","size":4170933,"filename":"splunk-mcp-server_130.tgz","platform":"independent","install_method_single":"simple","install_method_distributed":"appmgmt_phase","fedramp_validation":"no","fips_compatibility":false,"cloud_compatible":true},{"id":122097,"app":7931,"name":"1.2.1","product":{"name":"splunk","display_name":"Splunk"},"release_notes":"

Splunk MCP Server App 1.2.1 introduces a new MCP Telemetry Dashboard for monitoring MCP usage, authentication, consumption, and errors. This release also moves MCP tool execution limits and rate controls into a new Guardrails section in the UI, adds a new Splunk AI Assistant timeout setting, improves configuration validation, and includes telemetry and permissions-related fixes.

\n

**What's New**

\n

MCP Telemetry Dashboard

\n

Added a new MCP Telemetry Dashboard in the Splunk MCP Server app to help administrators quickly understand MCP activity across their environment. The dashboard helps answer questions such as:

\n

- Who is using MCP and how are they authenticating?

\n

- What are users and agents doing, and how much are they consuming?

\n

- Is anything broken?

\n

New Guardrails section for MCP controls

\n

Moved MCP server limits and rate controls for MCP tool execution to a new Guardrails section on the MCP landing page.

\n

UI-based Guardrails management

\n

Administrators can now update MCP app Guardrails settings directly from the UI. These changes do not require a splunkd restart.

\n

Splunk AI Assistant timeout setting

\n

Added a new Guardrails setting, Splunk AI Assistant timeout, which controls the maximum number of seconds before a Splunk AI Assistant tool call times out.

\n

Improved configuration specification coverage

\n

Added entries to mcp.conf.spec for eight previously undocumented \\[server] configuration keys that were causing btool validation errors.

\n

**Fixed Issues**

\n

Improved tool management permission errors

\n

When a user does not have the mcp\\_tool\\_admin capability, the app now displays a specific error message instead of a generic fallback error: \"You do not have the mcp\\_tool\\_admin capability required to manage tools.\"

\n

Saved search telemetry reliability

\n

Fixed an issue in saved search telemetry that caused some events to be dropped.

Fixed MCP encrypted token compatibility when reading stored credentials.

\n

**Notes / Considerations**

\n

- Guardrails settings can now be updated from the MCP app UI without restarting splunkd.

\n

- The Splunk AI Assistant timeout setting applies to Splunk AI Assistant tool calls and controls the maximum time allowed before a call times out.

\n

- Administrators who previously managed MCP server limits and rate controls through configuration should review the new Guardrails section on the MCP landing page.

\n

","CIM_versions":[],"product_versions":["10.6","10.5","10.4","10.3","10.2","10.1","10.0","9.4","9.3"],"created_datetime":"2026-06-25T05:03:41.447403Z","published_datetime":"2026-06-25T05:03:41.447062Z","size":3971169,"filename":"splunk-mcp-server_121.tgz","platform":"independent","install_method_single":"rejected","install_method_distributed":"rejected","fedramp_validation":"no","fips_compatibility":false,"cloud_compatible":false}]