Skills/PyPI/mcp-server-for-splunk

mcp-server-for-splunk@0.7.0

CAUTION· not started

Publisher claims: "Open-source Splunk MCP server (Model Context Protocol) for Splunk Enterprise and Splunk Cloud" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher deslicer · publishing for 376 daysInstalls 351Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCP_AUTH_DISABLEDMCP_AUTH_PROVIDERMCP_AUTH_PROVIDER_KWARGSSENTRY_DSNSPLUNK_DEFAULT_PASSWORDSPLUNK_PASSWORDSPLUNK_SESSION_TOKENSPLUNK_TOKENConfiguration, not credentials: DEPLOYMENT_ENV, DEPLOYMENT_ENVIRONMENT, FASTMCP_HTTP_HOST_ORIGIN_PROTECTION, MCP_DISABLE_PLUGINS, MCP_HOT_RELOAD, MCP_JSON_RESPONSE, MCP_LOG_LEVEL, MCP_PLUGIN_GROUP, MCP_RELOAD_MODULES, MCP_SEARCH_WAIT_SECONDS, MCP_SERVER_HOST, MCP_SERVER_PORT, MCP_SPLUNK_HOST, MCP_STATELESS_HTTP, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_SERVICE_NAME, OTEL_SERVICE_VERSION, OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG, SENTRY_DEBUG, SENTRY_ENABLE_LOGS, SENTRY_ENVIRONMENT, SENTRY_PROFILES_SAMPLE_RATE, SENTRY_RELEASE, SENTRY_SEND_PII, SENTRY_TRACES_SAMPLE_RATE, SPLUNK_CONNECT_RETRY_BASE_DELAY, SPLUNK_CONNECT_RETRY_COUNT, SPLUNK_HOST, SPLUNK_PORT, SPLUNK_SCHEME
Where it talks to
no vendor host named in the codeAlso splunk.com, astral.sh, docker.com, gofastmcp.com, sentry.io — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names splunk.com, astral.sh, docker.com, gofastmcp.com, sentry.io as well as its own vendor. The guard injects MCP_AUTH_DISABLED, MCP_AUTH_PROVIDER, MCP_AUTH_PROVIDER_KWARGS, SENTRY_DSN, SPLUNK_DEFAULT_PASSWORD, SPLUNK_PASSWORD, SPLUNK_SESSION_TOKEN, SPLUNK_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-server-for-splunk

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Auto-update or dynamic fetch configuration; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

CRITICAL
Pipe-to-shell patternsrc/mcp_server_for_splunk/cli/build_and_run.py:1497 · Pipe-to-shell pattern — downloads and immediately executes remote codeprint_error("2. uv: curl -LsSf https://astral.sh/uv/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcp_server_for_splunk/cli/build_and_run.py:676 · npx invocation of non-well-known package — may execute untrusted codeprint_warning("Failed to start MCP Inspector (npx not available).")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_splunk/cli/build_and_run.py:638 · Python subprocess execution detectedout = subprocess.run( # nosec B603 B607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/core/base.py:16 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.shared_context import http_headers_contextFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_splunk/cli/build_and_run.py:218 · Python subprocess execution detectedresult = subprocess.run(cmd, cwd=cwd, check=False) # nosec B603 B607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/mcp_server_for_splunk/prompts/mcp_usage.py:57 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"<instructions>- Include validation, error handling, and hot-reload capabilities.</instructions>\n"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternsrc/mcp_server_for_splunk/cli/build_and_run.py:1437 · Pipe-to-shell pattern — downloads and immediately executes remote codeprint_error("Please install uv first: curl -LsSf https://astral.sh/uv/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/server.py:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env before reading MCP_SPLUNK_* or MCP_LOG_LEVEL from the environment.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/server.py:36 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.http_session_mode import HttpSessionModeAdvertiserFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/resources/splunk_cim.py:15 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.resources.docs_http import (Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
CRITICAL
Pipe-to-shell patternsrc/mcp_server_for_splunk/cli/build_and_run.py:239 · Pipe-to-shell pattern — downloads and immediately executes remote codeinstaller = ["bash", "-lc", "curl -LsSf https://astral.sh/uv/install.sh | sh"]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcp_server_for_splunk/cli/build_and_run.py:634 · npx invocation of non-well-known package — may execute untrusted codeprint_warning("Node.js/npx not found. MCP Inspector will not be available.")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/build_and_run.py:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshelp="Force Splunk credential setup prompt (even if .env is configured)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/test_mcp_server.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load environment variables from a .env file if presentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/build_and_run.py:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_warning("No .env file found. Using system environment variables only.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/server.py:37 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.http_session_mode_middleware import HttpSessionModeHeaderMiddlewareFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/server.py:55 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.sentry import SentryHTTPMiddleware, SentryMCPMiddlewareFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/build_and_run.py:279 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_success("Environment variables loaded from .env file!")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/test_mcp_server.py:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("1) Verify Splunk settings in .env:")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/mcp_server_for_splunk/server.py:964 · Auto-update or dynamic fetch configuration — agent may load new code at runtime{"status": "error", "message": "Hot reload is disabled (MCP_HOT_RELOAD != true)"}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_splunk/cli/build_and_run.py:674 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdout=lf, stderr=lf, env=env) # nosec B603 B607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_server_for_splunk/cli/build_and_run.py:1116 · Process kill command — agent can terminate processesprint_status("Using fuser to kill processes on port 6274...")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/mcp_server_for_splunk/server.py:961 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"""Hot reload components for development (only works when MCP_HOT_RELOAD=true)"""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shellsrc/mcp_server_for_splunk/cli/build_and_run.py:1497 · Remote installer piped to shellprint_error("2. uv: curl -LsSf https://astral.sh/uv/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellsrc/mcp_server_for_splunk/cli/build_and_run.py:1437 · Remote installer piped to shellprint_error("Please install uv first: curl -LsSf https://astral.sh/uv/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_splunk/resources/splunk_docs.py:213 · File type combined with upload action — agent may exfiltrate local data files"description": "Using metrics.log to diagnose input-related issues",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_splunk/cli/build_and_run.py:175 · Python subprocess execution detectedcode = subprocess.run( # nosec B603 B607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/server.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# stdio launches often rely on a cwd .env file rather than client-supplied env vars.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/routes/health.py:15 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.http_session_mode import (Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/build_and_run.py:266 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_local("Loading environment variables from .env file...")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/resources/splunk_docs.py:20 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.resources.docs_http import (Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
CRITICAL
Pipe-to-shell patternsrc/mcp_server_for_splunk/cli/build_and_run.py:241 · Pipe-to-shell pattern — downloads and immediately executes remote codeinstaller = ["bash", "-lc", "wget -qO- https://astral.sh/uv/install.sh | sh"]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/cli/build_and_run.py:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Stop any running MCP processes/services, then start local server detached using current .env (no prompts)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_splunk/cli/build_and_run.py:246 · Python subprocess execution detectedcode = subprocess.run(installer, check=False).returncode # nosec B603 B607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellsrc/mcp_server_for_splunk/cli/build_and_run.py:239 · Remote installer piped to shellinstaller = ["bash", "-lc", "curl -LsSf https://astral.sh/uv/install.sh | sh"]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Auto-update or dynamic fetch configurationsrc/mcp_server_for_splunk/server.py:962 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif os.environ.get("MCP_HOT_RELOAD", "false").lower() != "true":Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/server.py:1015 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"hint": "Add SENTRY_DSN=https://[email protected]/project-id to your .env file",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_for_splunk/server.py:872 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"hint": "Add SENTRY_DSN to your .env file",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_for_splunk/server.py:49 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_for_splunk.core.shared_context import http_headers_contextFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈64 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-for-splunk@0.7.0 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim deslicer: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim deslicerPropose a patch to the maintainer