mcp-server-splunk

The server uses environment variables for Splunk authentication (token or username/password), which is a good practice. It does not contain hardcoded secrets or direct use of Python's `eval`. However, several tools (e.g., `search_splunk`, `create_dashboard`, `update_server_settings`, and others that accept SPL queries or raw configuration content) directly incorporate string arguments into Splunk SPL queries, XML configurations, or API calls. If these inputs are sourced from untrusted user input without proper sanitization by the AI client, they could lead to injection vulnerabilities (e.g., arbitrary SPL execution, XML injection, configuration manipulation). The server relies on the calling AI client to ensure input validity and safety, which is a critical consideration for deployment.