rsfl/splunk-mcp-llm-siemulator
A Docker lab integrating Splunk SIEM with Ollama LLM via MCP for AI security operations. Features Promptfoo OWASP evaluation, TA-ollama and TA-mcp-jsonrpc add-ons, dual bind-mount log ingestion, and real-time HEC streaming across six indexes for MITRE ATLAS TTP detection.
Platform-specific configuration:
{
"mcpServers": {
"splunk-mcp-llm-siemulator": {
"command": "npx",
"args": [
"-y",
"splunk-mcp-llm-siemulator"
]
}
}
}Add the config above to .claude/settings.json under the mcpServers key.
Loading reviews...