---
title: "Splunk SOAR MCP server for AI agents - actionlake"
description: "Give Claude 217 Splunk SOAR actions through one MCP server: containers, widgets, indicators. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/splunk-soar
updated: 2026-10-23
---

Connectors · Identity & security

# Splunk SOAR MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Splunk SOAR and the rest of your systems. It gives your agent 217 Splunk SOAR actions (142 reads, 58 writes and 17 that wait for a confirmation) and holds the Splunk SOAR credential itself, so the agent never does. It paces Splunk SOAR's limits and records every call.

[Connect Splunk SOAR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "splunk_soar.users.list",
  intent: "check which Splunk SOAR account is connected"
}
# List users · read · 1 upstream call
```

- 217 actions in one signed file
- 142 read look, never change
- 58 write create and update
- 17 wait for a yes destructive, confirmed first

Set up

## Connect Splunk SOAR in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Splunk SOAR.
   Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `username` SOAR username for a user login
   - `password` The user's password, or an automation user's ph-auth-token (Administration > User Management > Users > the…
   - `host` Where your Splunk SOAR lives: your host
   ```
   account { op: "connections.requirements", service: "splunk_soar" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "splunk_soar.users.list" }
   # list users · read · 1 upstream call
   check { action: "splunk_soar.users.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Splunk SOAR at a glance

**Sign-in**

Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`username` `password`

**Setup fields**

`host`

**Limits we pace to**

10 calls a second, per connection

**API covered**

Splunk SOAR REST API (SOAR Cloud and On-premises 6.x/7.x), at your Splunk SOAR instance's API base URL, which you enter when connecting

**Built from**

Splunk SOAR's documentation, read 23 October 2026[help.splunk.com](https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference) [help.splunk.com](https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/query-for-data)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

141 of 142 reads, for up to 1 minute; a write clears what it affects

**Shared entities**

7, so ask can line Splunk SOAR up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Splunk SOAR.

217 actions in 50 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **142** read look, never change
- **58** write create and update
- **17** destructive wait for a confirmation

1. ### Containers
   20
   15 read · 4 write · 1 destructive
   List containers · Get a container's audit trail · Create a container · Get a container
2. ### Widgets
   18
   18 read · 0 write · 0 destructive
   List dashboard widgets · Get dashboard data: artifact statistics · Get dashboard data: container statistics · Get dashboard data: containers by status
3. ### Indicators
   10
   10 read · 0 write · 0 destructive
   List indicators · List artifacts sharing an indicator · List containers sharing indicators · Get an indicator
4. ### Users
   8
   5 read · 2 write · 1 destructive
   List users · Create a user · Get a user · Update a user
5. ### Playbook runs
   7
   5 read · 1 write · 1 destructive
   List playbook runs · Get a playbook run · Get a playbook run's log · Run a playbook
6. ### Roles
   7
   4 read · 2 write · 1 destructive
   List roles · Create a role · Get a role · Update a role
7. ### Action runs
   6
   4 read · 1 write · 1 destructive
   Run an action · List action runs · List an action run's app runs · List an action run's approvals
8. ### Artifacts
   6
   2 read · 3 write · 1 destructive
   Create artifacts in bulk · Create an artifact · List artifacts · Get an artifact

**42 more areas · 135 actions**

- Custom lists **6**
- Notes **6**
- Playbooks **6**
- System settings **6**
- Assets **5**
- Automation brokers **5**
- Cef **5**
- Container statuses **5**
- Custom functions **5**
- Workbook templates **5**
- Aggregation rules **4**
- Apps **4**
- Container attachments **4**
- Feature flags **4**
- Severities **4**
- Workbook phase templates **4**
- Workbook task templates **4**
- App runs **3**
- Approvals **3**
- Command runs **3**
- Container comments **3**
- Container pins **3**
- Evidence **3**
- Indicator cef filters **3**
- Records **3**
- Source control **3**
- Workbook tasks **3**
- Cluster nodes **2**
- External prompts **2**
- License **2**
- Notifications **2**
- Tenants **2**
- User settings **2**
- Vault documents **2**
- Workbook phases **2**
- App status **1**
- Audit **1**
- Container pin settings **1**
- Health **1**
- Search **1**
- System info **1**
- Version **1**

Top actions

## The Splunk SOAR API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 30 of Splunk SOAR's 30 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `splunk_soar.users.list` List users | List users. | read | `identity.user.list` 474 connectors |
| `splunk_soar.roles.list` List roles | List roles. | read | `identity.role.list` 184 connectors |
| `splunk_soar.user_settings.get` Get my user settings | Get my user settings. | read | `identity.current_user.get` 307 connectors |
| `splunk_soar.users.create` Create a user | Create a user. | write | `identity.user.create` 262 connectors |
| `splunk_soar.roles.create` Create a role | Create a role. | write | `identity.role.create` 105 connectors |
| `splunk_soar.users.delete` Delete a user | Delete a user. | destructive | `identity.user.delete` 253 connectors |
| `splunk_soar.containers.list` List containers | List containers. | read | `security.incident.list` 17 connectors |
| `splunk_soar.audit.list` Query the audit log | Query the audit log. | read | `security.audit_log.list` 69 connectors |
| `splunk_soar.notes.list` List notes | List notes. | read | `security.incident_note.list` 9 connectors |
| `splunk_soar.containers.audit.list` Get a container's audit trail | Get a container's audit trail. | read | `security.audit_log.list` 69 connectors |
| `splunk_soar.notes.create` Create a note | Create a note. | write | `security.incident_note.create` 8 connectors |
| `splunk_soar.containers.create` Create a container | Create a container. | write | `security.incident.create` 8 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Splunk SOAR actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which Splunk SOAR incidents are open, and how long has each been open?
   calls `splunk_soar.containers.list`
2. Write write
   Create a user in Splunk SOAR. Show me exactly what you will send before you save it.
   calls `splunk_soar.users.create`

Governance for Splunk SOAR

## Destructive actions wait for a yes.

17 Splunk SOAR actions are destructive. These are all of them:

- Delete a user `splunk_soar.users.delete`
- Delete a role `splunk_soar.roles.delete`
- Delete a note `splunk_soar.notes.delete`
- Delete a container `splunk_soar.containers.delete`
- Cancel a playbook run `splunk_soar.playbook_runs.cancel`
- Delete a CEF field definition `splunk_soar.cef.delete`
- Delete an app `splunk_soar.apps.delete`
- Delete an asset `splunk_soar.assets.delete`
- Delete an evidence record `splunk_soar.evidence.delete`
- Delete an artifact `splunk_soar.artifacts.delete`
- Delete a custom list `splunk_soar.custom_lists.delete`
- Delete an Automation Broker `splunk_soar.automation_brokers.delete`
- Delete a container status `splunk_soar.container_statuses.delete`
- Delete a workbook template `splunk_soar.workbook_templates.delete`
- Delete a container attachment `splunk_soar.container_attachments.delete`
- Cancel an action run `splunk_soar.action_runs.cancel`
- Remove a container label `splunk_soar.system_settings.labels.remove`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do splunk_soar.users.delete confirm_policy: **human**

Delete a user?

**intent:** the user asked me to delete a user

run suspended · waiting for a named person · key _splunk-soar-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "splunk-soar-agent",
  allowed_actions: ["splunk_soar.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "splunk_soar.users.delete", approver: "lead@example.com" },
    { match: "splunk_soar.roles.delete", approver: "lead@example.com" },
    { match: "splunk_soar.notes.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Splunk SOAR only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Splunk SOAR costs on actionlake.

Every Splunk SOAR action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Splunk SOAR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 217 Splunk SOAR actions
- 217 actions page each page of a long list is one call
- 141 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Splunk SOAR action.

217 actions by area: the id your agent calls, what it does, and its effect.

**Containers 20**

- `splunk_soar.containers.actions.list` List a container's action runs read
- `splunk_soar.containers.activity_feed.list` List a container's activity feed read
- `splunk_soar.containers.approvals.list` List a container's approvals read
- `splunk_soar.containers.artifacts.list` List a container's artifacts read
- `splunk_soar.containers.attachments.list` List a container's attachments read
- `splunk_soar.containers.audit.list` Get a container's audit trail read
- `splunk_soar.containers.authorized_users.update` Set authorized users on several containers write
- `splunk_soar.containers.bulk_create` Create containers in bulk write
- `splunk_soar.containers.comments.list` List a container's comments read
- `splunk_soar.containers.create` Create a container write
- `splunk_soar.containers.delete` Delete a container destructive
- `splunk_soar.containers.fields.get` Get one field of a container read
- `splunk_soar.containers.get` Get a container read
- `splunk_soar.containers.list` List containers read
- `splunk_soar.containers.options.get` Get container options read
- `splunk_soar.containers.permitted_users.list` List users who may be authorized on a container read
- `splunk_soar.containers.playbook_runs.list` List a container's playbook runs read
- `splunk_soar.containers.recommended_actions.get` Get recommended actions for a container read
- `splunk_soar.containers.recommended_playbooks.get` Get recommended playbooks for a container read
- `splunk_soar.containers.update` Update a container write

**Widgets 18**

- `splunk_soar.widgets.artifact_stats.get` Get dashboard data: artifact statistics read
- `splunk_soar.widgets.container_stats.get` Get dashboard data: container statistics read
- `splunk_soar.widgets.containers_filtered_by_status.get` Get dashboard data: containers by status read
- `splunk_soar.widgets.containers_new.get` Get dashboard data: new containers per day read
- `splunk_soar.widgets.containers_open.get` Get dashboard data: open containers read
- `splunk_soar.widgets.containers_performance.get` Get dashboard data: container performance read
- `splunk_soar.widgets.containers_resolved.get` Get dashboard data: containers resolved per day read
- `splunk_soar.widgets.containers_workload.get` Get dashboard data: container workload read
- `splunk_soar.widgets.label_stats.get` Get dashboard data: events per day by label read
- `splunk_soar.widgets.list` List dashboard widgets read
- `splunk_soar.widgets.pending_approvals.get` Get dashboard data: pending approvals read
- `splunk_soar.widgets.playbook_stats.get` Get dashboard data: playbook counts read
- `splunk_soar.widgets.playbooks_actions_stats.get` Get dashboard data: playbook and action runs per day read
- `splunk_soar.widgets.roi_stats.get` Get dashboard data: roi per day read
- `splunk_soar.widgets.roi_summary.get` Get dashboard data: roi summary read
- `splunk_soar.widgets.sla_stats.get` Get dashboard data: sla breaches per day read
- `splunk_soar.widgets.sla_trend.get` Get dashboard data: sla trend read
- `splunk_soar.widgets.top_playbooks_actions.get` Get dashboard data: top playbook actions read

**Indicators 10**

- `splunk_soar.indicators.artifacts.list` List artifacts sharing an indicator read
- `splunk_soar.indicators.containers.list` List containers sharing indicators read
- `splunk_soar.indicators.get` Get an indicator read
- `splunk_soar.indicators.get_by_value` Get an indicator by value read
- `splunk_soar.indicators.list` List indicators read
- `splunk_soar.indicators.stats.count` Count indicators read
- `splunk_soar.indicators.stats.top_labels` Top labels by indicator count read
- `splunk_soar.indicators.stats.top_types` Top indicator types read
- `splunk_soar.indicators.stats.top_values` Top indicator values read
- `splunk_soar.indicators.timeline.get` Get an indicator's timeline read

**Users 8**

- `splunk_soar.users.audit.list` Get a user's audit trail read
- `splunk_soar.users.create` Create a user write
- `splunk_soar.users.delete` Delete a user destructive
- `splunk_soar.users.get` Get a user read
- `splunk_soar.users.list` List users read
- `splunk_soar.users.roles.list` List a user's roles read
- `splunk_soar.users.token.get` Get an automation user's token info read
- `splunk_soar.users.update` Update a user write

**Playbook runs 7**

- `splunk_soar.playbook_runs.actions.list` List a playbook run's action runs read
- `splunk_soar.playbook_runs.block_results.get` Get a playbook run's block results read
- `splunk_soar.playbook_runs.cancel` Cancel a playbook run destructive
- `splunk_soar.playbook_runs.create` Run a playbook write
- `splunk_soar.playbook_runs.get` Get a playbook run read
- `splunk_soar.playbook_runs.list` List playbook runs read
- `splunk_soar.playbook_runs.log.list` Get a playbook run's log read

**Roles 7**

- `splunk_soar.roles.audit.list` Get a role's audit trail read
- `splunk_soar.roles.create` Create a role write
- `splunk_soar.roles.delete` Delete a role destructive
- `splunk_soar.roles.get` Get a role read
- `splunk_soar.roles.list` List roles read
- `splunk_soar.roles.update` Update a role write
- `splunk_soar.roles.users.list` List a role's users read

**Action runs 6**

- `splunk_soar.action_runs.app_runs.list` List an action run's app runs read
- `splunk_soar.action_runs.approvals.list` List an action run's approvals read
- `splunk_soar.action_runs.cancel` Cancel an action run destructive
- `splunk_soar.action_runs.create` Run an action write
- `splunk_soar.action_runs.get` Get an action run read
- `splunk_soar.action_runs.list` List action runs read

**Artifacts 6**

- `splunk_soar.artifacts.bulk_create` Create artifacts in bulk write
- `splunk_soar.artifacts.create` Create an artifact write
- `splunk_soar.artifacts.delete` Delete an artifact destructive
- `splunk_soar.artifacts.get` Get an artifact read
- `splunk_soar.artifacts.list` List artifacts read
- `splunk_soar.artifacts.update` Update an artifact write

**Custom lists 6**

- `splunk_soar.custom_lists.create` Create a custom list write
- `splunk_soar.custom_lists.delete` Delete a custom list destructive
- `splunk_soar.custom_lists.formatted_content.get` Get a custom list's formatted content read
- `splunk_soar.custom_lists.get` Get a custom list read
- `splunk_soar.custom_lists.list` List custom lists read
- `splunk_soar.custom_lists.update` Update a custom list write

**Notes 6**

- `splunk_soar.notes.bulk_create` Create notes in bulk write
- `splunk_soar.notes.create` Create a note write
- `splunk_soar.notes.delete` Delete a note destructive
- `splunk_soar.notes.get` Get a note read
- `splunk_soar.notes.list` List notes read
- `splunk_soar.notes.update` Update a note write

**Playbooks 6**

- `splunk_soar.playbooks.audit.list` Get a playbook's audit trail read
- `splunk_soar.playbooks.get` Get a playbook read
- `splunk_soar.playbooks.import` Import a playbook write
- `splunk_soar.playbooks.list` List playbooks read
- `splunk_soar.playbooks.resource_usage.get` Get a playbook's resource usage read
- `splunk_soar.playbooks.update` Update a playbook write

**System settings 6**

- `splunk_soar.system_settings.features.update` Turn a system feature on or off write
- `splunk_soar.system_settings.get` Get system settings read
- `splunk_soar.system_settings.labels.add` Add a container label write
- `splunk_soar.system_settings.labels.list` List container labels read
- `splunk_soar.system_settings.labels.remove` Remove a container label destructive
- `splunk_soar.system_settings.update` Update system settings write

**Assets 5**

- `splunk_soar.assets.create` Create an asset write
- `splunk_soar.assets.delete` Delete an asset destructive
- `splunk_soar.assets.get` Get an asset read
- `splunk_soar.assets.list` List assets read
- `splunk_soar.assets.update` Update an asset write

**Automation brokers 5**

- `splunk_soar.automation_brokers.create` Create an Automation Broker write
- `splunk_soar.automation_brokers.delete` Delete an Automation Broker destructive
- `splunk_soar.automation_brokers.get` Get an Automation Broker read
- `splunk_soar.automation_brokers.list` List Automation Brokers read
- `splunk_soar.automation_brokers.update` Update an Automation Broker write

**Cef 5**

- `splunk_soar.cef.create` Create a CEF field definition write
- `splunk_soar.cef.delete` Delete a CEF field definition destructive
- `splunk_soar.cef.get` Get a CEF field definition read
- `splunk_soar.cef.list` List CEF field definitions read
- `splunk_soar.cef.update` Update a CEF field definition write

**Container statuses 5**

- `splunk_soar.container_statuses.create` Create a container status write
- `splunk_soar.container_statuses.delete` Delete a container status destructive
- `splunk_soar.container_statuses.get` Get a container status read
- `splunk_soar.container_statuses.list` List container statuss read
- `splunk_soar.container_statuses.update` Update a container status write

**Custom functions 5**

- `splunk_soar.custom_functions.create` Create a custom function write
- `splunk_soar.custom_functions.get` Get a custom function read
- `splunk_soar.custom_functions.import` Import a custom function write
- `splunk_soar.custom_functions.list` List custom functions read
- `splunk_soar.custom_functions.update` Update a custom function write

**Workbook templates 5**

- `splunk_soar.workbook_templates.create` Create a workbook template write
- `splunk_soar.workbook_templates.delete` Delete a workbook template destructive
- `splunk_soar.workbook_templates.get` Get a workbook template read
- `splunk_soar.workbook_templates.list` List workbook templates read
- `splunk_soar.workbook_templates.update` Update a workbook template write

**Aggregation rules 4**

- `splunk_soar.aggregation_rules.create` Create an aggregation rule write
- `splunk_soar.aggregation_rules.get` Get an aggregation rule read
- `splunk_soar.aggregation_rules.list` List aggregation rules read
- `splunk_soar.aggregation_rules.update` Update an aggregation rule write

**Apps 4**

- `splunk_soar.apps.delete` Delete an app destructive
- `splunk_soar.apps.get` Get an app read
- `splunk_soar.apps.install` Install or upgrade an app write
- `splunk_soar.apps.list` List apps read

**Container attachments 4**

- `splunk_soar.container_attachments.create` Attach a file to a container write
- `splunk_soar.container_attachments.delete` Delete a container attachment destructive
- `splunk_soar.container_attachments.get` Get a container attachment read
- `splunk_soar.container_attachments.list` List container attachments read

**Feature flags 4**

- `splunk_soar.feature_flags.detail.get` Get one field of a feature flag read
- `splunk_soar.feature_flags.get` Get a feature flag read
- `splunk_soar.feature_flags.list` List feature flags read
- `splunk_soar.feature_flags.update` Update a feature flag write

**Severities 4**

- `splunk_soar.severities.create` Create a severity write
- `splunk_soar.severities.get` Get a severity read
- `splunk_soar.severities.list` List severitys read
- `splunk_soar.severities.update` Update a severity write

**Workbook phase templates 4**

- `splunk_soar.workbook_phase_templates.create` Create a workbook phase template write
- `splunk_soar.workbook_phase_templates.get` Get a workbook phase template read
- `splunk_soar.workbook_phase_templates.list` List workbook phase templates read
- `splunk_soar.workbook_phase_templates.update` Update a workbook phase template write

**Workbook task templates 4**

- `splunk_soar.workbook_task_templates.create` Create a workbook task template write
- `splunk_soar.workbook_task_templates.get` Get a workbook task template read
- `splunk_soar.workbook_task_templates.list` List workbook task templates read
- `splunk_soar.workbook_task_templates.update` Update a workbook task template write

**App runs 3**

- `splunk_soar.app_runs.get` Get an app run read
- `splunk_soar.app_runs.list` List app runs read
- `splunk_soar.app_runs.log.get` Get an app run's log read

**Approvals 3**

- `splunk_soar.approvals.detail_summary.get` Get an approval's detail summary read
- `splunk_soar.approvals.get` Get an approval read
- `splunk_soar.approvals.list` List approvals read

**Command runs 3**

- `splunk_soar.command_runs.create` Run system commands write
- `splunk_soar.command_runs.get` Get a system command run read
- `splunk_soar.command_runs.list` List system command runs read

**Container comments 3**

- `splunk_soar.container_comments.create` Comment on a container write
- `splunk_soar.container_comments.get` Get a container comment read
- `splunk_soar.container_comments.list` List container comments read

**Container pins 3**

- `splunk_soar.container_pins.create` Pin data to a container's HUD write
- `splunk_soar.container_pins.get` Get a container HUD pin read
- `splunk_soar.container_pins.list` List container HUD pins read

**Evidence 3**

- `splunk_soar.evidence.create` Mark an object as evidence write
- `splunk_soar.evidence.delete` Delete an evidence record destructive
- `splunk_soar.evidence.list` List evidence records read

**Indicator cef filters 3**

- `splunk_soar.indicator_cef_filters.get` Get an indicator CEF filter read
- `splunk_soar.indicator_cef_filters.list` List indicator CEF filters read
- `splunk_soar.indicator_cef_filters.update` Update an indicator CEF filter write

**Records 3**

- `splunk_soar.records.fields.get` Get a field or related list of any record read
- `splunk_soar.records.get` Get a record of any type read
- `splunk_soar.records.list` List records of any type read

**Source control 3**

- `splunk_soar.source_control.get` Get a source control repository read
- `splunk_soar.source_control.list` List source control repositorys read
- `splunk_soar.source_control.sync` Sync a source control repository write

**Workbook tasks 3**

- `splunk_soar.workbook_tasks.get` Get a workbook task read
- `splunk_soar.workbook_tasks.list` List workbook tasks read
- `splunk_soar.workbook_tasks.update` Update a workbook task write

**Cluster nodes 2**

- `splunk_soar.cluster_nodes.get` Get a cluster node read
- `splunk_soar.cluster_nodes.list` List cluster nodes read

**External prompts 2**

- `splunk_soar.external_prompts.get` Get an external prompt read
- `splunk_soar.external_prompts.respond` Respond to an external prompt write

**License 2**

- `splunk_soar.license.get` Get license information read
- `splunk_soar.license.update` Load a license write

**Notifications 2**

- `splunk_soar.notifications.detail_summary.get` Get a notification's detail summary read
- `splunk_soar.notifications.list` List notifications read

**Tenants 2**

- `splunk_soar.tenants.get` Get a tenant read
- `splunk_soar.tenants.list` List tenants read

**User settings 2**

- `splunk_soar.user_settings.get` Get my user settings read
- `splunk_soar.user_settings.update` Update my user settings write

**Vault documents 2**

- `splunk_soar.vault_documents.get` Get a vault document read
- `splunk_soar.vault_documents.list` List vault documents read

**Workbook phases 2**

- `splunk_soar.workbook_phases.get` Get a container workbook phase read
- `splunk_soar.workbook_phases.list` List container workbook phases read

**App status 1**

- `splunk_soar.app_status.list` List app status records read

**Audit 1**

- `splunk_soar.audit.list` Query the audit log read

**Container pin settings 1**

- `splunk_soar.container_pin_settings.create` Create an HUD pin template write

**Health 1**

- `splunk_soar.health.get` Get system health read

**Search 1**

- `splunk_soar.search.query` Search SOAR read

**System info 1**

- `splunk_soar.system_info.get` Get system information read

**Version 1**

- `splunk_soar.version.get` Get the SOAR version read

Questions

## The Splunk SOAR MCP server, answered.

**Is there a Splunk SOAR MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 217 Splunk SOAR actions across containers, widgets, indicators and users, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Splunk SOAR.

**What do I need to connect Splunk SOAR?**

SOAR username for a user login and The user's password, or an automation user's ph-auth-token (Administration > User Management > Users > the…. Plus your host. The free call account { op: "connections.requirements", service: "splunk_soar" } lists exactly what to paste.

**Can an AI agent delete or change things in Splunk SOAR?**

Only if its key allows it, and only with an explicit confirmation. 17 Splunk SOAR actions are destructive, including delete a user, delete a role and delete a note. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Splunk SOAR API limit?**

actionlake paces every call to the limits in the Splunk SOAR service file: 10 calls a second per connection. Repeated reads are answered from cache (141 Splunk SOAR actions can be), which never reaches Splunk SOAR.

**What does a Splunk SOAR action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (217 Splunk SOAR actions page). Cache hits, searches, dry runs and calls Splunk SOAR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Splunk SOAR API does it cover?**

The Splunk SOAR REST API (SOAR Cloud and On-premises 6.x/7.x) at your Splunk SOAR instance's API base URL, which you enter when connecting. It is built from Splunk SOAR's documentation as read on 23 October 2026. 217 actions in 50 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Splunk SOAR data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 1 minute, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Splunk SOAR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Splunk SOAR

Shares the most action names with

- [Sekoia.io 23](https://actionlake.com/connectors/sekoia-io)
- [Torq 22](https://actionlake.com/connectors/torq)
- [StrangeBee TheHive 16](https://actionlake.com/connectors/strangebee-thehive)
- [Trend Vision One 14](https://actionlake.com/connectors/trend-vision-one)
- [GitGuardian 12](https://actionlake.com/connectors/gitguardian)
- [Expel Workbench 10](https://actionlake.com/connectors/expel-workbench)

Joins with, on shared entities

- [Axiom 4](https://actionlake.com/connectors/axiom)
- [HaloPSA 3](https://actionlake.com/connectors/halopsa)
- [NetBox 3](https://actionlake.com/connectors/netbox)
- [Delinea Secret Server 3](https://actionlake.com/connectors/delinea-secret-server)
- [Docebo 3](https://actionlake.com/connectors/docebo)
- [authentik 3](https://actionlake.com/connectors/authentik)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Splunk SOAR; the name is the vendor's own. Counts are from the Splunk SOAR service file, version 1.0.0.

## Give your agent Splunk SOAR today.

[Connect Splunk SOAR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/splunk-soar
More: https://actionlake.com/llms.txt