Sentinel-MCP: The Dev Xperience

Inspiration

Splunk is the world’s most powerful data engine, but for many developers and operators, the learning curve is steep. Writing complex SPL (Splunk Processing Language) and navigating dozens of siloed dashboards can slow down team velocity. We were inspired to build Sentinel-MCP to turn Splunk from a technical data lake into an accessible knowledge layer that any developer or manager can interact with via the tools they already use (Slack).

What it does

Sentinel-MCP is an Agentic Ops middleware that bridges the gap between technical logs and organizational action.

• Natural Language Operations: Instead of writing SPL, our agent uses LLM reasoning to "understand" a technical alert and translate it into a plain-English forensic report.
• Silo-Bridging: It connects Splunk Cloud with HR Databases and Slack, creating a frictionless experience where a security decision in one channel automatically triggers a compliance notification in another.
• Simplified Decision Making: By providing "one-click" remediation buttons in Slack, we remove the need for developers to switch contexts between multiple browser tabs and portals.

How we built it

We focused on a modular tool-calling architecture. By treating the Splunk Python SDK as a set of "tools" for the LLM, we followed the Model Context Protocol (MCP) pattern. This allows the platform to be easily extended—developers can add new "tools" (like GitHub or Jira integrations) to the agent in minutes, making Sentinel-MCP a highly extensible developer platform for enterprise operations.

Challenges we ran into

• Connectivity: Bridging the gap between a local development environment and Splunk Cloud API required careful management of tokens and IP whitelisting.
• Reasoning Reliability: Ensuring the LLM didn't "hallucinate" SPL (Splunk Processing Language). We solved this by using the Splunk AI Assistant to help refine the tool-calling logic.
• Slack Permissions: We encountered "scope" and "channel membership" hurdles when trying to enable the bot to talk across different department channels (Security vs. HR), which taught us a lot about the Slack OAuth ecosystem.

Accomplishments that we're proud of

We are most proud of the Organizational Ripple Effect. We proved that a "Security Platform" can also be a "People Platform" by automating the notification loop between technical ops and HR. This removes the "Human Middleware" bottleneck and ensures the entire company stays in sync during an incident.

What we learned

We discovered that the true power of the Splunk platform isn't just in indexing logs, but in its potential to serve as a high-speed Reasoning Layer for AI agents. We learned that the biggest bottleneck in modern operations isn't a lack of data, but the 'Context Gap' between siloed systems. By using the Splunk Python SDK to bridge technical logs with organizational data, we realized that Agentic Ops can effectively eliminate the 'Human Middleware' that currently slows down enterprise workflows.

What's next for Sentinel-MCP: The Dev Experience

Our vision is to evolve Sentinel-MCP into a Self-Service Agentic Framework. We plan to build a 'No-Code Tool Registry' that allows developers to instantly transform any Splunk Saved Search into a plug-and-play AI tool. By expanding our integration library to include GitHub, Jira, and ServiceNow, we aim to create a unified platform where any technical alert can trigger an autonomous, cross-departmental resolution without a single manual context switch."

Built With

• fastapi
• huggigface-inference-api
• langchain
• mcp-design-pattern
• slack-api
• splunk-enterprise
• splunk-python-sdk