MCP Server for Cortex

This server acts as a bridge, exposing the powerful analysis capabilities of a Cortex instance as tools consumable by Model Context Protocol (MCP) clients, such as large language models like Claude. It allows these clients to leverage Cortex analyzers for threat intelligence tasks.

What is Cortex?

Cortex is a powerful, free, and open-source observable analysis and active response engine. It allows you to analyze observables (like IPs, URLs, domains, files, etc.) using a variety of "analyzers" – modular pieces of code that connect to external services or perform local analysis.

Benefits of using Cortex (and this MCP server):

• Centralized Analysis: Run various analyses from a single point.
• Extensibility: Easily add new analyzers for different threat intelligence feeds and tools.
• Automation: Automate the process of enriching observables.
• Integration: Designed to work closely with TheHive, a Security Incident Response Platform (SIRP), but can also be used standalone.
• Security: API-key based access to protect your Cortex instance.

This MCP server makes these benefits accessible to MCP-compatible clients, enabling them to request analyses and receive structured results.

Prerequisites

1. Rust Toolchain: Ensure you have Rust installed (visit rustup.rs).
2. Cortex Instance: A running Cortex instance is required.
   • The server needs network access to this Cortex instance.
   • An API key for Cortex with permissions to list analyzers and run jobs.
3. Configured Analyzers: The specific analyzers you intend to use (e.g., AbuseIPDB_1_0, Abuse_Finder_3_0, VirusTotal_Scan_3_1, Urlscan_io_Scan_0_1_0) must be enabled and correctly configured within your Cortex instance.

Installation

The recommended way to install the MCP Server for Cortex is to download a pre-compiled binary for your operating system.

1. Go to the Releases Page: Navigate to the GitHub Releases page.

2. Download the Binary: Find the latest release and download the appropriate binary for your operating system (e.g., mcp-server-cortex-linux-amd64, mcp-server-cortex-macos-amd64, mcp-server-cortex-windows-amd64.exe).

3. Place and Prepare the Binary:

   • Move the downloaded binary to a suitable location on your system (e.g., /usr/local/bin on Linux/macOS, or a dedicated folder like C:\Program Files\MCP Servers\ on Windows).
   • For Linux/macOS: Make the binary executable:

     chmod +x /path/to/your/mcp-server-cortex
     

   • Ensure the directory containing the binary is in your system's PATH if you want to run it without specifying the full path.

Alternatively, you can build the server from source (see the Building section below).

Configuration

The server is configured using the following environment variables:

• CORTEX_ENDPOINT: The full URL to your Cortex API.
  • Example: http://localhost:9000/api
• CORTEX_API_KEY: Your API key for authenticating with the Cortex instance.
• RUST_LOG (Optional): Controls the logging level for the server.
  • Example: info (for general information)
  • Example: mcp_server_cortex=debug,cortex_client=info (for detailed server logs and info from the cortex client library)

Cortex Analyzer Configuration

For the tools provided by this MCP server to function correctly, the corresponding analyzers must be enabled and properly configured within your Cortex instance. The server relies on these Cortex analyzers to perform the actual analysis tasks.

The tools currently use the following analyzers by default (though these can often be overridden via tool parameters):

• analyze_ip_with_abuseipdb: Uses an analyzer like `Abus

... View full README on GitHub