MCP Server for Cortex

What is MCP Server for Cortex?

MCP Server for Cortex bridges a Cortex instance with MCP-compatible clients, exposing Cortex’s threat-intelligence analyzers as callable tools for large language models like Claude. It is intended for security analysts and automation engineers who need to programmatically enrich observables (IPs, URLs, domains, etc.) via a Cortex backend.

How to use MCP Server for Cortex?

Download or build the server binary, set environment variables CORTEX_ENDPOINT (Cortex API URL) and CORTEX_API_KEY, then configure your MCP client (e.g., Claude Desktop’s claude_desktop_config.json) to launch the binary with those env vars. Once running, the client can call tools like analyze_ip_with_abuseipdb to submit observables for analysis.

Key features of MCP Server for Cortex

• Exposes Cortex analyzers as MCP tools for LLM clients.
• Supports IP, URL, domain, FQDN, and email analysis.
• Uses API-key-based authentication for Cortex access.
• Requires only a binary download (Rust-based); no runtime dependencies.
• Built for extensibility – works with any enabled Cortex analyzer.

Use cases of MCP Server for Cortex

• Enrich an IP address with AbuseIPDB reputation data via an MCP client.
• Scan a URL with VirusTotal to detect malicious content.
• Analyze a domain or email using AbuseFinder in an automated playbook.
• Integrate Cortex’s analysis capabilities into a conversational AI (e.g., Claude).

FAQ from MCP Server for Cortex

What prerequisites are needed?

A Rust toolchain (for building from source), a running Cortex instance with network access, a Cortex API key with permissions to list analyzers and run jobs, and the desired analyzers enabled and configured inside Cortex.

How is the server configured?

Set the environment variables CORTEX_ENDPOINT (e.g., http://localhost:9000/api) and CORTEX_API_KEY. Optionally set RUST_LOG for logging level. No config file is required.

What tools does the server provide?

Four tools: analyze_ip_with_abuseipdb, analyze_with_abusefinder, scan_url_with_virustotal, and analyze_url_with_urlscan_io. Each accepts the observable data, an optional analyzer name, and optional max polling retries.

How do I install the server?

Download a pre-compiled binary from the GitHub Releases page for your OS, place it in your PATH, and make it executable (Linux/macOS: chmod +x). Alternatively, clone the repo and run cargo build --release.

How do I use it with Claude Desktop?

Add an entry to Claude Desktop’s claude_desktop_config.json under mcpServers with the binary path as the command and the two required environment variables. No arguments are needed.