# gbrigandi/mcp-server-cortex [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/gbrigandi/mcp-server-cortex  
**GitHub Stars:** 17  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/gbrigandi-mcp-server-cortex

## Description
A Rust-based MCP server to integrate Cortex, enabling observable analysis and automated security responses through AI.

## Tools
Capabilities this server exposes over MCP:

- **Description** — Analyzes an IP address using an AbuseIPDB analyzer (or a similarly configured IP reputation analyzer) via Cortex. Returns the job report if successful.

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/gbrigandi/mcp-server-cortex), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
chmod +x /path/to/your/mcp-server-cortex
```

2. Install:

```sh
cargo build --release
```

## Documentation

## What gbrigandi/mcp-server-cortex MCP server does

gbrigandi/mcp-server-cortex MCP server exposes selected Cortex analysis workflows as tools for MCP-compatible clients. Cortex performs the underlying observable analysis through enabled analyzers, while the MCP layer accepts tool parameters, starts jobs, waits for completion, and returns the resulting report when successful.

The supported inputs include IP addresses, domains, fully qualified domain names, URLs, and email addresses, depending on the tool.

## How it works

The server connects to the Cortex API using an endpoint and an API key. A tool call selects an analyzer, either by using its default analyzer name or by supplying a configured analyzer instance. After starting a Cortex job, the server polls for completion up to the requested retry limit and returns the job report or a Cortex error.

The gbrigandi/mcp-server-cortex MCP server does not provide the external threat-intelligence credentials itself. Those credentials belong in the relevant analyzer configuration inside Cortex. For example, AbuseIPDB, VirusTotal, and urlscan.io analyzers may each require their own API key.

## Setup and configuration

Use a precompiled binary from the repository's GitHub Releases page, place it in a suitable directory, and make it executable on Linux or macOS. The project also supports building from source with the Rust toolchain. An MCP client must be configured to launch the executable; the README gives Claude Desktop as an example.

Set these environment variables before starting the process:

- `CORTEX_ENDPOINT`: Full Cortex API URL, such as `http://localhost:9000/api`.
- `CORTEX_API_KEY`: Cortex API key with permission to list analyzers and run jobs.
- `RUST_LOG`: Optional logging configuration, including values such as `info`.

The Cortex instance must be reachable from the server, and the analyzers used by the tools must be enabled and configured in the relevant Cortex organization. Testing each analyzer in the Cortex interface first can help identify configuration or credential problems.

## Tools and capabilities

The gbrigandi/mcp-server-cortex MCP server provides these documented tools:

- `analyze_ip_with_abuseipdb` accepts an IP address, an optional analyzer name defaulting to `AbuseIPDB_1_0`, and an optional retry limit defaulting to five.
- `analyze_with_abusefinder` accepts data and a type of `ip`, `domain`, `fqdn`, `url`, or `mail`. Its default analyzer is `Abuse_Finder_3_0`, and it also accepts a retry limit.
- `scan_url_with_virustotal` submits a URL to a VirusTotal analyzer, defaulting to `VirusTotal_Scan_3_1`, with an optional retry limit.
- `analyze_url_with_urlscan_io` submits a URL to a urlscan.io analyzer, defaulting to `Urlscan_io_Scan_0_1_0`.

Analyzer names can be overridden where the tool exposes that parameter, allowing a Cortex deployment to use a differently named analyzer instance.

## Limitations and notes

Analysis depends on the Cortex deployment and its analyzer configuration. A disabled analyzer, missing provider API key, invalid credentials, or other Cortex-side configuration issue can cause a tool call to fail or return an error. The server also needs network access to the Cortex API.

Retry limits control polling attempts and do not replace Cortex job execution or provider-side rate limits.

_Full upstream README: https://allmcps.com/mcp/gbrigandi-mcp-server-cortex/readme_