cortex-mcp

An MCP server for the Cortex observable analysis and active response engine. It enables LLMs to automate security investigations by running analyzers on observables like IPs and URLs and executing automated response actions.

→ solomonneas/cortex-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: CORTEX_API_KEY, CORTEX_SUPERADMIN_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCORTEX_ALLOW_DESTRUCTIVE— No 0 Set to 1 (or true) to permit running responders (cortex_run_responder), which cause real-world side effects. Off by default. Responders also require confirm=true per call.

🔐 secretCORTEX_API_KEY— Yes - API key for normal operations (org admin level)

configCORTEX_FILE_BASE_DIR— cortex_run_analyzer_file Submit a file to an analyzer. filePath is confined to (disabled if unset); or pass fileBase64

configCORTEX_MAX_FANOUT— No 10 Maximum number of analyzers cortex_analyze_observable will submit to in a single call when fanning out.

🔐 secretCORTEX_SUPERADMIN_KEY— No - Superadmin API key for org/user/definition management

configCORTEX_TIMEOUT— No 30 Request timeout in seconds

configCORTEX_URL— Yes - Cortex base URL (e.g., http://cortex.example.com:9001)

configCORTEX_VERIFY_SSL— No true Set to false to skip SSL verification. Applied via a scoped HTTP dispatcher for Cortex requests only; it does not disable TLS verification process-wide.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/solomonneas-cortex-mcp-utsbqz)](https://m8ven.ai/mcp/solomonneas-cortex-mcp-utsbqz)

commit: a8e707d58b260c976eff562aade655f060347da4

code hash: f968d052161898587650000119e0648a57052935496a68fb04f49c99b8e38e56

verified: 6/12/2026, 11:27:54 AM

view raw JSON →