MCP Server for Cortex
This server acts as a bridge, exposing the powerful analysis capabilities of a Cortex instance as tools consumable by Model Context Protocol (MCP) clients, such as large language models like Claude. It allows these clients to leverage Cortex analyzers for threat intelligence tasks.
What is Cortex?
Cortex is a powerful, free, and open-source observable analysis and active response engine. It allows you to analyze observables (like IPs, URLs, domains, files, etc.) using a variety of "analyzers" – modular pieces of code that connect to external services or perform local analysis.
Benefits of using Cortex (and this MCP server):
- Centralized Analysis: Run various analyses from a single point.
- Extensibility: Easily add new analyzers for different threat intelligence feeds and tools.
- Automation: Automate the process of enriching observables.
- Integration: Designed to work closely with TheHive, a Security Incident Response Platform (SIRP), but can also be used standalone.
- Security: API-key based access to protect your Cortex instance.
