cortex-mcp

Active

Detonating one indicator in Cortex means picking analyzers by hand, launching a job per analyzer, then clicking through each report to reconcile the verdicts. cortex-mcp hands the whole engine to your agent: auto-detect the observable, fan out across every applicable analyzer, and get one aggregated taxonomy verdict back in plain language.

31 tools4 resources4 promptsdestructive-gatedNode 20+MIT

See it work

one question, the tools it calls, the answer

representative session · claude + cortex-mcp
An alert flagged 203.0.113.47 for outbound traffic. What does Cortex think of it, and pull any IOCs?
cortex_analyze_observable{ data: "203.0.113.47", fanOut: true }
auto-detected type: ip ran 4 analyzers Abuse_Finder_3_0 malicious abuse-confidence 92% MaxMind_GeoIP RU / hosting ASN CyberCrime_Tracker suspicious 1 hit taxonomy: 2 malicious / 1 suspicious / 1 info
cortex_get_job_artifacts{ jobId: "a1f3-Abuse_Finder_3_0" }
3 artifacts domain c2.example.net url http://c2.example.net/gate.php ip 198.51.100.9
203.0.113.47 is malicious: 92% abuse confidence, on a Russian hosting ASN, and it points at a c2.example.net C2 domain. I'd block the IP and domain and sweep for callbacks to 198.51.100.9. Running a responder stays gated until you confirm.

Representative session. Illustrative values, RFC 5737 addresses. Nothing leaves the box except calls to the Cortex instance you configure.

What it does

cortex-mcp points any MCP client at a running Cortex instance and turns StrangeBee/TheHive's analyzer and responder engine into typed tools the agent can call. It exists because analysts already drive Cortex by hand through its web UI or raw REST API, and an agent can do that work conversationally: auto-detect an observable's data type, fan out analysis across every applicable analyzer, aggregate the taxonomy verdicts, and extract IOC artifacts without clicking through a dozen jobs. It differs from a generic HTTP bridge by modeling Cortex's real domain surface (analyzers, responders, jobs, definitions, orgs, users) as 31 typed tools with capped fan-out and safety gates, so the agent works in Cortex's vocabulary instead of reconstructing the API. It calls a Cortex instance you already run and never replaces it.

Capabilities

31 tools across the Cortex pipeline

Analyzers5 tools
List and get enabled analyzers, run by ID or name, run against a path-confined or base64 file.
Analyzer & responder definitions6 tools
Browse available definitions with filters, enable or disable them in the current org.
Jobs & artifacts7 tools
Get status, wait for reports, list jobs, extract IOC artifacts, delete or bulk-clean with dry-run.
Responders2 tools
List responders and execute a response action against a TheHive entity, gated behind confirm.
Bulk analysis & status2 tools
Auto-detect an observable, fan out with taxonomy aggregation, and read instance health.
Orgs & users (superadmin)9 tools
List, create, and update organizations and users, and rotate or retrieve API keys.
Full reference on GitHub →

Set it up

npx -y thehive-cortex-mcp

Set CORTEX_URL and CORTEX_API_KEY. Add CORTEX_SUPERADMIN_KEY for org/user management, CORTEX_FILE_BASE_DIR to allow path-based file reads, and CORTEX_ALLOW_DESTRUCTIVE=1 to permit responders.

MCP client config
{ "mcpServers": { "cortex": { "command": "npx", "args": ["-y", "thehive-cortex-mcp"], "env": { "CORTEX_URL": "http://cortex.example.com:9001", "CORTEX_API_KEY": "your-org-admin-key" } } } }
[ shield ]

Real-world actions are off or confirmation-gated by default. Responders require both CORTEX_ALLOW_DESTRUCTIVE=1 and confirm=true per call; job deletes and analyzer disables require confirm=true. Arbitrary file reads are blocked unless CORTEX_FILE_BASE_DIR is set, and even then paths are realpath-confined to defeat symlink and .. escapes. Bulk analysis will not fan out to every analyzer unless you opt in, and disabling SSL verification is scoped to Cortex requests only, never the whole process.

31
MCP tools
4
resources
4
prompts
gated
destructive actions
MIT
license