cortex-mcp
ActiveDetonating one indicator in Cortex means picking analyzers by hand, launching a job per analyzer, then clicking through each report to reconcile the verdicts. cortex-mcp hands the whole engine to your agent: auto-detect the observable, fan out across every applicable analyzer, and get one aggregated taxonomy verdict back in plain language.
See it work
one question, the tools it calls, the answer
Representative session. Illustrative values, RFC 5737 addresses. Nothing leaves the box except calls to the Cortex instance you configure.
What it does
cortex-mcp points any MCP client at a running Cortex instance and turns StrangeBee/TheHive's analyzer and responder engine into typed tools the agent can call. It exists because analysts already drive Cortex by hand through its web UI or raw REST API, and an agent can do that work conversationally: auto-detect an observable's data type, fan out analysis across every applicable analyzer, aggregate the taxonomy verdicts, and extract IOC artifacts without clicking through a dozen jobs. It differs from a generic HTTP bridge by modeling Cortex's real domain surface (analyzers, responders, jobs, definitions, orgs, users) as 31 typed tools with capped fan-out and safety gates, so the agent works in Cortex's vocabulary instead of reconstructing the API. It calls a Cortex instance you already run and never replaces it.
Capabilities
31 tools across the Cortex pipeline
Set it up
Set CORTEX_URL and CORTEX_API_KEY. Add CORTEX_SUPERADMIN_KEY for org/user management, CORTEX_FILE_BASE_DIR to allow path-based file reads, and CORTEX_ALLOW_DESTRUCTIVE=1 to permit responders.
MCP client config
{ "mcpServers": { "cortex": { "command": "npx", "args": ["-y", "thehive-cortex-mcp"], "env": { "CORTEX_URL": "http://cortex.example.com:9001", "CORTEX_API_KEY": "your-org-admin-key" } } } }Real-world actions are off or confirmation-gated by default. Responders require both CORTEX_ALLOW_DESTRUCTIVE=1 and confirm=true per call; job deletes and analyzer disables require confirm=true. Arbitrary file reads are blocked unless CORTEX_FILE_BASE_DIR is set, and even then paths are realpath-confined to defeat symlink and .. escapes. Bulk analysis will not fan out to every analyzer unless you opt in, and disabling SSL verification is scoped to Cortex requests only, never the whole process.