cortex-mcp

Active

Detonating one indicator in Cortex means picking analyzers by hand, launching a job per analyzer, then clicking through each report to reconcile the verdicts. cortex-mcp hands the whole engine to your agent: auto-detect the observable, fan out across every applicable analyzer, and get one aggregated taxonomy verdict back in plain language.

GitHub repo → npm →
$npx -y thehive-cortex-mcp
destructive-gatedNode 20+

See it workrepresentative session

you
An alert flagged 203.0.113.47 for outbound traffic. What does Cortex think of it, and pull any IOCs?
tool
cortex_analyze_observable{ data: "203.0.113.47", fanOut: true }
result
auto-detected type: ip ran 4 analyzers Abuse_Finder_3_0 malicious abuse-confidence 92% MaxMind_GeoIP RU / hosting ASN CyberCrime_Tracker suspicious 1 hit taxonomy: 2 malicious / 1 suspicious / 1 info
tool
cortex_get_job_artifacts{ jobId: "a1f3-Abuse_Finder_3_0" }
result
3 artifacts domain c2.example.net url http://c2.example.net/gate.php ip 198.51.100.9
agent
203.0.113.47 is malicious: 92% abuse confidence, on a Russian hosting ASN, and it points at a c2.example.net C2 domain. I'd block the IP and domain and sweep for callbacks to 198.51.100.9. Running a responder stays gated until you confirm.

Representative session. Illustrative values, RFC 5737 addresses. Nothing leaves the box except calls to the Cortex instance you configure.

What it does

cortex-mcp points any MCP client at a running Cortex instance and turns StrangeBee/TheHive's analyzer and responder engine into typed tools the agent can call. It exists because analysts already drive Cortex by hand through its web UI or raw REST API, and an agent can do that work conversationally: auto-detect an observable's data type, fan out analysis across every applicable analyzer, aggregate the taxonomy verdicts, and extract IOC artifacts without clicking through a dozen jobs. It differs from a generic HTTP bridge by modeling Cortex's real domain surface (analyzers, responders, jobs, definitions, orgs, users) as 31 typed tools with capped fan-out and safety gates, so the agent works in Cortex's vocabulary instead of reconstructing the API. It calls a Cortex instance you already run and never replaces it.

Capabilities31 tools across the Cortex pipeline

Analyzers

5 tools

List and get enabled analyzers, run by ID or name, run against a path-confined or base64 file.

Analyzer & responder definitions

6 tools

Browse available definitions with filters, enable or disable them in the current org.

Jobs & artifacts

7 tools

Get status, wait for reports, list jobs, extract IOC artifacts, delete or bulk-clean with dry-run.

Responders

2 tools

List responders and execute a response action against a TheHive entity, gated behind confirm.

Bulk analysis & status

2 tools

Auto-detect an observable, fan out with taxonomy aggregation, and read instance health.

Orgs & users (superadmin)

9 tools

List, create, and update organizations and users, and rotate or retrieve API keys.

Full tool reference on GitHub →

Setup

01 · install
npx -y thehive-cortex-mcp
02 · configure

Set CORTEX_URL and CORTEX_API_KEY. Add CORTEX_SUPERADMIN_KEY for org/user management, CORTEX_FILE_BASE_DIR to allow path-based file reads, and CORTEX_ALLOW_DESTRUCTIVE=1 to permit responders.

03 · mcp client config
{ "mcpServers": { "cortex": { "command": "npx", "args": ["-y", "thehive-cortex-mcp"], "env": { "CORTEX_URL": "http://cortex.example.com:9001", "CORTEX_API_KEY": "your-org-admin-key" } } } }

Safety

how it stays safe
Real-world actions are off or confirmation-gated by default. Responders require both CORTEX_ALLOW_DESTRUCTIVE=1 and confirm=true per call; job deletes and analyzer disables require confirm=true. Arbitrary file reads are blocked unless CORTEX_FILE_BASE_DIR is set, and even then paths are realpath-confined to defeat symlink and .. escapes. Bulk analysis will not fan out to every analyzer unless you opt in, and disabling SSL verification is scoped to Cortex requests only, never the whole process.

More in Security / SOC8 tools

wazuh-mcpRead your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. suricata-mcpHunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. thehive-mcpDrive TheHive incident response from your agent: cases, alerts, tasks, observables. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. hotwashBuild IR playbooks as flowcharts and run them step by step, agent-drivable. soc-stackOne command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.