Model Context Protocol moderate risk

Cortex

This MCP server bridges LLMs to a Cortex instance for threat intelligence, enabling analysis of observables like IPs and URLs via configured analyzers.

Connections & Capabilities

Connects To

GitHub

Capabilities

read

Quickstart

Config

{
  "mcpServers": {
    // ... other server configurations ...
    "cortex": {
      "command": "/opt/mcp-servers/mcp-server-cortex",
      "args": [],
      "env": {
        "CORTEX_ENDPOINT": "http://your-cortex-instance:9000/api",
        "CORTEX_API_KEY": "your_cortex_api_key_here",
      }
    }
    // ... other server configurations ...
  }
}

Exposed MCP Tools (4)

safe

analyze_ip_with_abuseipdb

Analyzes an IP address using AbuseIPDB via Cortex and returns the job report.

Read-only operation that queries AbuseIPDB for IP reputation.

safe

analyze_with_abusefinder

Analyzes data (IP, domain, URL, etc.) using AbuseFinder via Cortex and returns the job report.

Read-only operation that queries AbuseFinder for threat intelligence.

safe

scan_url_with_virustotal

Scans a URL using VirusTotal via Cortex and returns the job report.

Read-only operation that submits a URL to VirusTotal for scanning.

safe

analyze_url_with_urlscan_io

Analyzes a URL using Urlscan.io via Cortex and returns the job report.

Read-only operation that submits a URL to Urlscan.io for analysis.

Safety Assessment

This server is relatively safe for read-only operations, but the security posture depends heavily on the configuration of the Cortex instance and the protection of the API key. It is risky if the Cortex instance is not properly secured or if the API key is exposed.

API key authentication for Cortex access.
Read-only access to Cortex data via analyzers.
No direct system-level access.
Relies on Cortex's own security measures.

Exposure of Cortex API key in environment variables.
Potential for information leakage depending on Cortex analyzer configurations.
Vulnerable if the underlying Cortex instance is compromised.
No input sanitization performed by the MCP server itself.