gbrigandi/mcp-server-cortex

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

17 stars 8 forks 质量 63 趋势 21MIT

Repository Install

Cortex 的 MCP 服务器

概览

这个服务器起到桥梁的作用,暴露出Cortex实例作为Model Contex协议(MCP)客户端所消耗的工具的强大分析能力,如克洛德等大型语言模型. 它可以让这些客户利用Cortex分析器执行威胁情报任务. Cortex是一个强大的,自由的,开源的可观测分析和活性响应引擎. 它允许您使用多种"分析器"来分析可观测到的(如IP,URL,域,文件等)——连接外部服务或进行局部分析的模块化代码. *:从一个点进行各种分析。 *:方便地为不同的威胁情报信息和工具添加新的分析器. *: 使可观察物的丰富过程自动化。 *:设计上与安全事件应对平台TheHive(英语:TheHive (Security Conference Sporters))密切合作,但也可以单独使用. *: API- key 访问以保护您的 Cortex 实例 .

概述（AI 翻译）

这个服务器起到桥梁的作用,暴露出Cortex实例作为Model Contex协议(MCP)客户端所消耗的工具的强大分析能力,如克洛德等大型语言模型. 它可以让这些客户利用Cortex分析器执行威胁情报任务.

□何为克特斯?

Cortex是一个强大的,自由的,开源的可观测分析和活性响应引擎. 它允许您使用多种"分析器"来分析可观测到的(如IP,URL,域,文件等)——连接外部服务或进行局部分析的模块化代码.

** 使用 Cortex (和这个MCP 服务器)的好处:**

** 集中分析**:从单一点进行各种分析。 *** 扩展**:方便地为不同的威胁情报信息和工具添加新的分析器。 *** 自动**:使可观察物的丰富过程自动化。 *集成:设计与安全事件应对平台TheHive(SIRP)密切合作,但也可以单独使用.
** 安全**:基于API的钥匙访问以保护您的 Cortex 实例.

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

MCP Server for Cortex

This server acts as a bridge, exposing the powerful analysis capabilities of a Cortex instance as tools consumable by Model Context Protocol (MCP) clients, such as large language models like Claude. It allows these clients to leverage Cortex analyzers for threat intelligence tasks.

What is Cortex?

Cortex is a powerful, free, and open-source observable analysis and active response engine. It allows you to analyze observables (like IPs, URLs, domains, files, etc.) using a variety of “analyzers” – modular pieces of code that connect to external services or perform local analysis.

Benefits of using Cortex (and this MCP server):

Centralized Analysis: Run various analyses from a single point.
Extensibility: Easily add new analyzers for different threat intelligence feeds and tools.
Automation: Automate the process of enriching observables.
Integration: Designed to work closely with TheHive, a Security Incident Response Platform (SIRP), but can also be used standalone.
Security: API-key based access to protect your Cortex instance.

This MCP server makes these benefits accessible to MCP-compatible clients, enabling them to request analyses and receive structured results.

Prerequisites

Rust Toolchain: Ensure you have Rust installed (visit rustup.rs).
Cortex Instance: A running Cortex instance is required.
- The server needs network access to this Cortex instance.
- An API key for Cortex with permissions to list analyzers and run jobs.
Configured Analyzers: The specific analyzers you intend to use (e.g., AbuseIPDB_1_0, Abuse_Finder_3_0, VirusTotal_Scan_3_1, Urlscan_io_Scan_0_1_0) must be enabled and correctly configured within your Cortex instance.

Installation

The recommended way to install the MCP Server for Cortex is to download a pre-compiled binary for your operating system.

Go to the Releases Page: Navigate to the GitHub Releases page.
Download the Binary: Find the latest release and download the appropriate binary for your operating system (e.g., mcp-server-cortex-linux-amd64, mcp-server-cortex-macos-amd64, mcp-server-cortex-windows-amd64.exe).
Place and Prepare the Binary:
- Move the downloaded binary to a suitable location on your system (e.g., /usr/local/bin on Linux/macOS, or a dedicated folder like C:\Program Files\MCP Servers\ on Windows).
- For Linux/macOS: Make the binary executable:
```
chmod +x /path/to/your/mcp-server-cortex
```
- Ensure the directory containing the binary is in your system’s PATH if you want to run it without specifying the full path.

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
          "mcpServers": {
            // ... other server configurations ...
            "cortex": {
              "command": "/opt/mcp-servers/mcp-server-cortex",
              "args": [],
              "env": {
                "CORTEX_ENDPOINT": "http://your-cortex-instance:9000/api",
                "CORTEX_API_KEY": "your_cortex_api_key_here",
              }
            }
            // ... other server configurations ...
          }
        }


## Available Tools

The server provides the following tools, which can be called by an MCP client:

1.  **`analyze_ip_with_abuseipdb`**
    *   **Description**: Analyzes an IP address using an AbuseIPDB analyzer (or a similarly configured IP reputation analyzer) via Cortex. Returns the job report if successful.
    *   **Parameters**:
        *   `ip` (string, required): The IP address to analyze.
        *   `analyzer_name` (string, optional): The specific name of the AbuseIPDB analyzer instance in Cortex. Defaults to `AbuseIPDB_1_0`.
        *   `max_retries` (integer, optional): Maximum number of times to poll for the analyzer job to complete. Defaults to 5.

2.  **`analyze_with_abusefinder`**
    *   **Description**: Analyzes various types of data (IP, domain, FQDN, URL, or email) using an AbuseFinder analyzer via Cortex. Returns the job report if successful.
    *   **Parameters**:
        *   `data` (string, required): The data to analyze (e.g., "1.1.1.1", "example.com", "http://evil.com/malware", "[email protected]").
   
…