Cortex MCP server
{
"mcpServers": {
"dinglebear-cortex": {
"command": "npx",
"args": [
"-y",
"@dinglebear/cortex@latest"
],
"env": {
"CORTEX_TOKEN": "<cortex_token>",
"CORTEX_API_TOKEN": "<cortex_api_token>",
"CORTEX_API_ADMIN_TOKEN": "<cortex_api_admin_token>",
"CORTEX_URL": "https://...",
"CORTEX_DB_PATH": "/path/to/directory",
"CORTEX_PUBLIC_URL": "https://..."
}
}
}
}{
"mcpServers": {
"dinglebear-cortex": {
"command": "npx",
"args": [
"-y",
"@dinglebear/cortex@latest"
],
"env": {
"CORTEX_TOKEN": "<cortex_token>",
"CORTEX_API_TOKEN": "<cortex_api_token>",
"CORTEX_API_ADMIN_TOKEN": "<cortex_api_admin_token>",
"CORTEX_URL": "https://...",
"CORTEX_DB_PATH": "/path/to/directory",
"CORTEX_PUBLIC_URL": "https://..."
}
}
}
}{
"mcpServers": {
"dinglebear-cortex": {
"command": "npx",
"args": [
"-y",
"@dinglebear/cortex@latest"
],
"env": {
"CORTEX_TOKEN": "<cortex_token>",
"CORTEX_API_TOKEN": "<cortex_api_token>",
"CORTEX_API_ADMIN_TOKEN": "<cortex_api_admin_token>",
"CORTEX_URL": "https://...",
"CORTEX_DB_PATH": "/path/to/directory",
"CORTEX_PUBLIC_URL": "https://..."
}
}
}
}{
"servers": {
"dinglebear-cortex": {
"command": "npx",
"args": [
"-y",
"@dinglebear/cortex@latest"
],
"env": {
"CORTEX_TOKEN": "${input:cortex_token}",
"CORTEX_API_TOKEN": "${input:cortex_api_token}",
"CORTEX_API_ADMIN_TOKEN": "${input:cortex_api_admin_token}",
"CORTEX_URL": "${input:cortex_url}",
"CORTEX_DB_PATH": "${input:cortex_db_path}",
"CORTEX_PUBLIC_URL": "${input:cortex_public_url}"
}
}
},
"inputs": [
{
"id": "cortex_token",
"type": "promptString",
"description": "Cortex token",
"password": true
},
{
"id": "cortex_api_token",
"type": "promptString",
"description": "Cortex api token",
"password": true
},
{
"id": "cortex_api_admin_token",
"type": "promptString",
"description": "Cortex api admin token",
"password": true
},
{
"id": "cortex_url",
"type": "promptString",
"description": "Cortex url",
"password": true
},
{
"id": "cortex_db_path",
"type": "promptString",
"description": "Cortex db path",
"password": true
},
{
"id": "cortex_public_url",
"type": "promptString",
"description": "Cortex public url",
"password": true
}
]
}{
"mcpServers": {
"dinglebear-cortex": {
"command": "npx",
"args": [
"-y",
"@dinglebear/cortex@latest"
],
"env": {
"CORTEX_TOKEN": "<cortex_token>",
"CORTEX_API_TOKEN": "<cortex_api_token>",
"CORTEX_API_ADMIN_TOKEN": "<cortex_api_admin_token>",
"CORTEX_URL": "https://...",
"CORTEX_DB_PATH": "/path/to/directory",
"CORTEX_PUBLIC_URL": "https://..."
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @dinglebear/cortexversion 3.13.2
What it does
Cortex is a self-hosted log aggregation and intelligence platform that collects logs from syslog, Docker, files, OpenTelemetry, and AI sessions into a SQLite database with full-text search. It exposes search, timeline, correlation, and fleet inventory features through MCP, CLI, and REST interfaces for homelab and small private fleet operators.
- Search and correlate logs from multiple sources (syslog, Docker, OTel) to investigate incidents and track timelines.
- Build and query a fleet inventory graph showing host state, service topology, and container relationships across SSH and API collectors.
- Index and retrieve Claude, Codex, Gemini, and Antigravity AI session transcripts alongside operational logs for correlated investigation.
Tools this server exposes
| Tool | Does |
|---|---|
| tail | Retrieve recent log entries with optional limit filtering. |
| errors | Query logs for error entries and patterns. |
| search | Full-text search across all indexed logs using FTS5. |
| timeline | Construct time-ordered sequences of log events for incident investigation. |
| context | Retrieve surrounding log entries and related metadata for a given log event. |
| status | Report the current state and health of the Cortex server. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.