cortex

Name: cortex
Author: dinglebear-ai

bydinglebear-ai· 6 MCP servers

Stars

Forks

How to install cortex?

dinglebear-ai/cortex

$git clone https://github.com/dinglebear-ai/cortex

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install cortex by running `git clone https://github.com/dinglebear-ai/cortex`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/cortex.

Files · 1

View on GitHub

README.md

1	# cortex
2
3	[![crates.io](https://img.shields.io/crates/v/cortex)](https://crates.io/crates/cortex) [![ghcr.io](https://img.shields.io/badge/ghcr.io-jmagar%2Fcortex-blue?logo=docker)](https://github.com/jmagar/cortex/pkgs/container/cortex)
4
5	Rust syslog receiver and MCP server for homelab log intelligence. Ingests syslog over UDP and TCP, stores it in SQLite with FTS5 full-text indexing, and exposes action-based log search, inventory, correlation, status, and analysis tools through MCP, REST, and CLI adapters backed by the shared service layer.
6
7	cortex also maintains derived projection tables for the investigation graph.
8	Those graph tables connect source IPs, claimed hosts, apps, canonical
9	services, containers, AI projects/sessions, and error signatures with
10	evidence, but raw logs, heartbeats, inventory, signatures, and session rows
11	remain the source of truth. The graph projection is rebuildable and
12	intentionally has no ingest triggers. Graph rebuilds use staging tables plus
13	a short serialized swap and record explicit projection status, source
14	watermarks, row counts, runtime metrics, and degraded failure state.
15
16	Service identity is resolver-backed: searching `plex` resolves the logical
17	service first (`logical_service:plex`), then concrete service instances such
18	as `service_instance:tootie/plex`. Cortex no longer treats `tootie:plex` or
19	`tootie:plex:plex` as canonical service identities — those legacy shapes are
20	rejected with `rejected_legacy_shape` (see
21	`openwiki/inventory-graph.md`, "Canonical Resolver Proof: Plex").
22
23	## Contents
24
25	- [Naming](#naming)
26	- [Capabilities And Boundaries](#capabilities-and-boundaries)
27	- [Install](#install)
28	- [Quickstart](#quickstart)
29	- [Client Configuration](#client-configuration)
30	- [Runtime Surfaces](#runtime-surfaces)
31	- [MCP Tool Reference](#mcp-tool-reference)
32	- [CLI Reference](#cli-reference)
33	- [Configuration](#configuration)
34	- [Authentication](#authentication)
35	- [Safety And Trust Model](#safety-and-trust-model)
36	- [Architecture](#architecture)
37	- [Distribution Contract](#distribution-contract)
38	- [Development](#development)
39	- [Verification](#verification)
40	- [Deployment](#deployment)
41	- [Troubleshooting](#troubleshooting)
42	- [Documentation](#documentation)
43	- [Related Servers](#related-servers)
44	- [License](#license)
45
46	## Naming
47
48	Cortex keeps its repo and CLI name as `cortex`. The npm package is
49	`cortex-rmcp`, because Cortex is broader than only an MCP server. The MCP
50	registry name is `tv.tootie/cortex`, and the Docker image is
51	`ghcr.io/jmagar/cortex:v<version>`.
52
53	Most smaller Rust MCP servers in this workspace use the
54	`<service>-rmcp` repo / `r<service>` binary / `<service>-rmcp` npm pattern.
55	Cortex is the deliberate exception: repo `cortex`, CLI `cortex`, npm package
56	`cortex-rmcp`.
57
58	## Capabilities And Boundaries
59
60	Cortex ingests syslog, OTLP, Docker, managed file-tail, inventory, heartbeat,
61	and AI-session signals into SQLite, then exposes bounded investigation actions
62	through MCP, REST, and CLI adapters backed by the same service layer.
63
64	Primary capabilities:
65
66	- UDP and TCP syslog receiver on port `1514`.
67	- SQLite + FTS5 log storage with retention and storage-budget controls.
68	- MCP action surface for search, filtering, timelines, errors, context,
69	inventory, graph, AI-session correlation, and incident evidence bundles.
70	- REST and CLI adapters for operational workflows and local automation.
71	- Optional MCP Apps query widget for MCP hosts that support UI resources.
72	- Derived graph projection tables for topology and investigation workflows.
73
74	Not for: replacing a SIEM, accepting arbitrary unaudited log mutations from
75	agents, or exposing Docker/admin operations without a trusted deployment
76	boundary. Cortex is a homelab log-intelligence service with bounded action
77	surfaces and explicit admin gates.
78
79	MCP callers never provide credentials, tokens, keys, or secrets as action
80	arguments. Auth tokens, upstream notification secrets, file-tail roots, and API
81	admin credentials live in server configuration or environment variables.
82
83	## Install
84
85	Use the npm launcher for local MCP clients and quick CLI access:
86
87	```bash
88	npx -y cortex-rmcp --help
89	npx -y cortex-rmcp mcp
90	```
91
92	For a permanent command on `PATH`, install the launcher globally:
93
94	```bash
95	npm i -g cortex-rmcp
96	cortex --version
97	```
98
99	The package downloads the matching GitHub Release binary during `postinstall`.
100	For source builds:
101
102	```bash
103	cargo build --release
104	```
105
106	## Quickstart
107
108	The first-screen 30-second path is a stdio MCP client pointed at the launcher:
109
110	```json
111	{
112	"mcpServers": {
113	"cortex": {
114	"command": "npx",
115	"args": ["-y", "cortex-rmcp", "mcp"]
116	}
117	}
118	}
119	```
120
121	Then ask for a cheap read action first:
122
123	```json
124	{"action":"status"}
125	```
126
127	For an HTTP server with syslog listeners:
128
129	```bash
130	export CORTEX_API_TOKEN=change-me
131	export CORTEX_TOKEN=change-me
132	cortex serve mcp
133	```
134
135	## Client Configuration
136
137	stdio launches a query-only MCP process that reads the configured Cortex
138	database without starting network listeners:
139
140	```json
141	{

6 picks

Type

cortex

bydinglebear-ai· 6 MCP servers

Stars

Forks

How to install cortex?

dinglebear-ai/cortex

$git clone https://github.com/dinglebear-ai/cortex

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install cortex by running `git clone https://github.com/dinglebear-ai/cortex`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/cortex.

Files · 1

View on GitHub

README.md

1	# cortex
2
3	[![crates.io](https://img.shields.io/crates/v/cortex)](https://crates.io/crates/cortex) [![ghcr.io](https://img.shields.io/badge/ghcr.io-jmagar%2Fcortex-blue?logo=docker)](https://github.com/jmagar/cortex/pkgs/container/cortex)
4
5	Rust syslog receiver and MCP server for homelab log intelligence. Ingests syslog over UDP and TCP, stores it in SQLite with FTS5 full-text indexing, and exposes action-based log search, inventory, correlation, status, and analysis tools through MCP, REST, and CLI adapters backed by the shared service layer.
6
7	cortex also maintains derived projection tables for the investigation graph.
8	Those graph tables connect source IPs, claimed hosts, apps, canonical
9	services, containers, AI projects/sessions, and error signatures with
10	evidence, but raw logs, heartbeats, inventory, signatures, and session rows
11	remain the source of truth. The graph projection is rebuildable and
12	intentionally has no ingest triggers. Graph rebuilds use staging tables plus
13	a short serialized swap and record explicit projection status, source
14	watermarks, row counts, runtime metrics, and degraded failure state.
15
16	Service identity is resolver-backed: searching `plex` resolves the logical
17	service first (`logical_service:plex`), then concrete service instances such
18	as `service_instance:tootie/plex`. Cortex no longer treats `tootie:plex` or
19	`tootie:plex:plex` as canonical service identities — those legacy shapes are
20	rejected with `rejected_legacy_shape` (see
21	`openwiki/inventory-graph.md`, "Canonical Resolver Proof: Plex").
22
23	## Contents
24
25	- [Naming](#naming)
26	- [Capabilities And Boundaries](#capabilities-and-boundaries)
27	- [Install](#install)
28	- [Quickstart](#quickstart)
29	- [Client Configuration](#client-configuration)
30	- [Runtime Surfaces](#runtime-surfaces)
31	- [MCP Tool Reference](#mcp-tool-reference)
32	- [CLI Reference](#cli-reference)
33	- [Configuration](#configuration)
34	- [Authentication](#authentication)
35	- [Safety And Trust Model](#safety-and-trust-model)
36	- [Architecture](#architecture)
37	- [Distribution Contract](#distribution-contract)
38	- [Development](#development)
39	- [Verification](#verification)
40	- [Deployment](#deployment)
41	- [Troubleshooting](#troubleshooting)
42	- [Documentation](#documentation)
43	- [Related Servers](#related-servers)
44	- [License](#license)
45
46	## Naming
47
48	Cortex keeps its repo and CLI name as `cortex`. The npm package is
49	`cortex-rmcp`, because Cortex is broader than only an MCP server. The MCP
50	registry name is `tv.tootie/cortex`, and the Docker image is
51	`ghcr.io/jmagar/cortex:v<version>`.
52
53	Most smaller Rust MCP servers in this workspace use the
54	`<service>-rmcp` repo / `r<service>` binary / `<service>-rmcp` npm pattern.
55	Cortex is the deliberate exception: repo `cortex`, CLI `cortex`, npm package
56	`cortex-rmcp`.
57
58	## Capabilities And Boundaries
59
60	Cortex ingests syslog, OTLP, Docker, managed file-tail, inventory, heartbeat,
61	and AI-session signals into SQLite, then exposes bounded investigation actions
62	through MCP, REST, and CLI adapters backed by the same service layer.
63
64	Primary capabilities:
65
66	- UDP and TCP syslog receiver on port `1514`.
67	- SQLite + FTS5 log storage with retention and storage-budget controls.
68	- MCP action surface for search, filtering, timelines, errors, context,
69	inventory, graph, AI-session correlation, and incident evidence bundles.
70	- REST and CLI adapters for operational workflows and local automation.
71	- Optional MCP Apps query widget for MCP hosts that support UI resources.
72	- Derived graph projection tables for topology and investigation workflows.
73
74	Not for: replacing a SIEM, accepting arbitrary unaudited log mutations from
75	agents, or exposing Docker/admin operations without a trusted deployment
76	boundary. Cortex is a homelab log-intelligence service with bounded action
77	surfaces and explicit admin gates.
78
79	MCP callers never provide credentials, tokens, keys, or secrets as action
80	arguments. Auth tokens, upstream notification secrets, file-tail roots, and API
81	admin credentials live in server configuration or environment variables.
82
83	## Install
84
85	Use the npm launcher for local MCP clients and quick CLI access:
86
87	```bash
88	npx -y cortex-rmcp --help
89	npx -y cortex-rmcp mcp
90	```
91
92	For a permanent command on `PATH`, install the launcher globally:
93
94	```bash
95	npm i -g cortex-rmcp
96	cortex --version
97	```
98
99	The package downloads the matching GitHub Release binary during `postinstall`.
100	For source builds:
101
102	```bash
103	cargo build --release
104	```
105
106	## Quickstart
107
108	The first-screen 30-second path is a stdio MCP client pointed at the launcher:
109
110	```json
111	{
112	"mcpServers": {
113	"cortex": {
114	"command": "npx",
115	"args": ["-y", "cortex-rmcp", "mcp"]
116	}
117	}
118	}
119	```
120
121	Then ask for a cheap read action first:
122
123	```json
124	{"action":"status"}
125	```
126
127	For an HTTP server with syslog listeners:
128
129	```bash
130	export CORTEX_API_TOKEN=change-me
131	export CORTEX_TOKEN=change-me
132	cortex serve mcp
133	```
134
135	## Client Configuration
136
137	stdio launches a query-only MCP process that reads the configured Cortex
138	database without starting network listeners:
139
140	```json
141	{

6 picks

Type

cortex

How to install cortex?

Related

cortex

How to install cortex?

Related