PlugWiki

Cortex MCP Server: Setup for Claude and Other Apps

OfficialLocal
GetDocs
Tools
6
6 read · 0 change
Works in
12
apps
Risk
Medium
can write
Auth
API key

Lets Claude and other assistants look up cases, issues, assets, endpoints and compliance results in Cortex XSIAM, XDR and Cortex Cloud.

This is Palo Alto Networks' MCP server for Cortex. You download it from your own tenant, then run it yourself in Docker or a Python 3.13+ environment. It talks to your tenant's public API with an API key you create.

The docs list 6 built-in tools and say the list is not exhaustive. They only retrieve information. Write actions, such as adding a note to a case, come from custom tools you add yourself. The API key itself can read and write, so give it a narrow role.

Good for

  • SOC analysts who triage cases and issues in plain language
  • Security engineers who investigate assets and endpoints
  • Teams that already run Cortex XSIAM and want an assistant on top

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Cortex MCP

Any client

  1. 1

    In Cortex XSIAM go to Settings, Configurations, Integrations, Cortex MCP Server and download the MCP file.

  2. 2

    Optional: check the download with the checksum file, then extract the .zip.

  3. 3

    Create an API key under Settings, Configurations, Integrations, API Keys, with Standard security level and a least-privilege role.

  4. 4

    Copy the API URL, API key and API key ID before you close the notice. The key is shown once.

  5. 5

    Follow the README in the extracted folder to create the .env file and build the image.

  6. 6

    Run the container with the command docker run --env-file .env -it cortex-mcp, or start it with Poetry.

  7. 7

    Point your MCP client at the server. The Cortex docs use Claude Desktop as the example.

Requires Docker, or Python 3.13+ with Poetry, A Cortex XSIAM tenant.

Read-only mode: There is no documented read-only switch. Give the API key a narrow role, such as the Viewer role that the setup link preselects.

The server is not on a public registry. You download it from your own tenant, so the install box cannot give a one-line command. It uses stdio by default, and Streamable HTTP is optional. The Docker .env file takes the same CORTEX_MCP_PAPI_ variables as the Poetry config. Use the .env file for the API credentials because Palo Alto recommends it over putting them in the client config.

From the vendor's docs. Source.

Tools

  • Lists assets, with optional filters

    Fetches all assets or a filtered set, for example by category, region or provider.

    Try: “List my assets from one cloud provider in one region.”

    Network · get_assets

  • Shows one asset in detail

    Fetches the detailed record for the asset with the ID you give.

    Try: “Give me the details for asset ID 4821.”

    Network · get_assets_by_id

  • Lists cases, with optional filters

    Fetches all cases or a filtered set, for example by domain, status, severity or a specific case ID.

    Try: “Show me the ten most critical open cases.”

    Network · get_cases

  • Lists issues, with optional filters

    Fetches all issues or a filtered set, for example by domain, severity, detection method or a specific issue ID.

    Try: “List the high severity issues in my tenant.”

    Network · get_issues

  • Fetches compliance assessment results

    Fetches the results of all or some compliance assessments from the Cortex platform.

    Try: “Show the results of my compliance assessments.”

    Network · get_assessment_profile_results

  • Lists endpoints managed by XDR agents

    Fetches a filtered list of endpoints managed by the XDR agents, filtered by endpoint status, agent status and other fields.

    Try: “Which endpoints have a disconnected XDR agent?”

    Network · get_filtered_endpoints

From the official docs

Permissions

medium risk · 4 things to watch

Medium risk

The API key can read and change data in your Cortex tenant. Create it with a least-privilege role and an expiry date.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • Built-in tools read; custom tools can write

    Palo Alto says the built-in tools retrieve information and do not write to the tenant. You can add custom tools that do write, and its own examples include isolating an endpoint and adding a case note. Review any custom tool before you load it. cortex-docs.paloaltonetworks.com

  • The API key can read and write

    Palo Alto warns that the key has both read and write capabilities. Give it the least-privilege role and set an expiry date. cortex-docs.paloaltonetworks.com

  • Queries count against your license quotas

    The server uses public APIs and is limited by your tenant's license quotas, especially for XQL queries. cortex-docs.paloaltonetworks.com

  • The key is shown only once

    Copy the API key and key ID when you create them. You cannot view the key again. cortex-docs.paloaltonetworks.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details
Turning on read-onlyNo read-only mode is documented. Limit the API key with a narrow role. The setup link preselects Standard security level, the Viewer role and an expiry date.
Talks toYour Cortex tenant's public API
Sign-in and keysCortex API URL, API key and API key ID, kept in a .env file for Docker or in the Python environment.
Scopes

  • The role you give the API key, from predefined or custom roles

Questions

Where do I get the Cortex MCP server?

Download it from your own tenant. Go to Settings, Configurations, Integrations, Cortex MCP Server. The download is a zip with a README, and Palo Alto offers a checksum file to verify it.

Does it run locally or is it hosted?

It runs where you start it, in a Docker container or a Poetry virtual environment. The Poetry route needs Python 3.13 or higher. It uses stdio by default, and Streamable HTTP is optional.

What credentials does it need?

It needs the Cortex API URL, an API key and the API key ID. Create the key in Settings, Configurations, Integrations, API Keys, and copy it right away because it is shown once.

What role should the API key have?

The narrowest role that does the job. Palo Alto warns the key has read and write capabilities. The setup link preselects the Viewer role, Standard security level and an expiration date.

Which apps does it work with?

Any app that supports MCP. The Cortex docs use Claude Desktop as the example.

Does it have limits?

Yes. It uses the public APIs, so your tenant's license quotas apply, especially to XQL queries.

Which tools does it have?

Six built-in tools are documented: get_assets, get_assets_by_id, get_cases, get_issues, get_assessment_profile_results and get_filtered_endpoints. Palo Alto says the list is not exhaustive, and the update command downloads new tools.

Can it change anything in my tenant?

Not with the built-in tools, which only retrieve information. Palo Alto says writes come from custom tools you build with OpenAPI or Python. The API key itself can read and write, so limit its role.

Information

updated Nov 1, 2026

Publisher
Official
Transport
stdio, Streamable HTTP
Auth
API key

Cortex XSIAMDocsConfigure the MCP client

Other Palo Alto Networks MCP servers

See all

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 4
  1. Install the Cortex MCP server · cortex-docs.paloaltonetworks.com
  2. cortex-docs.paloaltonetworks.com · cortex-docs.paloaltonetworks.com
  3. cortex-docs.paloaltonetworks.com · cortex-docs.paloaltonetworks.com
  4. cortex-docs.paloaltonetworks.com · cortex-docs.paloaltonetworks.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 1, 2026.