Upstream Service Integration -- cortex

May 30, 2026 · View on GitHub

Self-contained architecture

cortex has no upstream API dependency. Unlike other MCP servers that wrap an external service (Plex, Overseerr, Gotify), cortex is the service. It receives syslog messages directly via UDP/TCP, stores them in SQLite, and exposes them through MCP tools.

                No upstream API
                      ↓
  Syslog sources ──▶ cortex ──▶ MCP clients
  (rsyslog, UniFi,    (receiver +     (Claude Code,
   ATT router, etc.)   query server)   Codex, Gemini)

Inbound data sources

Instead of an upstream API, cortex receives data from syslog sources:

SourceProtocolConfiguration
Linux hosts (rsyslog)TCP or UDP/etc/rsyslog.d/99-remote.conf
WSL hostsTCP or UDPrsyslog with Tailscale IP
UniFi Cloud GatewayUDPSettings > System > Remote Syslog
ATT BGW-320 RouterUDPDiagnostics > Syslog > Remote Syslog

See SETUP.md for per-host configuration.

Syslog protocol support

StandardSupport
RFC 3164 (BSD syslog)Full -- parsed by syslog_loose
RFC 5424 (IETF syslog)Full -- parsed by syslog_loose
UniFi CEF (Common Event Format)Partial -- hostname extracted from UNIFIdeviceName extension

The syslog_loose crate performs lenient parsing that tolerates non-compliant messages common in homelab environments.

Trust boundary

Syslog content is untrusted user-controlled data:

  • hostname: claimed by the sender, spoofable via UDP
  • message, app_name: arbitrary text from the sending device
  • source_ip: actual network sender address (the only trustworthy identity)

All query parameters are SQL-parameterized. FTS5 queries use their own DSL (not SQL), preventing injection.

No outbound credentials

cortex reads no _URL, _API_KEY, or similar environment variables for upstream connectivity. The only credential is the optional CORTEX_TOKEN for inbound MCP authentication.

Cross-references