Syslog MCP server

Cortex

Self-hosted homelab log intelligence over MCP, CLI, and REST with SQLite/FTS.

It collects logs and operational evidence, stores them in SQLite with FTS5 search, and exposes one shared intelligence layer through CLI, REST, MCP, and a bundled browser workspace.

Cortex began as a syslog receiver. It now covers network logs, Docker, managed files, OpenTelemetry logs, metrics, and traces, host heartbeats, fleet inventory, shell and agent activity, and Claude, Codex, Gemini CLI, and Antigravity transcripts. It correlates those sources into timelines, incidents, and an evidence-backed topology graph without making the graph a second source of truth.

At a glance

[!IMPORTANT]

Cortex is designed for a trusted homelab or small private fleet. It is not a clustered log warehouse, a general-purpose SIEM, or a safe place to expose unauthenticated administrative surfaces to the public internet.

Contents

• Quick start
• How Cortex is built
• Ingestion
• Investigation and intelligence
• Fleet inventory and graph
• AI session intelligence
• Alerts and notifications
• Interfaces
• Configuration
• Authentication and trust boundaries
• Storage and maintenance
• Deployment and distribution

Quick start

Install the CLI

The first-class guided path is:

npx skills add dinglebear-ai/cortex --skill install-cortex

Start a fresh agent task and invoke $install-cortex. It chooses server or client-only role, delegates to the canonical installer/setup engine, configures auth/network/storage, and verifies the live client connection.

Shortened. The full README is on GitHub.