Authenticate with the Cortex XCOR MCP server

Palo Alto Networks Cortex XCOR provides two MCP servers:

• Cortex XCOR MCP server: Connects to your tenant and requires authentication.
• Documentation MCP server: Serves public Cortex XCOR documentation and does not require authentication.

Before you can use the Cortex XCOR MCP server, authenticate with the MCP client you use to access a large language model (LLM). Use one of the following options to configure authentication:

• Generate a Cortex XCOR API token, either through a personal access token or a service account.
• Use OAuth. To use the Cortex XCOR MCP server with OAuth, your MCP client must support OAuth.
  OAuth authentication with the Cortex XCOR MCP server has been tested with the following MCP clients only.

The following steps explain how to authenticate with popular AI-powered code editors. After authenticating, you can use the LLM features in your code editor to interact with the Cortex XCOR MCP server tools.

​

Prerequisites

If you’re authenticating your MCP client with a Cortex XCOR API token, use one of the following options to generate one:

• Personal access: Create a personal access token to authenticate your user account with Cortex XCOR. When you authenticate with a personal access token, Cortex XCOR associates the actions you take with your identity and respects the permissions granted to your user account’s team.
• Programmatic access: Create an unrestricted service account to create a persistent identity for a service or agent that you want to authenticate with your MCP client. You must have administrative access to create a service account.

​

Authenticating using Claude Code

To authenticate with the Cortex XCOR MCP server from Claude Code, add the MCP server as a remote HTTP server.

1. From within Claude Code, run the following commands to add the Cortex XCOR MCP server and the public documentation MCP server:
   claude mcp add --transport http chronosphere "https://TENANT.chronosphere.io/api/mcp/mcp" \
   --header "Authorization: Bearer API_TOKEN"
   claude mcp add --transport http chronosphere-docs "https://docs.chronosphere.io/mcp"
   
   Replace the following for the Cortex XCOR MCP server:
   To authenticate using OAuth instead of a Cortex XCOR API token, omit the --header flag. You can also use the /mcp command to authenticate with OAuth authentication.
2. Test your connection with the Cortex XCOR MCP server:
   claude mcp get chronosphere
   

The command returns the details for the Cortex XCOR MCP server.

​

Authenticating using Cursor

To authenticate with the Cortex XCOR MCP server from Cursor, modify the mcp.json file to include the Cortex XCOR MCP server remote endpoint.

1. From within Cursor, access the mcp.json file.
2. Add the following configuration to the mcp.json file to add the Cortex XCOR MCP server and the public documentation MCP server:
   {
     "mcpServers": {
       "chronosphere": {
         "url": "https://TENANT.chronosphere.io/api/mcp/mcp",
         "headers": {
           "Authorization": "Bearer API_TOKEN"
         }
       },
       "chronosphere-docs": {
         "url": "https://docs.chronosphere.io/mcp"
       }
     }
   }
   
   Replace the following for the Cortex XCOR MCP server:
   To authenticate using OAuth instead of a Cortex XCOR API token, omit the headers section from the configuration.
3. Save and close the mcp.json file.
4. Refresh the MCP server settings in Cursor.

The Cortex XCOR MCP server and documentation MCP server display in the list of configured MCP servers.