Cortex XCOR MCP server tools

The Palo Alto Networks Cortex XCOR MCP server supports the tools in the following table. After authenticating, you can submit read-only queries to Cortex XCOR from within your code editor.

Get tools

The following tools return individual resources, such as a single dashboard, monitor, or log.

Tool type	Endpoint	Description
API	`get_classic_dashboard`	Get classic dashboards tools.
API	`get_dashboard`	Get dashboards tools.
API	`get_drop_rule`	Get drop rules tools.
API	`get_mapping_rule`	Get mapping rules tools.
API	`get_monitor`	Get monitors tools.
API	`get_notification_policy`	Get notification policies tools.
API	`get_recording_rule`	Get recording rules tools.
API	`get_rollup_rule`	Get rollup rules tools.
API	`get_slo`	Get SLO tools.
Events	`get_events_metadata`	List properties you can query on events.
Logs	`get_log`	Get a full log message by its ID. The ID is the unique identifier for the log.
Logs	`get_log_histogram`	Get histogram of logs from a given query.

List tools

The following tools list multiple resources, such as a list of all available dashboards, monitors, and log field names.

Tool type	Endpoint	Description
API	`list_classic_dashboards`	List classic dashboards tools.
API	`list_dashboards`	List dashboards tools.
API	`list_drop_rules`	List drop rules tools.
API	`list_mapping_rules`	List mapping rules tools.
API	`list_metric_usages_by_label_name`	List metric usage statistics grouped by label name. Use this tool to find unused or high-cardinality labels that could be dropped.
API	`list_metric_usages_by_metric_name`	List metric usage statistics grouped by metric name. Use this tool to find unused or underutilized metrics that could be dropped to reduce costs.
API	`list_monitors`	List monitors tools.
API	`list_notification_policies`	List notification policies tools.
API	`list_recording_rules`	List recording rules tools.
API	`list_rollup_rules`	List rollup rules tools.
API	`list_rule_evaluations`	List rule evaluation issues for monitors and recording rules so you can identify rules that are failing or having problems.
API	`list_slo`	List SLO tools.
Events	`list_events`	List events from a given query.
Events	`list_events_label_values`	List values for a given label name.
Logs	`list_log_field_names`	List field names of logs.
Logs	`list_log_field_values`	List field values of logs.
Monitors	`list_monitor_statuses`	Lists the current status of all monitors. Returns monitor statuses with alert states and optional signal and series details.
Metrics	`list_prometheus_label_names`	Returns the list of label names (keys) available on metrics that match the given selectors. Use this tool when you need to discover what labels are available on specific metrics or services.
Metrics	`list_prometheus_label_values`	Returns the list of values for a specific label name, optionally filtered by selectors. Use this tool when you know the label name and want to discover what values it has across your metrics.
Metrics	`list_prometheus_series`	Returns the complete time series (full label sets with all key-value pairs) that match the given selectors. Each result shows the exact combination of labels for an active time series.
Metrics	`list_prometheus_series_metadata`	Returns metadata for the given metric in the form of `type`, `help`, and `unit`.
Traces	`list_traces`	List traces from a given query.

Query tools

The following tools run a query for a particular data type, such as a query for log data.

Tool type	Endpoint	Description
Logs	`query_logs_range`	Execute a range query for logs. This endpoint returns logs as either `timeSeries` or `gridData`. This query might return a large amount of data, so use a shorter range such as one hour.
Metrics	`query_prometheus_instant`	Evaluates a Prometheus instant query at a single point in time.
Metrics	`query_prometheus_range`	Executes a Prometheus PromQL query over a specified time range and returns time series data points in JSON format. Supports standard PromQL syntax plus Cortex XCOR custom functions.
Metrics	`render_prometheus_range_query`	Evaluates a Prometheus expression query over a range of time and renders it as a PNG image.

Customize available tools

By default, the Cortex XCOR MCP server exposes all available tools to your MCP client. You can use the X-Chrono-MCP-Disable-Tools header to selectively hide specific tools from your client’s tool list. The header accepts a comma-separated list of tool names. Tool names must match the endpoint names listed in the tools table on this page. Whitespace between entries is ignored, and unknown tool names are silently ignored.

Claude Code

To disable specific tools when using Claude Code, include the X-Chrono-MCP-Disable-Tools header when adding the MCP server:

claude mcp add --transport http chronosphere "https://TENANT.chronosphere.io/api/mcp/mcp" \
--header "Authorization: API_TOKEN" \
--header "X-Chrono-MCP-Disable-Tools: TOOLS"

Replace the following:

TENANT: The name of your Cortex XCOR tenant.
API_TOKEN: The API token generated from your service account. Cortex XCOR recommends storing your API token in a separate file or Kubernetes Secret and calling it using an environment variable, such as $API_TOKEN.
TOOLS: A comma-separated list of tool names you want to hide. For example:
query_logs_range, render_prometheus_range_query

To expose all tools, omit the X-Chrono-MCP-Disable-Tools header from the command.

Cursor

To disable specific tools when using Cursor, add the X-Chrono-MCP-Disable-Tools header to the headers section in your mcp.json file:

{
  "mcpServers": {
    "chronosphere": {
      "url": "https://TENANT.chronosphere.io/api/mcp/mcp",
      "headers": {
        "Authorization": "Bearer API_TOKEN",
        "X-Chrono-MCP-Disable-Tools": "TOOLS"
      }
    }
  }
}

Replace the following:

TENANT: The name of your Cortex XCOR tenant.
API_TOKEN: The API token generated from your service account. Cortex XCOR recommends storing your API token in a separate file or Kubernetes Secret and calling it using an environment variable, such as $API_TOKEN.
TOOLS: A comma-separated list of tool names you want to hide. For example:
query_logs_range, render_prometheus_range_query

To expose all tools, remove the X-Chrono-MCP-Disable-Tools line from the headers section.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Get tools

List tools

Query tools

Customize available tools

Claude Code

Cursor

​Get tools

​List tools

​Query tools

​Customize available tools

​Claude Code

​Cursor

Get tools

List tools

Query tools

Customize available tools

Claude Code

Cursor