System requirements - MCP integrations require the latest demisto:mcp Docker image and must contain certain commands. - Developer Guide - Cortex - Cortex - Security Operations

MCP Integration Contributor Guide
Product
Cortex
Creation date
2026-05-20
Last date published
2026-05-20
Category
Developer Guide
Abstract

MCP integrations require the latest demisto:mcp Docker image and must contain certain commands.

Every MCP integration must set script.mcp: true in the integration YAML and use the latest demisto:mcp Docker image.

MCP integrations must expose three core commands:

test-module (built-in)

  • Triggered by the Test button in the integration configuration UI.

  • For token/bearer/basic auth: Calls client.test_connection() to verify connectivity.

  • For OAuth auth: Raises DemistoException directing users to use the auth-test command instead.

  • Returns ok on success.

list-tools (hidden command)

  • Retrieves all available tools from the MCP server.

  • Takes no arguments.

  • Returns a list of tool names and descriptions.

  • Hidden from the UI. The system calls this periodically to discover tools.

  • Results are used to auto-generate agentic actions.

call-tool (hidden command)

  • Executes a specific tool on the MCP server.

  • Arguments:

    • name: (Required) The tool name to execute.

    • arguments: (Optional) JSON string of parameters for the tool.

  • Returns the tool’s execution result.

  • Hidden from the UI. The system calls this when an agent uses a tool.

OAuth integrations

OAuth integrations add two additional commands:

<prefix>-auth-test

  • Tests OAuth authentication after the user provides an authorization code.

  • Only included when auth type is OAuth (Authorization Code, Client Credentials, or Dynamic Client Registration).

<prefix>-generate-login-url

  • Generates the OAuth login URL for the user to authorize the integration.

  • Only included when auth type is OAuth.