The cognitive substrate that decides. Your stack executes.

The push model in 60 seconds

Register a handler URL once. When Cortex decides an action should happen (rule fires, trust threshold crossed, commitment going stale, pattern matched), it HMAC-signs an envelope and POSTs to your URL. You verify the signature, execute through your app's native channels, and call back. Trust compounds per (user × counterparty × action class). Full contract: Trigger dispatch and the framework recipes at Recipes (Trigger.dev, n8n, Zapier, custom-webhook, MCP-executor).

What you get

Five primitives, callable over one protocol, with full provenance and a per-(action class × counterparty) trust ledger underneath:

• Memory. A unified retrieval surface across episodes, conversations, knowledge-graph entities, and rules. One memory.recall call, ranked results.
• Rules. A behavioral rulebook with lifecycle — candidate, active, suspended, retired. New rules require user confirmation by design, so the rulebook can't be poisoned by prompt injection.
• Trust. Earned per-pair autonomy, not a global “trust this AI” switch. Read the current level, graduate a pair you've earned, and let reversals demote it automatically.
• Action. Send-class operations route through the action engine and either execute, return pending_approval with a decision id resolvable via pull-mode action.approve / action.reject, or dispatch a trigger to your registered handler (push-mode).
• Dispatch. Register a handler URL, receive signed triggers when the substrate decides, call back trigger.complete / trigger.reverse. ADR-0019. The push complement to the four pull primitives above.

One-minute connect

Point Claude Desktop, Cursor, or any MCP-capable client at the local dev server. (Full setup with token issuance in the Quickstart.)

{
  "mcpServers": {
    "cortex": {
      "url": "http://localhost:3002/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_BEARER_TOKEN"
      }
    }
  }
}

The surface, today

70 tools across the full vision — 44 live in code today, 12 ship July 20, 2026 (action approval + trigger dispatch), 8 ship V1.x+ (cross-app routing engine, narrative summarization, identity preferences, additional feedback signal kinds), and 1 ship V2 (Trusted Delegate, full delegate flows). No MCP resources or prompts — this surface is tools-only by design.

The substrate read API (added 2026-05-27 evening per explainability, counterparty depth, commitments, patterns, identity, capability discovery, subscriptions, routing read-preview, feedback learning, extension action classes) is what makes the cognitive-substrate positioning externally verifiable. The runtime self-description is agent.capabilities(); pitch docs match it via the sync rule. Per ADR-0021 + ADR-0022.

Designed around what we won't expose

The public surface is deliberately narrow. Tools that mutate user OAuth credentials, manage third-party connector lifecycles, edit rules without user confirmation, or expose raw memory without trust gating are not on this server. They exist for Cortex's own agent runtime and are unreachable from this endpoint. See Governance boundary for the full list.

Where to go next

• Quickstart — connect a real client in five minutes.
• Authentication — how bearer tokens work today, OAuth for MVP.
• Core concepts — the five primitives, the action-approval ceremony, and the entity model.
• Trigger dispatch — the push contract: envelope, signing, callbacks, retry, DLQ, three handler tiers.
• Recipes — copy-paste handler implementations for Trigger.dev, n8n, Zapier, custom webhooks, and (V1.1) MCP-executor.
• Tool reference — every tool with its input schema, output shape, errors, and a runnable example.