Security model

Cortex supplies knowledge and tools to an agent host. The host remains responsible for how the agent uses that context and when a person must approve an action.

Data access

Cortex sees data sent through its API, CLI, web application, or MCP tools. Cortex does not inspect your repository, terminal, or agent session on its own.

An agent can send repository-derived information to Cortex when it creates or updates a Module, Issue, or comment. Review the host's tool calls and the destination Account before approving writes.

SessionStart context

The plugin adds bounded Cortex instructions when a supported agent session starts. Those instructions explain the available integration and direct the agent to retrieve relevant knowledge explicitly.

The SessionStart hook does not watch the Cortex inbox, invoke a coding agent, or execute remote work automatically.

MCP tools

The hosted MCP server includes read, write, and delete-capable operations. Cortex enforces the authenticated principal's Account access and operation permissions. The agent host decides whether to request confirmation before invoking an allowed operation.

Inspect the discovered tool set and configure the host's approval policy before enabling Cortex for unattended workflows.

OAuth credentials

First-party plugins contain public OAuth client IDs. They do not contain client secrets. Each supported host completes Authorization Code with PKCE and stores its own grant.

socra cortex setup does not copy or expose the Socra CLI bearer token. Removing a plugin does not automatically revoke grants already stored by the host or authorization server.

Instruction precedence

Cortex output is tool context. It does not override system instructions, repository instruction files, organization policies, or the agent host's confirmation rules. Keep the instruction files your host normally discovers.