Connect Cortex to ChatGPT: Manage Service Catalogs and Scorecards

If your team uses Claude, check out our guide on connecting Cortex to Claude or explore our broader architectural overview on connecting Cortex to AI Agents. Giving a Large Language Model access to your Internal Developer Portal (IDP) is how you automate engineering governance. You can connect Cortex to ChatGPT so your AI agents can read service catalogs, audit dependencies, evaluate scorecard compliance, and unarchive entities automatically. Here is exactly how to do it using a Model Context Protocol (MCP) server.

Modern engineering organizations use Cortex to enforce standards across hundreds of microservices. Exposing that complex ecosystem of services, resources, domains, and scorecards to ChatGPT requires a secure integration layer. You either spend weeks building, hosting, and maintaining a custom MCP server, or you use a managed infrastructure layer that handles the boilerplate for you.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Cortex, connect it natively to ChatGPT, and execute complex engineering workflows using natural language.

The Engineering Reality of the Cortex API

A custom MCP server is a self-hosted integration layer that translates an LLM's tool calls into REST API requests. If you decide to build a custom MCP server for Cortex, you are responsible for the entire API lifecycle. Cortex is a highly specialized platform with specific design patterns that break standard CRUD assumptions.

The YAML Descriptor Translation Layer

Cortex relies heavily on OpenAPI specs and YAML descriptors to define catalog entities and scorecards. Large Language Models prefer working in flat, predictable JSON structures. When an LLM wants to create or update a catalog entity, it must generate a syntactically perfect YAML string payload. If your custom server does not handle the translation and error formatting cleanly, the LLM will hallucinate indentation or drop required metadata blocks, causing the Cortex API to reject the payload with a vague 400 error.

Scorecard Evaluation Dynamics

Evaluating scorecards in Cortex requires precise sequence tracking. An LLM cannot just read a scorecard and assume compliance. It must fetch the scorecard descriptor, map the rules to a specific entity tag, and trigger a distinct evaluation endpoint. Fetching the exact remaining rules to reach the next tier requires passing specific contextual IDs. Building the state machine to help an LLM navigate this multi-step logic requires extensive custom code.

Strict Rate Limits and 429 Errors

When an AI agent audits an entire microservice architecture, it executes dozens of sequential tool calls. Cortex enforces rate limits to protect its infrastructure. Factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When the Cortex API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. Your AI agent must read these headers and implement its own retry and exponential backoff logic.

Instead of forcing your engineering team to build custom API polling mechanisms, schema mappers, and authentication layers, you can use Truto to dynamically generate a managed MCP server.

Creating the Cortex MCP Server

Truto derives MCP tools dynamically from the Cortex integration's underlying resource definitions and documentation schemas. Each MCP server is scoped to a single connected Cortex workspace and secured by a cryptographic token. You can create this server in two ways.

Method 1: Via the Truto UI

This is the fastest method for internal operational setups.

1. Navigate to the integrated account page for your Cortex connection in the Truto dashboard.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration. You can restrict the server to read-only methods or filter by specific tool tags.
5. Click Create and copy the generated MCP server URL. It will look like https://api.truto.one/mcp/a1b2c3d4e5f6....

Method 2: Via the Truto REST API

For platform engineers building automated provisioning pipelines, you can generate MCP servers programmatically. This endpoint creates the server, stores the token metadata, and schedules an optional expiration alarm.

Request:

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ChatGPT Cortex Auditor",
    "config": {
      "methods": ["read", "write"],
      "require_api_token_auth": false
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

Response:

{
  "id": "mcp_srv_9x8y7z",
  "name": "ChatGPT Cortex Auditor",
  "config": { "methods": ["read", "write"] },
  "expires_at": "2026-12-31T23:59:59.000Z",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

Save this URL. It is fully self-contained and ready to process JSON-RPC 2.0 requests from ChatGPT.

Connecting the Cortex MCP Server to ChatGPT

Once your MCP server URL is provisioned, you must register it with ChatGPT so the LLM can discover the available Cortex tools.

Method A: Via the ChatGPT UI

For users on ChatGPT Plus, Team, or Enterprise plans with Developer Mode enabled:

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Toggle Developer mode to the "On" position.
3. Under the MCP servers / Custom connectors section, click Add new server.
4. Enter a name (e.g., "Cortex Dev Portal").
5. Paste the Truto MCP URL into the Server URL field.
6. Click Save.

ChatGPT will immediately send an initialize request to the server to fetch the available Cortex schemas and tool descriptions.

Method B: Via Local Configuration File

If you are running a custom agent framework, an open-source client, or a local development proxy that bridges Server-Sent Events (SSE) to ChatGPT, you can map the MCP server using a configuration file.

{
  "mcpServers": {
    "cortex_production": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

This configuration instructs the MCP client to establish an SSE connection with the Truto router, dynamically exposing the Cortex API endpoints to your AI logic.

Hero Tools for Cortex Automation

The Truto integration exposes the entire Cortex REST API to ChatGPT. Below are the highest-leverage operations for automating engineering portals.

List All Catalog Entities

Retrieves a complete list of all microservices, resources, and domains registered in the Cortex catalog. AI agents use this to audit the full inventory of engineering assets.

"Fetch all entities in the Cortex catalog and output a summary of the top 10 most recently updated microservices."

Get Single Catalog Entity by ID

Fetches deeply detailed metadata for a specific entity, including ownership links, Slack channels, Git repositories, and hierarchy mapping.

"Pull the full metadata record for the 'payment-gateway' service and tell me who the registered owners are."

Create Dependency Between Entities

Establishes an API-created dependency edge from a caller service to a callee service. ChatGPT can use this to map out architectures based on conversational input.

"Create a dependency in Cortex showing that the 'checkout-service' is the caller and 'auth-service' is the callee. Add a description noting it relies on the /v1/verify endpoint."

Evaluate Entity Scorecard Score

Triggers a real-time score evaluation for a specific entity against a specific scorecard. This tool forces Cortex to run its latest checks, which is critical before requesting exemptions.

"Trigger a fresh scorecard evaluation for the 'billing-worker' against the 'production-readiness' scorecard."

Get Scorecard Next Steps for Entity

Retrieves the exact remaining rules a microservice must complete to advance to the next level of a scorecard ladder. ChatGPT uses this to generate actionable Jira tickets or Slack messages for developers.

"Show me the next steps required for the 'user-directory' service to reach Level 3 on the Security Scorecard."

Create or Update OpenAPI Entity

Creates or patches a Cortex catalog entity using an OpenAPI or YAML descriptor payload. ChatGPT can generate the YAML dynamically and push it directly into the catalog.

"Create a new Cortex entity for a domain called 'Data Platform' using a standard YAML descriptor. Assign ownership to the Data Engineering group."

For the complete tool inventory and exact JSON schema requirements, visit the Cortex integration page.

Workflows in Action

Giving ChatGPT access to isolated Cortex endpoints is useful, but the real power of MCP is workflow orchestration. Below are two concrete, multi-step operations ChatGPT can execute autonomously.

Workflow 1: Auditing Service Dependencies and Finding Gaps

Platform engineers frequently need to understand how downstream services affect upstream applications. If a microservice is missing a dependency mapping, an incident response can be delayed. ChatGPT can audit these gaps automatically.

"Check the dependencies for the 'order-processing' service. If it does not have a dependency registered for the 'inventory-db' resource, create that dependency edge now."

Execution Steps:

1. cortex_dependency_list_for_entity: ChatGPT queries all registered dependencies where order-processing is the caller.
2. Analyze: The LLM parses the array of returned dependency objects, checking the callee_tag for inventory-db.
3. cortex_dependency_create_between_entities: Discovering the link is missing, ChatGPT constructs a payload with caller_tag: order-processing and callee_tag: inventory-db and executes the creation tool.

The engineer receives confirmation that the architectural map has been updated without writing a single line of API mapping code.

Workflow 2: Evaluating Scorecards and Remediation Planning

Engineering managers need to track their team's compliance against security and production readiness scorecards. ChatGPT can act as a compliance assistant.

"Run an evaluation on the 'search-api' service against the 'soc2-compliance' scorecard. Tell me exactly what rules it is currently failing, and draft a message I can send to the team to fix them."

sequenceDiagram
    participant User
    participant ChatGPT
    participant CortexMCP as Cortex MCP Server
    participant CortexAPI as Cortex API

    User->>ChatGPT: "Run an evaluation on search-api..."
    ChatGPT->>CortexMCP: Call cortex_scorecard_evaluate_entity_score
    CortexMCP->>CortexAPI: POST /api/v1/scorecards/soc2-compliance/entities/search-api/evaluate
    CortexAPI-->>CortexMCP: 204 No Content
    CortexMCP-->>ChatGPT: Evaluation triggered successfully

    ChatGPT->>CortexMCP: Call cortex_scorecard_get_next_steps_for_entity
    CortexMCP->>CortexAPI: GET /api/v1/scorecards/soc2-compliance/entities/search-api/next-steps
    CortexAPI-->>CortexMCP: Returns pending rules payload
    CortexMCP-->>ChatGPT: JSON data

    ChatGPT->>User: "The evaluation is complete. The search-api is failing the 'Missing PagerDuty Integration' rule. Here is the draft message..."

Execution Steps:

1. cortex_scorecard_evaluate_entity_score: ChatGPT forces a fresh evaluation to ensure data isn't stale.
2. cortex_scorecard_get_next_steps_for_entity: ChatGPT fetches the specific rules separating the service from the next compliance tier.
3. Synthesize: The LLM reads the rule descriptions and formats a clear, actionable summary for the user.

Security and Access Control

Connecting an LLM to your engineering portal requires strict governance. Truto MCP servers include built-in security features to limit the blast radius of AI agents.

• Method Filtering: You can restrict an MCP server to read-only operations. By setting config.methods: ["read"] during server creation, Truto will strip out all create, update, and delete tools. The LLM will only be able to query the catalog.
• Tag Filtering: If your Cortex integration has resources tagged by domain, you can restrict the server to only expose tools relevant to that domain (e.g., config.tags: ["scorecards"]).
• Extra Authentication: By setting require_api_token_auth: true, possession of the MCP URL is no longer enough. The client must also pass a valid Truto API token in the Authorization header, providing a second layer of security.
• Automatic Expiration: You can set an expires_at datetime. Truto will automatically dismantle the server and revoke the token at the specified time, which is ideal for temporary auditing sessions.

Connecting Cortex to ChatGPT using a managed MCP server removes the pain of OAuth token refreshes, schema mapping, and API maintenance. By letting Truto handle the infrastructure, your engineering team can focus entirely on designing the AI prompts and autonomous workflows that keep your microservices compliant, mapped, and fully documented.