Precursor IntelligenceAPI Docs
Getting Started

Precursor Intelligence MCP Server

The Precursor Intelligence MCP server gives any MCP-compatible client (Claude Desktop, Claude Code, Cursor, Zed, or your own agent) direct, typed access to the same threat-intelligence dataset that powers the REST API.

It is a hosted, remote MCP server. There is nothing to install. Point your client at the endpoint, add your API key, and start calling tools.

POST
https://mcp.precursorintelligence.com

What you can do with it

The server exposes 41 tools spanning the full Precursor Intelligence dataset:

  • CVE detail, EPSS scoring, CISA KEV status, and notable events
  • CPE vendor, product, and version lookups with full-text product search
  • CWE catalogue
  • MITRE ATT&CK tactics and techniques
  • Atomic Red Team test library
  • Threat actor profiles, including industry-targeting lookups
  • IOC intelligence (1M+ records) with substring and exact-match lookup
  • Malware sample metadata
  • SSL and JA3 blacklists
  • Shadowserver honeypot telemetry (per-CVE, per-vendor, and daily aggregates)
  • AI-generated remediation summaries
  • Account, credit balance, and data-freshness introspection

A complete list grouped by domain lives on the Tools page.

How it works

The server speaks JSON-RPC 2.0 over HTTP POST, implementing the MCP Streamable HTTP transport at protocol version 2025-06-18. Every call:

  1. Validates your bearer token.
  2. Charges 1 credit on tools/call (account_status is free).
  3. Runs the query against the dataset.
  4. Returns a standard MCP CallToolResult whose single text block is a JSON-serialised payload, with a _meta.precursor block carrying the request ID, credit balance, and tool metadata.

If the underlying query fails or times out, the credit is refunded automatically.

Tools-only server

The server advertises only the tools capability. It does not expose resources, prompts, sampling, or server-initiated notifications. Clients that auto-discover capabilities will see tools.listChanged: false.

Where to go next

Set up your client

Connect Claude Desktop, Claude Code, Cursor, or any custom MCP client in under five minutes.

Authentication

API keys, IP allowlists, and the exact header your client needs to send.

Browse the tools

All 41 tools grouped by domain, each with parameters, response shape, and examples.

Response format

The CallToolResult envelope, the _meta.precursor block, and the three payload shapes.

Credits

What costs a credit, how charging and refunds work, and how to read your balance.

Errors

Full JSON-RPC error code reference, HTTP status mapping, and recovery guidance.