Tools

All Tools

The Precursor Intelligence MCP server exposes 71 tools. All cost 1 credit per successful call except account_status, which is free. Click any tool for full parameter, response, and example detail.

The Your Data tools (the *_my_*, get_open_ports, assess_cve_exposure, map_assets_to_actor, and appliances_exploited_by_actor tools) return your own organisation's data — assets, alerts, watchlist, supply-chain, and more — and cross-reference it with the threat intel. They require the mcp:org scope on your key; the organisation is resolved from the key and never read from the request. See Authentication.

Every tool's name is the exact string you pass to tools/call:

{ "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "<tool>", "arguments": { } } }

CVE, EPSS & KEV

Tool	What it does
`get_cve`	Full intelligence on a single CVE: NVD record, CVSS, EPSS, CISA KEV status, Shadowserver honeypot activity, notable events, and attributed threat actors with citations.
`search_cves_by_vendor`	Highest-EPSS CVEs for a vendor, sorted by EPSS descending.
`list_kev_recent`	CISA KEV entries added within the last N days.
`list_high_epss_cves`	CVEs at or above an EPSS threshold, sorted descending.
`list_recent_notable_events`	CVE events such as new NVD entries, high EPSS deltas, and CISA KEV additions.

CPE & Vendors

Tool	What it does
`get_vendor`	Vendor summary: total CVE count, product count, and product-to-CVE map.
`get_vendor_product`	Product summary: CVE count, version count, and version-to-CVE map.
`get_vendor_product_version`	Up to 200 CVEs affecting a specific vendor/product/version triple, with a truncation flag.
`search_products`	Full-text search across CPE product names.
`list_top_vendors_by_cve_count`	Top CPE vendors by total tracked CVE count.

CWE

Tool	What it does
`get_cwe`	Single CWE record: description, abstraction, related weaknesses, consequences, and mitigations.
`list_cwes`	Search or page the CWE catalog (approximately 964 records).
`list_top_cwes`	Most-referenced CWEs across scored CVEs.

MITRE ATT&CK

Tool	What it does
`get_mitre_technique`	Single ATT&CK technique or sub-technique: description, platforms, detection, and kill-chain phases.
`list_mitre_tactics`	All 14 ATT&CK Enterprise tactics with per-tactic statistics.
`list_mitre_techniques`	Techniques list, optionally filtered by tactic shortname.
`list_top_mitre_techniques`	Most-referenced ATT&CK techniques across intelligence reporting.

Atomic Red Team

Tool	What it does
`list_art_techniques`	Atomic Red Team technique index (324 techniques), with optional substring filter.
`list_art_atomic_tests`	Paged atomic test list, filterable by ATT&CK technique ID and platform.
`get_art_atomic_test`	Full atomic test detail: executors, dependencies, and input arguments.

Threat Actors

Tool	What it does
`list_threat_actors`	Tracked actors ranked by corroborated evidence volume. Filterable by type (ransomware / apt / cybercrime / hacktivist).
`get_threat_actor`	Full dossier: aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft, and linked CVEs / industries / malware — each with an evidence quote and source URL.
`list_threat_actor_cves`	CVEs an actor is reported to exploit, with evidence quotes plus CVSS, EPSS, KEV status and action priority. KEV-first ordering.
`get_cve_threat_actors`	Threat actors reported to have exploited a given CVE, each with the quote and source URL attributing it.
`list_threat_actors_by_industry`	Threat actors reported to target a given industry, with citations. Matches industry names, slugs and aliases.
`get_threat_actor_techniques`	Full technique set for an actor: MITRE ATT&CK where it is a named intrusion set, in-house data for the ~800 actors ATT&CK does not name.

IOCs

Tool	What it does
`search_iocs`	Substring search across 1M+ IOCs from our IOC intelligence, with filters by type, threat type, and malware family.
`lookup_ioc`	Exact-match IOC lookup across the IOC feed and blog-derived IOCs, with enrichment.
`list_recent_iocs`	IOCs first seen within the last N days.

Malware Samples

Tool	What it does
`search_malware_samples`	Search the malware sample corpus by substring, file type, or signature.
`get_malware_sample`	Single sample by SHA-256 hash, with key metadata and signature.
`list_recent_malware_samples`	Recently observed samples from our malware dataset, optionally filtered by file type.
`list_top_malware`	Most-referenced malware families across intelligence reporting.

Blacklists

Tool	What it does
`lookup_ssl_blacklist`	Check whether a SHA-1 certificate fingerprint appears on the SSL blacklist as associated with botnet C2 or malware.
`lookup_ja3_blacklist`	Check whether a JA3 MD5 fingerprint appears on the JA3 blacklist as associated with malware or C2.

Shadowserver Honeypot

Tool	What it does
`get_shadowserver_cve_activity`	Daily Shadowserver honeypot observations for a single CVE over N days.
`list_shadowserver_top_cves`	Top CVEs by Shadowserver honeypot connections over a configurable window.
`list_shadowserver_top_vendors`	Top vendors by Shadowserver honeypot connections.
`get_shadowserver_daily_stats`	Aggregate Shadowserver daily statistics: unique IPs, connections, and active CVEs.

Remediation

Tool	What it does
`get_top_affected_systems`	Most-referenced affected systems across intelligence reporting.
`list_remediation_summary`	Latest AI-generated remediation summaries for a CVE.
`list_recent_remediation_queue`	CVEs recently added to the remediation queue.

Account & Meta

Tool	What it does
`account_status`	Free. Caller's current credit balance and API key metadata.

Your Data (scope `mcp:org`)

These tools return your own organisation's data and require the mcp:org scope. The organisation is resolved from your API key and injected server-side — it is never read from the request, so a key can only ever read its own org.

Your Data · Cross-Reference

Join your own assets and findings with Precursor's threat intel.

Tool	What it does
`assess_cve_exposure`	Your exposure to a specific CVE: your findings + affected assets, watchlist/alert membership, inferred CPE matches, public intel, and recent exploitation.
`map_assets_to_actor`	Map your assets to a threat actor's ATT&CK TTPs and linked CVEs, optionally filtered by vendor.
`appliances_exploited_by_actor`	Your edge appliances tied to CVEs exploited in the wild in the last N days, optionally attributed to a named actor.

Your Data · Attack Surface

Your EdgeProtect attack-surface inventory — assets, ports, services, certs, and more.

Tool	What it does
`list_my_assets`	Your EdgeProtect scans with target and roll-up counts.
`list_my_software`	Discovered software: CPE products + detected website technologies.
`list_my_vulnerabilities`	Your vulnerability findings with instance counts; filter by severity/CVSS/KEV/has-CVE.
`list_my_hosts`	Discovered hosts (hostname/FQDN/OS) with IP and open-port counts.
`get_open_ports`	Which ports are open on a specific asset (hostname/FQDN/IP), with the service on each.
`list_my_ports`	Ports across your assets with host/IP/service; filter by state, port, protocol, or host.
`list_my_services`	Detected services (product/version, HTTP server/title, TLS); filter by product/port/SSL.
`list_my_ip_addresses`	IP addresses with geo/ASN/ISP enrichment.
`list_my_network_ranges`	Network CIDR ranges attributed to your organisation.
`list_my_ssl_certificates`	TLS certificates on your services, ordered by expiry.
`list_my_dns_records`	DNS records for your domains; filter by record type.
`list_my_discovered_domains`	Domains found by EdgeProtect discovery (registrar/expiry/nameservers).
`list_my_exposed_credentials`	Breached credentials for your domains (email/username/source). Passwords are never returned.

Your Data · Watchlist

Tool	What it does
`list_my_relevant_cves`	CVEs flagged relevant to your stack, sorted by EPSS.
`list_my_favorite_threat_groups`	Threat groups your organisation follows.
`get_my_industry`	The industry group(s) configured for your organisation.

Your Data · Alerts

Tool	What it does
`list_my_alerts`	Your CVE alert/notification feed; `unseen_only` available.
`get_my_alert_config`	Your alert watchlist entries and notification recipients.
`list_my_domain_alerts`	Brand/domain intelligence alerts; `unread_only` available.

Your Data · Supply Chain

Tool	What it does
`list_my_lockfiles`	Dependency lockfiles (SBOM) you've uploaded, with package/findings counts.
`check_my_supply_chain_exposure`	Your dependencies matched against known software-supply-chain incidents.

Your Data · Posture

Tool	What it does
`list_my_triage_findings`	Your triaged vulnerabilities (scored, with actor/malware enrichment and action priority).
`list_my_domains`	Domains your organisation monitors.
`list_my_action_plans`	AI-generated remediation to-do lists.
`list_my_reports`	Threat-report analyses you've run.