Tools

All Tools

The Precursor Intelligence MCP server exposes 41 tools. All cost 1 credit per successful call except account_status, which is free. Click any tool for full parameter, response, and example detail.

Every tool's name is the exact string you pass to tools/call:

{ "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "<tool>", "arguments": { } } }

CVE, EPSS & KEV

Tool	What it does
`get_cve`	Full intelligence on a single CVE: NVD record, CVSS, EPSS, CISA KEV status, Shadowserver honeypot activity, and notable events.
`search_cves_by_vendor`	Highest-EPSS CVEs for a vendor, sorted by EPSS descending.
`list_kev_recent`	CISA KEV entries added within the last N days.
`list_high_epss_cves`	CVEs at or above an EPSS threshold, sorted descending.
`list_recent_notable_events`	CVE events such as new NVD entries, high EPSS deltas, and CISA KEV additions.

CPE & Vendors

Tool	What it does
`get_vendor`	Vendor summary: total CVE count, product count, and product-to-CVE map.
`get_vendor_product`	Product summary: CVE count, version count, and version-to-CVE map.
`get_vendor_product_version`	Up to 200 CVEs affecting a specific vendor/product/version triple, with a truncation flag.
`search_products`	Full-text search across CPE product names.
`list_top_vendors_by_cve_count`	Top CPE vendors by total tracked CVE count.

CWE

Tool	What it does
`get_cwe`	Single CWE record: description, abstraction, related weaknesses, consequences, and mitigations.
`list_cwes`	Search or page the CWE catalog (approximately 964 records).
`list_top_cwes`	Most-referenced CWEs across scored CVEs.

MITRE ATT&CK

Tool	What it does
`get_mitre_technique`	Single ATT&CK technique or sub-technique: description, platforms, detection, and kill-chain phases.
`list_mitre_tactics`	All 14 ATT&CK Enterprise tactics with per-tactic statistics.
`list_mitre_techniques`	Techniques list, optionally filtered by tactic shortname.
`list_top_mitre_techniques`	Most-referenced ATT&CK techniques across intelligence reporting.

Atomic Red Team

Tool	What it does
`list_art_techniques`	Atomic Red Team technique index (324 techniques), with optional substring filter.
`list_art_atomic_tests`	Paged atomic test list, filterable by ATT&CK technique ID and platform.
`get_art_atomic_test`	Full atomic test detail: executors, dependencies, and input arguments.

Threat Actors

Tool	What it does
`list_threat_actors`	Top threat actors by reporting frequency.
`get_threat_actor`	Threat group record: aliases, country, sponsor, targeted industries, and incident types.
`list_threat_actors_by_industry`	Threat actors known to target a given industry.

IOCs

Tool	What it does
`search_iocs`	Substring search across 1M+ IOCs from our IOC intelligence, with filters by type, threat type, and malware family.
`lookup_ioc`	Exact-match IOC lookup across the IOC feed and blog-derived IOCs, with enrichment.
`list_recent_iocs`	IOCs first seen within the last N days.

Malware Samples

Tool	What it does
`search_malware_samples`	Search the malware sample corpus by substring, file type, or signature.
`get_malware_sample`	Single sample by SHA-256 hash, with key metadata and signature.
`list_recent_malware_samples`	Recently observed samples from our malware dataset, optionally filtered by file type.
`list_top_malware`	Most-referenced malware families across intelligence reporting.

Blacklists

Tool	What it does
`lookup_ssl_blacklist`	Check whether a SHA-1 certificate fingerprint appears on the SSL blacklist as associated with botnet C2 or malware.
`lookup_ja3_blacklist`	Check whether a JA3 MD5 fingerprint appears on the JA3 blacklist as associated with malware or C2.

Shadowserver Honeypot

Tool	What it does
`get_shadowserver_cve_activity`	Daily Shadowserver honeypot observations for a single CVE over N days.
`list_shadowserver_top_cves`	Top CVEs by Shadowserver honeypot connections over a configurable window.
`list_shadowserver_top_vendors`	Top vendors by Shadowserver honeypot connections.
`get_shadowserver_daily_stats`	Aggregate Shadowserver daily statistics: unique IPs, connections, and active CVEs.

Remediation

Tool	What it does
`get_top_affected_systems`	Most-referenced affected systems across intelligence reporting.
`list_remediation_summary`	Latest AI-generated remediation summaries for a CVE.
`list_recent_remediation_queue`	CVEs recently added to the remediation queue.

Account & Meta

Tool	What it does
`data_freshness`	Last-update timestamps and stale flags for every ingest source.
`account_status`	Free. Caller's current credit balance and API key metadata.