Your Data · Cross-Reference

`appliances_exploited_by_actor`

Which of your edge appliances (firewalls/VPNs/gateways) are tied to CVEs being actively exploited in the wild in the last N days, optionally attributed to a named actor (e.g. "Qilin"). Edge appliances are identified by a curated vendor allowlist, overridable via "vendors". Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

actorstringoptional

Optional threat actor / group name or alias to attribute exploitation to, e.g. Qilin. Maximum 120 characters.

daysintegeroptionaldefault: 7

Shadowserver exploitation window, in days. Accepted range: 1–90.

vendorsarrayoptional

Optional override of the curated edge-appliance vendor allowlist. Provide lowercase CPE vendor slugs. Maximum 40 items.

Example invocation

Ask your agent:

Which of my edge appliances are being exploited by Qilin this week?

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "appliances_exploited_by_actor",
      "arguments": { "actor": "Qilin", "days": 7 }
    }
  }'

Response

result.content[0].text (parsed)

{
  "actor": "Qilin",
  "actor_slug": "qilin",
  "actor_aliases": ["Agenda", "Water Galura"],
  "window_days": 7,
  "my_appliances": [
    {
      "vendor": "f5",
      "product": "big-ip",
      "version": "17.1.0",
      "cpe": "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*"
    },
    {
      "vendor": "sonicwall",
      "product": "sonicos",
      "version": "7.0.1",
      "cpe": "cpe:2.3:o:sonicwall:sonicos:7.0.1:*:*:*:*:*:*:*"
    }
  ],
  "recently_exploited_for_my_appliances": [
    {
      "cve_id": "CVE-2023-46805",
      "vendor": "f5",
      "product": "big-ip",
      "connections": 967,
      "last_observed": "2026-06-17",
      "severity": "CRITICAL",
      "cisa_kev": true
    }
  ],
  "attributed_to_actor": ["CVE-2023-46805"],
  "note": null,
  "generated_at": "2026-06-18T09:30:00.000Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

actorstring | nulloptional

The resolved canonical actor name — from MITRE ATT&CK if it matched there, otherwise from the in-house dataset. null when no actor argument was supplied, or when the name resolved against neither dataset. A non-null value is your confirmation that the name was understood.

actor_slugstring | nulloptional

The actor's slug when it exists in the in-house dataset. Pass it to get_threat_actor for the full dossier.

actor_aliasesarrayoptional

Known aliases for the resolved actor. Empty when no actor was supplied or the actor could not be resolved.

window_daysintegeroptional

The Shadowserver exploitation window used for this request, in days.

my_appliancesarrayoptional

Your discovered edge appliances matched against the (curated or overridden) vendor allowlist. Each entry has vendor, product, version, and cpe.

recently_exploited_for_my_appliancesarrayoptional

CVEs tied to your appliances that show recent in-the-wild exploitation. Each entry has cve_id, vendor, product, connections (count over the window), last_observed (date), severity, and cisa_kev (boolean).

attributed_to_actorarrayoptional

CVE identifiers from recently_exploited_for_my_appliances that are attributed to the named actor. Attribution is the union of the legacy CVE-attribution set and the in-house cited actor_cve claims. Empty when no actor was supplied, when the name did not resolve, or when none of your recently-exploited appliance CVEs are attributed to that actor.

notestring | nulloptional

Set when no edge appliance in your attack surface matched the vendor allowlist — i.e. the whole result is empty because nothing was in scope, not because nothing was found. Otherwise null.

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: days: min:1`	`days` is less than 1.
`-32602`	`invalid_params: days: max:90`	`days` exceeds 90.
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

For a complete reference of JSON-RPC error codes, see Errors.