Your Data · Cross-Reference

`assess_cve_exposure`

Assess your organisation's exposure to a specific CVE: your own EdgeProtect scan findings and affected assets, whether it's on your watchlist or alerts, inferred matches against your discovered software (CPE), plus public intel (CVSS/EPSS/KEV) and recent Shadowserver exploitation. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

cve_idstringrequired

CVE identifier matching ^CVE-[0-9]{4}-[0-9]{4,7}$. Case-insensitive on input; cve-2024-3400 is accepted and uppercased server-side.

Example invocation

Ask your agent:

How exposed are we to CVE-2024-3400 — do we run anything affected and is it being exploited?

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "assess_cve_exposure",
      "arguments": { "cve_id": "CVE-2024-3400" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "cve_id": "CVE-2024-3400",
  "public_summary": {
    "id": "CVE-2024-3400",
    "severity": {
      "cvss_score": 10.0,
      "cvss_level": "CRITICAL"
    },
    "epss": {
      "score": 0.9437,
      "percentile": 0.999
    },
    "cisa_kev": { "listed": true }
  },
  "my_findings": {
    "count": 2,
    "instances": 5,
    "items": [
      {
        "title": "PAN-OS GlobalProtect command injection on perimeter firewall",
        "severity": "critical",
        "cvss": 10.0,
        "kev": true,
        "status": "open",
        "scan_id": "scan_9f2c1ab4"
      },
      {
        "title": "GlobalProtect portal exposed (vpn.precursorsecurity.com)",
        "severity": "high",
        "cvss": 8.6,
        "kev": true,
        "status": "in_progress",
        "scan_id": "scan_7d0e55c1"
      }
    ]
  },
  "my_watchlist": {
    "in_relevant_cves": true,
    "in_alerts": true,
    "triage_hits": 3
  },
  "matching_assets": [
    {
      "vendor": "paloaltonetworks",
      "product": "pan-os",
      "version": "11.1.2",
      "cpe": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*"
    }
  ],
  "exploitation_recent": {
    "window_days": 30,
    "last_observed": "2026-06-16",
    "connections": 1842,
    "cisa_kev": true
  },
  "generated_at": "2026-06-18T09:30:00.000Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

cve_idstringoptional

The canonical CVE identifier the assessment was run against (uppercased).

public_summaryobjectoptional

The compact public CVE record — the same shape as the get_cve payload (CVSS, EPSS, KEV, and related public intelligence). Use it to ground the org-specific findings against the wider threat picture.

my_findingsobjectoptional

Your own EdgeProtect scan findings for this CVE. Contains count (number of distinct findings), instances (total affected occurrences across assets), and an items array of the findings themselves.

my_findings.items[].titlestringoptional

Human-readable title of the finding as recorded by EdgeProtect.

my_findings.items[].severitystringoptional

Severity label assigned to the finding, e.g. critical, high, medium.

my_findings.items[].cvssnumberoptional

CVSS base score associated with the finding.

my_findings.items[].kevbooleanoptional

Whether the CVE behind this finding is on the CISA KEV catalog.

my_findings.items[].statusstringoptional

Remediation status of the finding, e.g. open, in_progress, resolved.

my_findings.items[].scan_idstringoptional

Identifier of the scan that produced the finding.

my_watchlistobjectoptional

Whether this CVE intersects your watchlist configuration: in_relevant_cves (boolean — present on your relevant-CVE list), in_alerts (boolean — has triggered an alert), and triage_hits (integer count of triage matches).

matching_assetsarrayoptional

Assets from your discovered software inventory whose CPE matches this CVE's applicability. Each entry has vendor, product, version, and cpe.

exploitation_recentobjectoptional

Recent Shadowserver exploitation activity: window_days (integer, fixed at 30), last_observed (date of the most recent observation), connections (count over the window), and cisa_kev (boolean).

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: cve_id: required_string`	The `cve_id` argument is missing.
`-32602`	`invalid_params: cve_id: pattern`	The value does not match the CVE identifier pattern.
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

For a complete reference of JSON-RPC error codes, see Errors.