Your Data · Supply Chain

`check_my_supply_chain_exposure`

Match your organisation's lockfile dependencies against known software-supply-chain incidents (compromised/malicious packages). Returns candidate hits by package + ecosystem with installed vs affected versions so you can confirm the overlap. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

limitintegeroptionaldefault: 100

Maximum number of candidate hits to return. Accepted range: 1–500.

Example invocation

Ask your agent: "Are any of our dependencies caught in a supply-chain incident?"

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_my_supply_chain_exposure","arguments":{"limit":100}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "items": [
    {
      "package": "left-pad",
      "ecosystem": "npm",
      "installed_version": "1.3.0",
      "affected_versions": ["1.3.0", "1.3.1"],
      "incident": {
        "id": "SC-2026-0042",
        "title": "left-pad malicious release publishing credential stealer",
        "severity": "high",
        "published": "2026-05-20T00:00:00.000Z",
        "threat_actor": "UNC-Supply",
        "reference": "https://precursorintelligence.com/incidents/SC-2026-0042"
      }
    },
    {
      "package": "lodash",
      "ecosystem": "npm",
      "installed_version": "4.17.20",
      "affected_versions": ["4.17.20", "4.17.21-beta"],
      "incident": {
        "id": "SC-2026-0017",
        "title": "lodash compromised maintainer account pushes backdoored build",
        "severity": "critical",
        "published": "2026-03-11T00:00:00.000Z",
        "threat_actor": null,
        "reference": "https://precursorintelligence.com/incidents/SC-2026-0017"
      }
    }
  ],
  "generated_at": "2026-06-18T08:15:00.000Z"
}

The full MCP envelope, including _meta.precursor with request_id, credits, and response_truncated, is documented in Response Format.

Version-range filtering is not applied — treat each hit as a candidate and confirm the reported installed_version against affected_versions before acting.

Response fields

countintegeroptional

Number of candidate hits returned (equals items.length).

itemsarrayoptional

Candidate matches between your dependencies and known incidents. Each object contains the fields below.

items[].packagestringoptional

Name of the dependency that matched a known incident (e.g. left-pad).

items[].ecosystemstringoptional

Package ecosystem the dependency belongs to (e.g. npm, PyPI).

items[].installed_versionstringoptional

Version of the package recorded in your lockfile.

items[].affected_versionsarrayoptional

Array of version strings flagged as affected by the incident.

items[].incidentobjectoptional

The matched supply-chain incident. Contains id, title, severity, published (ISO 8601 timestamp), threat_actor (string or null), and reference (URL).

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:500`	`limit` exceeds 500
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; the credit is automatically refunded