CVE & EPSS

`get_cve`

Fetch full intelligence on a single CVE: NVD record, CVSS scores, EPSS probability and trend, CISA KEV status, Shadowserver honeypot activity, CPE applicability, and a timeline of notable events. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

cve_idstringrequired

CVE identifier matching ^CVE-[0-9]{4}-[0-9]{4,7}$. Case-insensitive on input; cve-2024-3094 is accepted and uppercased server-side.

Example invocation

Ask your agent:

Get the full Precursor Intelligence record for CVE-2024-3094, including CISA KEV status and Shadowserver honeypot activity.

Raw JSON-RPC:

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_cve",
      "arguments": { "cve_id": "CVE-2024-3094" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "id": "CVE-2024-3094",
  "description": "Malicious code was discovered in the upstream tarballs of xz Utils versions 5.6.0 and 5.6.1.",
  "published": "2024-03-29T17:15:21.000Z",
  "last_modified": "2026-02-11T09:24:01.000Z",
  "vuln_status": "Analyzed",
  "severity": {
    "cvss_score": 10.0,
    "cvss_level": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "impact_score": 6.0,
    "exploitability_score": 3.9
  },
  "epss": {
    "score": 0.9401,
    "percentile": 0.998,
    "delta_7d": 0.0012,
    "score_series_7d": [0.9395, 0.9396, 0.9398, 0.9399, 0.9400, 0.9400, 0.9401],
    "updated_at": "2026-05-17T00:00:00.000Z"
  },
  "cisa_kev": {
    "listed": true,
    "date_added": "2024-03-29",
    "due_date": "2024-04-12",
    "vendor": "XZ Utils",
    "product": "XZ Utils",
    "vulnerability_name": "XZ Utils Supply Chain Compromise",
    "short_description": "XZ Utils contains a supply chain compromise via malicious code introduced in versions 5.6.0 and 5.6.1.",
    "required_action": "Apply mitigations per vendor instructions or discontinue use of the product.",
    "notes": ""
  },
  "shadowserver": {
    "exploited": true,
    "observation_date": "2026-05-17",
    "vendor": "tukaani",
    "product": "xz",
    "class": "Supply Chain",
    "severity": "CRITICAL",
    "iot": false,
    "connections": 4231,
    "unique_ips": {
      "1d": 4231,
      "7d": 3987,
      "30d": 3542,
      "90d": 3108
    },
    "geo_daily": [
      {
        "date": "2026-05-17",
        "geo": "US",
        "event_type": "scan",
        "unique_ips": 812
      }
    ]
  },
  "risk": {
    "score": 97,
    "priority": "CRITICAL",
    "categories": ["Remote Code Execution"],
    "known_exploited": true,
    "seen_in_wild": true,
    "scored_at": "2026-05-17T12:00:00.000Z"
  },
  "classification": {
    "cwe_ids": ["CWE-506"],
    "vulnerability_types": ["Supply Chain"],
    "threat_actors": [],
    "malware_families": [],
    "targeted_industries": ["Technology"]
  },
  "cpe": [
    {
      "operator": "AND",
      "matches": [
        {
          "criteria": "cpe:2.3:a:tukaani:xz_utils:5.6.0:*:*:*:*:*:*:*",
          "vulnerable": true,
          "version_end_including": "5.6.1"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "source": "openwall.com",
      "tags": ["Mailing List", "Third Party Advisory"]
    }
  ],
  "timeline": [
    {
      "event": "kev_added",
      "at": "2024-03-29T00:00:00.000Z",
      "detail": "Added to CISA KEV"
    }
  ]
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

idstringoptional

The canonical CVE identifier (uppercased).

descriptionstring | nulloptional

English-language description from the NVD record.

publishedstringoptional

ISO 8601 timestamp of the NVD publication date (UTC).

last_modifiedstringoptional

ISO 8601 timestamp of the most recent NVD modification (UTC).

vuln_statusstringoptional

NVD analysis status, e.g. Analyzed, Awaiting Analysis, Undergoing Analysis.

severityobject | nulloptional

CVSS data from the highest available metric version (v3.1, then v3.0, then v2). Contains cvss_score (numeric), cvss_level (severity label), cvss_version, cvss_vector, impact_score, and exploitability_score. null when no CVSS data is present.

epssobject | nulloptional

EPSS exploit-probability data: score (0.0–1.0), percentile (0.0–1.0), delta_7d (7-day change), score_series_7d (array of the 7 most recent daily scores, oldest first), and updated_at timestamp. null when no EPSS data is available.

cisa_kevobjectoptional

CISA Known Exploited Vulnerabilities status. Always present. When listed is true, also includes date_added, due_date, vendor, product, vulnerability_name, short_description, required_action, and notes. When not listed, only listed: false is returned.

shadowserverobjectoptional

Shadowserver honeypot data for this CVE. Always present. When exploited is true, also includes observation_date, vendor, product, class (vulnerability class), severity, iot (boolean), connections (total), unique_ips (object with rolling averages at 1d, 7d, 30d, and 90d), and geo_daily (array of per-country daily rows, up to 50 entries from the past 30 days). When no Shadowserver data exists, only exploited: false and an empty geo_daily array are returned.

riskobject | nulloptional

Precursor Intelligence risk assessment: score (0–100), priority (CRITICAL/HIGH/MEDIUM/LOW), categories (array of risk category strings), known_exploited (boolean), seen_in_wild (boolean), and scored_at timestamp. null when no risk score has been computed.

classificationobjectoptional

Structured classification data: cwe_ids (array of CWE identifiers), vulnerability_types, threat_actors, malware_families, and targeted_industries. Arrays default to empty when no data is available.

cpearrayoptional

CPE applicability configurations from the NVD record. Each entry has an operator string and a matches array. Each match includes criteria (CPE URI), vulnerable (boolean), and optional version-boundary fields (version_start_including, version_start_excluding, version_end_including, version_end_excluding).

referencesarrayoptional

NVD reference links. Each entry contains url, source, and tags (array of NVD tag strings).

timelinearrayoptional

Timeline of significant events for this CVE. Each item has event (event type string), at (ISO 8601 timestamp), and detail (description string). Events include NVD publication, large EPSS delta shifts, and CISA KEV additions.

Errors

Code	Message	When
`-32602`	`invalid_params: cve_id: required_string`	The `cve_id` argument is missing.
`-32602`	`invalid_params: cve_id: pattern`	The value does not match the CVE identifier pattern.
`-32001`	`unauthorized`	The API key is invalid or revoked.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

If the CVE identifier is well-formed but not in the dataset, the tool returns a successful response with a payload of { "error": "not_found" } and the credit is refunded automatically.

For a complete reference of JSON-RPC error codes, see Errors.