CVE & EPSS

`get_cve_threat_actors`

Threat actors reported to have exploited a given CVE, each with the evidence quote and source URL that attributes it. The reverse of list_threat_actor_cves, and the fastest way to answer "is anyone actually using this?" when triaging a patch queue. An empty result means no source has been ingested linking an actor to this CVE — not that none exists. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

cve_idstringrequired

CVE identifier, e.g. "CVE-2021-44228". Case-insensitive; validated against ^CVE-[0-9]{4}-[0-9]{4,7}$.

limitintegeroptional

1–100. Defaults to 25.

Example invocation

Ask your agent:

Is anyone actually exploiting CVE-2021-44228 in the wild? Who, and what's the source?

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_cve_threat_actors",
      "arguments": { "cve_id": "CVE-2021-44228" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "cve_id": "CVE-2021-44228",
  "count": 18,
  "limit": 25,
  "items": [
    {
      "name": "RansomHub",
      "slug": "ransomhub",
      "actor_type": "ransomware",
      "actor_subtype": "extortion-only",
      "motivation": "financial",
      "relation": "exploited",
      "evidence_quote": "CVE-2021-44228 ( CWE-502 ) Apache Log4j2 contains a deserialization of untrusted data vulnerability...",
      "source_url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a",
      "citations": 1
    },
    {
      "name": "MirrorFace",
      "slug": "mirrorface",
      "actor_type": "apt",
      "suspected_origin_country": "China (PRC-aligned; assessed subgroup of APT10/menuPass)",
      "motivation": "espionage",
      "mitre_attack_id": "G1054",
      "relation": "exploited",
      "evidence_quote": "We observed that vulnerabilities of enterprise products were abused in the wild.",
      "source_url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html",
      "citations": 1
    }
  ],
  "generated_at": "2026-08-04T10:20:34.843Z"
}

When nothing is attributed, the payload carries an explicit note:

No attribution on record

{
  "cve_id": "CVE-1999-0001",
  "count": 0,
  "limit": 25,
  "items": [],
  "note": "No attributed threat actor claims for this CVE in the Precursor threat-intel dataset. This means no source has been ingested linking an actor to it, not that no actor exploits it.",
  "generated_at": "2026-08-04T10:20:34.843Z"
}

Using this well

Read the note before concluding

The note exists because an empty array is easy to over-read. "No source links an actor to this CVE" is a much weaker statement than "no actor exploits this CVE" — only the first is supported by the data. Say the first.

citations shows corroboration

evidence_quote is the strongest single citation. citations counts how many independent claims exist for that actor–CVE pair, so an agent can weigh corroboration without seeing internal confidence scores.

list_threat_actor_cves — the reverse: from an actor to its CVEs, with severity and patch ordering.
get_cve — the full CVE record, which embeds this same block under threat_actors.
get_threat_actor — full dossier for any actor returned here, by slug.

Errors

Code	Message	When
`-32602`	`invalid_params: cve_id: required_string`	The `cve_id` argument is missing.
`-32602`	`invalid_params: cve_id: pattern`	Not a well-formed CVE identifier.
`-32602`	`invalid_params: limit: range`	`limit` is outside 1–100.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

A well-formed CVE id with no attribution is a successful, billed call — count: 0, empty items, and the note above.