Malware Samples

`get_malware_sample`

Retrieves a single malware sample from the malware sample corpus by its SHA-256 hash, returning key metadata and the detected signature. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

sha256stringrequired

SHA-256 hash of the sample, exactly 64 hexadecimal characters (pattern ^[0-9a-fA-F]{64}$). The value is lowercased server-side before lookup.

Example invocation

Ask your agent: "Pull the malware sample details for the file with SHA-256 3b4da4eb7b6c4da34e2ed72c558f3ec1a4a3c8a1fdf49fa1e2c5d6a7b8c9d0e1."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_malware_sample","arguments":{"sha256":"3b4da4eb7b6c4da34e2ed72c558f3ec1a4a3c8a1fdf49fa1e2c5d6a7b8c9d0e1"}}}'

Response

result.content[0].text (parsed)

{
  "sha256_hash": "3b4da4eb7b6c4da34e2ed72c558f3ec1a4a3c8a1fdf49fa1e2c5d6a7b8c9d0e1",
  "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
  "md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
  "file_name": "update.dll",
  "file_type": "dll",
  "file_size": 1245120,
  "signature": "QakBot",
  "first_seen": "2026-05-17T08:11:00Z",
  "last_seen": "2026-05-18T01:02:00Z",
  "reporter": "precursor_intelligence",
  "downloads": 14,
  "uploads": 3,
  "tags": ["loader", "banker"],
  "clamav_detections": ["Win.Trojan.Qakbot-12345"],
  "cert_subject_cn": null,
  "cert_issuer_cn": null,
  "cert_cscb_listed": false,
  "generated_at": "2026-05-29T12:00:00Z"
}

The full MCP envelope structure is described in Response Format.

If the SHA-256 hash is well-formed but does not match any sample in the corpus, the response is a successful call with the payload { "error": "not_found", "sha256": "<queried_hash>" } and the credit is refunded automatically.

Errors

Code	Message	When
`-32602`	`invalid_params: sha256: required_string`	`sha256` was not provided
`-32602`	`invalid_params: sha256: pattern`	Hash is not exactly 64 hex characters
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; credit is refunded automatically

See Errors for the full error reference.