Shadowserver

`get_shadowserver_cve_activity`

Returns daily Shadowserver honeypot observations for a single CVE over a configurable look-back window. Use this tool to understand how actively a vulnerability is being scanned or exploited across the internet. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

cve_idstringrequired

CVE identifier. Must match ^CVE-[0-9]{4}-[0-9]{4,7}$. The value is uppercased server-side, so cve-2024-3094 is accepted.

daysintegeroptionaldefault: 30

Number of days to look back. Accepted range: 1–90.

Example invocation

Ask your agent: "Show me the Shadowserver honeypot activity for CVE-2024-3094 over the last 60 days."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_shadowserver_cve_activity","arguments":{"cve_id":"CVE-2024-3094","days":60}}}'

Response

result.content[0].text (parsed)

{
  "cve_id": "CVE-2024-3094",
  "days": 60,
  "summary": {
    "cve_id": "CVE-2024-3094",
    "vendor": "xz",
    "product": "xz-utils",
    "severity": "Critical",
    "cvss": 10.0,
    "cisa_kev": true,
    "iot": false,
    "vulnerability_class": "Supply Chain",
    "first_seen": "2024-04-02",
    "last_seen": "2026-05-17",
    "connections_total": 841203,
    "connections_7d": 29841,
    "connections_30d": 118204,
    "connections_90d": 312900,
    "action_priority": "Immediate",
    "epss_score": 0.9732,
    "epss_percentile": 0.9991,
    "nvd_published": "2024-03-29",
    "summary_as_of": "2026-05-17"
  },
  "observations": [
    { "observation_date": "2026-05-17", "unique_ips": 188 },
    { "observation_date": "2026-05-16", "unique_ips": 172 },
    { "observation_date": "2026-05-15", "unique_ips": 161 }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope (including _meta.precursor with request_id, credits, and response_truncated) is described in Response Format.

Response fields

Field	Type	Description
`cve_id`	string	The CVE identifier as stored (uppercased).
`days`	integer	The look-back window used for this query.
`summary`	object or null	Aggregate statistics for the CVE across all time and fixed windows. `null` if the CVE has no Shadowserver records.
`summary.vendor`	string	Vendor name associated with the CVE.
`summary.product`	string	Product name associated with the CVE.
`summary.severity`	string	Vulnerability severity label (e.g. `Critical`, `High`).
`summary.cvss`	number	CVSS base score.
`summary.cisa_kev`	boolean	Whether the CVE appears in the CISA Known Exploited Vulnerabilities catalog.
`summary.iot`	boolean	Whether the CVE has been observed targeting IoT devices.
`summary.vulnerability_class`	string	Broad vulnerability class (e.g. `Remote Code Execution`).
`summary.first_seen`	string	Earliest observation date in `YYYY-MM-DD` format.
`summary.last_seen`	string	Most recent observation date in `YYYY-MM-DD` format.
`summary.connections_7d`	integer	Total honeypot connections in the last 7 days.
`summary.connections_30d`	integer	Total honeypot connections in the last 30 days.
`summary.connections_90d`	integer	Total honeypot connections in the last 90 days.
`summary.connections_total`	integer	Total honeypot connections across all time.
`summary.action_priority`	string	Recommended action priority derived from CISA KEV and EPSS data.
`summary.epss_score`	number	EPSS probability score (0.0–1.0).
`summary.epss_percentile`	number	EPSS percentile ranking (0.0–1.0).
`summary.nvd_published`	string	NVD publication date in `YYYY-MM-DD` format.
`summary.summary_as_of`	string	Date through which the summary statistics are computed.
`observations`	array	One entry per calendar day within the window, sorted descending by date. Empty array if no observations exist.
`observations[].observation_date`	string	Observation date in `YYYY-MM-DD` format.
`observations[].unique_ips`	integer	Unique source IPs observed on this date.
`generated_at`	string	ISO 8601 timestamp when the response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: cve_id: required_string`	`cve_id` was not supplied.
`-32602`	`invalid_params: cve_id: pattern`	`cve_id` does not match `^CVE-[0-9]{4}-[0-9]{4,7}$`.
`-32602`	`invalid_params: days: min:1`	`days` is less than 1.
`-32602`	`invalid_params: days: max:90`	`days` is greater than 90.
`-32001`	`unauthorized`	API key is invalid, revoked, or not permitted from this IP.
`-32002`	`insufficient_credits`	Credit balance is zero. Top up from the dashboard.
`-32603`	`internal`	Unexpected server error. The credit is automatically refunded.

If the CVE exists but has no Shadowserver observations in the requested window, the tool returns a successful response with an empty observations array and a null summary. No credit is charged for a lookup that returns no data due to a missing entity.

For the full error reference, see Errors.