Shadowserver

`get_shadowserver_daily_stats`

Returns aggregate Shadowserver honeypot statistics for each day in the requested window, including unique IP counts, total connections, and the number of active and distinct CVEs observed. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

daysintegeroptionaldefault: 30

Look-back window in days. Must be between 1 and 90.

Example invocation

Ask your agent: "Show me the daily Shadowserver honeypot baseline for the past 60 days."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_shadowserver_daily_stats","arguments":{"days":60}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "days": 60,
  "items": [
    {
      "observation_date": "2026-05-17",
      "dimension": "port",
      "dimension_value": "445",
      "unique_ips": 188412,
      "connections": 4231998,
      "active_cves": 2812,
      "distinct_cves": 1412
    },
    {
      "observation_date": "2026-05-16",
      "dimension": "port",
      "dimension_value": "445",
      "unique_ips": 191037,
      "connections": 4318204,
      "active_cves": 2790,
      "distinct_cves": 1398
    }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

Note: the full MCP envelope (including _meta.precursor credits and request ID) is described in Response Format.

Response fields

countintegeroptional

Total number of rows returned across all dimensions in the window.

daysintegeroptional

The look-back window that was applied, in days.

itemsarrayoptional

One entry per calendar day and dimension combination in the window, ordered newest first by date, then by connection volume descending. Each object contains the fields described below.

items[].observation_datestringoptional

Observation date in YYYY-MM-DD format (UTC).

items[].dimensionstringoptional

The grouping dimension for this row (for example, "port" or "protocol").

items[].dimension_valuestringoptional

The value of the dimension for this row (for example, "445" or "tcp").

items[].unique_ipsintegeroptional

Number of unique source IP addresses observed by Shadowserver honeypots on this date for this dimension.

items[].connectionsintegeroptional

Total connection attempts logged across all honeypot sensors on this date for this dimension.

items[].active_cvesintegeroptional

Count of CVEs that had at least one connection recorded on this date for this dimension.

items[].distinct_cvesintegeroptional

Count of distinct CVEs with activity, de-duplicated across all sensors on this date for this dimension.

generated_atstringoptional

ISO 8601 timestamp indicating when the response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: days: min:1`	`days` is less than 1.
`-32602`	`invalid_params: days: max:90`	`days` is greater than 90.
`-32001`	`unauthorized`	The API key is invalid, revoked, or not permitted from this IP address.
`-32002`	`insufficient_credits`	The account has no credits remaining.
`-32603`	`internal`	An unexpected server error occurred. The credit is refunded automatically.

See Errors for the full error reference.