Threat Actors

`get_threat_actor`

Retrieve the full intelligence record for a named threat group: description, aliases, attributed country, suspected sponsor, targeted categories, incident types, suspected victims, references, and ATT&CK technique count. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

namestringrequired

Threat actor name or known alias. 1–120 characters. Examples: "APT29", "Lazarus Group", "Sandworm".

Example invocation

Ask your agent:

Show me the Precursor Intelligence profile for APT29, including aliases, attributed country, and industries they typically target.

Raw JSON-RPC:

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_threat_actor",
      "arguments": { "name": "APT29" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "name": "APT29",
  "description": "Russian state-sponsored threat actor linked to SVR foreign intelligence operations, known for stealthy long-term espionage campaigns against government and critical-infrastructure targets worldwide.",
  "country": "RU",
  "suspected_sponsor": "SVR",
  "aliases": ["Cozy Bear", "NOBELIUM", "The Dukes"],
  "target_categories": ["Government", "Defense", "Think Tanks", "Healthcare"],
  "incident_types": ["Espionage", "Supply Chain Compromise"],
  "suspected_victims": ["US Department of State", "Democratic National Committee", "SolarWinds customers"],
  "references": [
    "https://attack.mitre.org/groups/G0016/",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a"
  ],
  "technique_count": 47,
  "generated_at": "2026-05-29T10:24:31.118Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: name: required_string`	The `name` argument is missing.
`-32602`	`invalid_params: name: length`	Name exceeds 120 characters.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

If the name is well-formed but does not match any actor in the dataset, the tool returns a successful response with a payload like { "error": "not_found", "name": "APT29" }. The credit is refunded automatically.