CPE & Vendors

`get_vendor_product`

Returns a product summary for a given vendor and product: total CVE count, version count, and a per-version breakdown with associated CVE IDs. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

vendorstringrequired

Vendor name. 1–128 characters. Case-insensitive on input.

productstringrequired

Product name. 1–128 characters. Case-insensitive on input.

Example invocation

Ask your agent: "How many CVEs affect Microsoft Exchange Server, and which versions are impacted?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_vendor_product","arguments":{"vendor":"microsoft","product":"exchange_server"}}}'

Response

result.content[0].text (parsed)

{
  "vendor": "microsoft",
  "product": "exchange_server",
  "cve_count": 412,
  "version_count": 38,
  "versions": {
    "2019": ["CVE-2021-26855", "CVE-2021-27065", "CVE-2024-21410"],
    "2016": ["CVE-2021-26855", "CVE-2022-41082", "CVE-2023-21529"]
  }
}

The full JSON-RPC envelope, including _meta.precursor with request_id, credits, and generated_at, is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: vendor: required_string`	`vendor` is missing or not a string
`-32602`	`invalid_params: vendor: length:1..128`	`vendor` exceeds 128 characters or is empty
`-32602`	`invalid_params: product: required_string`	`product` is missing or not a string
`-32602`	`invalid_params: product: length:1..128`	`product` exceeds 128 characters or is empty
`-32001`	`unauthorized`	API key is invalid, revoked, or the request IP is not on the allowlist
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error

If the vendor or product exists in the CPE data but has no associated CVEs, the response returns a valid payload with cve_count: 0 and an empty versions object ({}). Argument-validation failures never charge a credit.