CPE & Vendors

`get_vendor_product_version`

Returns up to 200 CVEs affecting a specific vendor, product, and version, with full compact CVE records and a truncation flag when the result set exceeds the 200-record cap. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

vendorstringrequired

Vendor name as it appears in the CPE dictionary. 1–128 characters. Lowercased server-side.

productstringrequired

Product name as it appears in the CPE dictionary. 1–128 characters. Lowercased server-side.

versionstringrequired

Exact product version string. 1–128 characters. Case-preserved server-side (versions can be alphanumeric, e.g. 5.6.1, 11.0.0.2, 2019_cu14).

Example invocation

Ask your agent:

What CVEs affect xz version 5.6.1, and are any of them in the CISA KEV catalog?

Raw JSON-RPC:

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_vendor_product_version",
      "arguments": {
        "vendor": "tukaani",
        "product": "xz",
        "version": "5.6.1"
      }
    }
  }'

Response

result.content[0].text (parsed)

{
  "vendor": "tukaani",
  "product": "xz",
  "version": "5.6.1",
  "cve_count": 1,
  "returned": 1,
  "truncated": false,
  "cap": 200,
  "cves": {
    "CVE-2024-3094": {
      "id": "CVE-2024-3094",
      "description": "Malicious code was discovered in the upstream tarballs of xz Utils versions 5.6.0 and 5.6.1.",
      "published": "2024-03-29T17:15:21.000Z",
      "last_modified": "2026-02-11T09:24:01.000Z",
      "vuln_status": "Analyzed",
      "severity": {
        "cvss_score": 10.0,
        "cvss_level": "CRITICAL",
        "cvss_version": "3.1",
        "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "impact_score": 6.0,
        "exploitability_score": 3.9
      },
      "epss": {
        "score": 0.9401,
        "percentile": 0.998,
        "delta_7d": 0.0008,
        "score_series_7d": [0.9388, 0.9391, 0.9394, 0.9396, 0.9398, 0.9400, 0.9401],
        "updated_at": "2026-05-17T00:00:00.000Z"
      },
      "cisa_kev": {
        "listed": true,
        "date_added": "2024-03-29",
        "due_date": "2024-04-12",
        "vendor": "XZ Utils",
        "product": "XZ Utils",
        "vulnerability_name": "XZ Utils Supply Chain Compromise",
        "short_description": "XZ Utils contains a backdoor inserted through a supply-chain compromise that allows unauthorized remote access.",
        "required_action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "notes": ""
      },
      "shadowserver": {
        "exploited": true,
        "observation_date": "2026-05-01",
        "vendor": "XZ Utils",
        "product": "XZ Utils",
        "class": "RCE",
        "severity": "Critical",
        "iot": false,
        "connections": 4231,
        "unique_ips": {
          "1d": 812,
          "7d": 3087,
          "30d": 9412,
          "90d": 21003
        }
      },
      "risk": {
        "score": 97,
        "priority": "CRITICAL",
        "categories": ["Remote Code Execution"],
        "known_exploited": true,
        "seen_in_wild": true,
        "scored_at": "2026-05-17T00:00:00.000Z"
      },
      "classification": {
        "cwe_ids": ["CWE-506"],
        "vulnerability_types": ["Supply Chain"],
        "threat_actors": [],
        "malware_families": [],
        "targeted_industries": ["Technology"]
      },
      "intel": {
        "blog_mention_count": 42
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
          "source": "openwall.com",
          "tags": ["Mailing List", "Third Party Advisory"]
        }
      ]
    }
  }
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

vendorstringoptional

The normalized (lowercased) vendor name.

productstringoptional

The normalized (lowercased) product name.

versionstringoptional

The version string as supplied, with case preserved.

cve_countintegeroptional

Total number of CVEs associated with this vendor/product/version combination in the dataset, including any beyond the cap.

returnedintegeroptional

Number of CVE records included in this response. Equal to cve_count when truncated is false, otherwise 200.

truncatedbooleanoptional

true when the dataset contains more than 200 CVEs for this version and the response was clipped at the 200-record cap. Narrow your query by specifying a more precise version string if you need complete coverage.

capintegeroptional

The maximum number of CVE records returned in a single call. Always 200.

cvesobjectoptional

A JSON object (map) keyed by CVE ID. Each value is a compact CVE record containing: id, description, published, last_modified, vuln_status, severity (CVSS score, level, version, vector, impact score, and exploitability score), epss (score, percentile, 7-day delta, 7-day score series, and updated timestamp), cisa_kev (listing status and, when listed, dates, vendor, product, vulnerability name, description, required action, and notes), shadowserver (exploitation signal, observation date, vendor, product, vulnerability class, severity, IoT flag, connection count, and unique IP counts over 1, 7, 30, and 90 days), risk (score, priority, categories, known-exploited flag, seen-in-wild flag, and scored timestamp), classification (CWE IDs, vulnerability types, threat actors, malware families, and targeted industries), intel (community mention counts), and references.

Errors

Code	Message	When
`-32602`	`invalid_params: vendor: required_string`	The `vendor` argument is missing.
`-32602`	`invalid_params: vendor: length:1..128`	`vendor` exceeds 128 characters or is empty.
`-32602`	`invalid_params: product: required_string`	The `product` argument is missing.
`-32602`	`invalid_params: product: length:1..128`	`product` exceeds 128 characters or is empty.
`-32602`	`invalid_params: version: required_string`	The `version` argument is missing.
`-32602`	`invalid_params: version: length:1..128`	`version` exceeds 128 characters or is empty.
`-32001`	`unauthorized`	The API key is invalid, revoked, or the request IP is not on the allowlist.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

If the vendor, product, or version combination is well-formed but not present in the dataset, the tool returns a successful response with a payload of { "error": "not_found" } and the credit is refunded automatically.

For a complete reference of JSON-RPC error codes, see Errors.