Atomic Red Team

`list_art_atomic_tests`

Returns a paged list of Atomic Red Team atomic tests, optionally filtered by ATT&CK technique ID and platform. Useful for enumerating available test coverage before retrieving full test details with get_art_atomic_test. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

technique_idstringoptional

ATT&CK technique ID to filter by. Pattern: ^T[0-9]{4}(\.[0-9]{3})?$. Examples: T1059, T1059.001.

platformstringoptional

Platform slug to filter by. Max 40 characters, pattern ^[a-z0-9-]+$. Examples: windows, linux, macos.

limitintegeroptionaldefault: 50

Number of results to return. Range: 1–100.

offsetintegeroptionaldefault: 0

Row offset for pagination. Range: 0–2000. Increment by limit to step through large result sets.

Example invocation

Ask your agent: "List the first 25 Atomic Red Team tests for technique T1059.001 on Windows."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_art_atomic_tests","arguments":{"technique_id":"T1059.001","platform":"windows","limit":25,"offset":0}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "total": 14,
  "technique_id": "T1059.001",
  "platform": "windows",
  "limit": 25,
  "offset": 0,
  "items": [
    {
      "id": 4012,
      "name": "PowerShell -Enc",
      "description": "Executes an encoded PowerShell command to evade simple string-based detection.",
      "auto_generated_guid": "a3b2c1d0-1234-5678-abcd-ef0123456789",
      "supported_platforms": ["windows"],
      "attack_technique": "T1059.001",
      "display_name": "PowerShell"
    },
    {
      "id": 4013,
      "name": "PowerShell Download Cradle",
      "description": "Downloads and executes a remote script using a PowerShell download cradle.",
      "auto_generated_guid": "b4c3d2e1-2345-6789-bcde-f01234567890",
      "supported_platforms": ["windows"],
      "attack_technique": "T1059.001",
      "display_name": "PowerShell"
    }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope wrapping this payload is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: technique_id: pattern`	`technique_id` does not match `^T[0-9]{4}(\.[0-9]{3})?$`
`-32602`	`invalid_params: platform: pattern`	`platform` contains characters outside `^[a-z0-9-]+$`
`-32602`	`invalid_params: platform: max:40`	`platform` exceeds 40 characters
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:100`	`limit` exceeds 100
`-32602`	`invalid_params: offset: min:0`	`offset` is negative
`-32602`	`invalid_params: offset: max:2000`	`offset` exceeds 2000
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero

Argument-validation failures (-32602) are never charged. See Errors for the full error reference.