CWE

`list_cwes`

Search the CWE catalog (~964 records) by keyword. Returns matching weaknesses with their abstraction level and description. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

querystringoptional

Keyword to match against CWE names and descriptions. 1–80 characters. Omit to return the top entries up to limit.

limitintegeroptionaldefault: 50

Maximum number of results to return. 1–100.

Example invocation

Ask your agent: "Find CWEs related to authentication, show me up to 20."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_cwes","arguments":{"query":"authentication","limit":20}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "query": "authentication",
  "limit": 20,
  "items": [
    {
      "cwe_id": 287,
      "name": "Improper Authentication",
      "abstraction": "Class",
      "status": "Stable",
      "likelihood_of_exploit": "Medium",
      "description": "When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct."
    },
    {
      "cwe_id": 798,
      "name": "Use of Hard-coded Credentials",
      "abstraction": "Variant",
      "status": "Stable",
      "likelihood_of_exploit": "Medium",
      "description": "The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."
    }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: query: length:1..80`	`query` is provided but is empty or exceeds 80 characters
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:100`	`limit` exceeds 100
`-32001`	`unauthorized`	API key is invalid, revoked, or the request originates from a disallowed IP
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard