Your Data · Attack Surface

`list_my_vulnerabilities`

List your organisation's EdgeProtect vulnerability findings with per-finding instance counts. Filter by severity, minimum CVSS, KEV-only, or has-CVE. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

severitystringoptional

Optional. Filter to a single severity level, e.g. critical, high, medium, or low.

min_cvssnumberoptional

Optional. Only return findings with a CVSS base score at or above this value. Accepted range: 0–10.

kev_onlybooleanoptionaldefault: false

When true, only return findings whose CVE is listed in the CISA KEV catalog.

has_cvebooleanoptionaldefault: false

When true, only return findings that have an associated CVE identifier.

limitintegeroptionaldefault: 50

Maximum number of findings to return. Accepted range: 1–200.

Example invocation

Ask your agent: "Show our critical findings that have a CVE."

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_my_vulnerabilities","arguments":{"severity":"critical","has_cve":true,"limit":50}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "items": [
    {
      "title": "OpenSSH Pre-Auth Remote Code Execution",
      "severity": "critical",
      "cve_id": "CVE-2024-6387",
      "cvss_score": 9.8,
      "epss_score": 0.7421,
      "kev_status": true,
      "public_exploit_available": true,
      "status": "open",
      "instances": 4
    },
    {
      "title": "F5 BIG-IP Configuration Utility Authentication Bypass",
      "severity": "critical",
      "cve_id": "CVE-2023-46747",
      "cvss_score": 9.8,
      "epss_score": 0.9602,
      "kev_status": true,
      "public_exploit_available": true,
      "status": "open",
      "instances": 1
    }
  ],
  "generated_at": "2026-06-18T08:15:00.000Z"
}

The full MCP envelope, including _meta.precursor with request_id, credits, and response_truncated, is documented in Response Format.

Response fields

countintegeroptional

Number of findings returned (equals items.length).

itemsarrayoptional

Vulnerability findings for your organisation. Each object contains the fields below.

items[].titlestringoptional

Human-readable title of the finding.

items[].severitystringoptional

Severity label, e.g. critical, high, medium, or low.

items[].cve_idstring | nulloptional

Associated CVE identifier, or null when the finding has no CVE.

items[].cvss_scorenumber | nulloptional

CVSS base score for the finding, or null when unavailable.

items[].epss_scorenumber | nulloptional

EPSS exploit-probability score (0.0–1.0), or null when unavailable.

items[].kev_statusbooleanoptional

Whether the associated CVE is listed in the CISA KEV catalog.

items[].public_exploit_availablebooleanoptional

Whether a public exploit is known to be available for the finding.

items[].statusstringoptional

Current remediation status, e.g. open, fixed, or accepted.

items[].instancesintegeroptional

Number of instances of this finding across your assets.

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: min_cvss: min:0`	`min_cvss` is less than 0
`-32602`	`invalid_params: min_cvss: max:10`	`min_cvss` exceeds 10
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:200`	`limit` exceeds 200
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; the credit is automatically refunded