IOCs

`list_recent_iocs`

Returns IOCs first seen in the last N days, optionally filtered by IOC type. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

ioc_typestringoptional

Filter results to a single IOC type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Common values include domain, url, ip:port, and sha256_hash.

daysintegeroptionaldefault: 1

Look-back window in days. Accepted range: 1–7. The window is intentionally short because broader windows can exceed the 1 MiB response cap.

limitintegeroptionaldefault: 100

Maximum number of IOC records to return. Accepted range: 1–200.

Example invocation

Ask your agent: "Show me all domain IOCs added to the feed in the last 24 hours."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_recent_iocs","arguments":{"ioc_type":"domain","days":1,"limit":100}}}'

Response

result.content[0].text (parsed)

{
  "count": 3,
  "days": 1,
  "ioc_type": "domain",
  "limit": 100,
  "items": [
    {
      "id": 80421,
      "ioc_value": "phish-cdn-update.org",
      "ioc_type": "domain",
      "threat_type": "payload_delivery",
      "malware_printable": "QakBot",
      "first_seen_utc": "2026-05-28T03:11:00Z",
      "last_seen_utc": "2026-05-28T09:44:00Z",
      "confidence_level": 75,
      "tags": ["phishing", "qakbot"]
    },
    {
      "id": 80418,
      "ioc_value": "update-secure-login.net",
      "ioc_type": "domain",
      "threat_type": "phishing",
      "malware_printable": "AgentTesla",
      "first_seen_utc": "2026-05-28T01:47:00Z",
      "last_seen_utc": "2026-05-28T08:02:00Z",
      "confidence_level": 80,
      "tags": ["credential-theft"]
    },
    {
      "id": 80401,
      "ioc_value": "cdn-static-assets.ru",
      "ioc_type": "domain",
      "threat_type": "botnet_cc",
      "malware_printable": "Emotet",
      "first_seen_utc": "2026-05-27T22:09:00Z",
      "last_seen_utc": "2026-05-28T05:31:00Z",
      "confidence_level": 90,
      "tags": ["botnet", "emotet"]
    }
  ],
  "generated_at": "2026-05-29T10:24:31.118Z"
}

The full MCP envelope (including _meta.precursor with request ID, credits, and truncation flag) is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: ioc_type: pattern`	`ioc_type` contains characters outside `^[a-z0-9_-]+$` or exceeds 40 characters
`-32602`	`invalid_params: days: min:1`	`days` is less than 1
`-32602`	`invalid_params: days: max:7`	`days` exceeds 7
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:200`	`limit` exceeds 200
`-32001`	`unauthorized`	API key is invalid, revoked, or the request originated from a disallowed IP
`-32002`	`insufficient_credits`	Your organisation has no credits remaining. Top up from the dashboard.

For the complete error reference, see Errors.