Shadowserver

`list_shadowserver_top_cves`

Returns the top CVEs ranked by Shadowserver honeypot connection volume over a configurable look-back window. Use it to spot which vulnerabilities are being actively probed at scale right now. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

daysintegeroptionaldefault: 30

Look-back window in days. Must be between 7 and 90.

limitintegeroptionaldefault: 50

Maximum number of CVEs to return. Must be between 1 and 100.

Example invocation

Ask your agent: "Which CVEs are generating the most Shadowserver honeypot traffic right now? Give me the top 20 over the last 14 days."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_shadowserver_top_cves","arguments":{"days":14,"limit":20}}}'

Response

result.content[0].text (parsed)

{
  "count": 20,
  "days": 14,
  "limit": 20,
  "sort_column": "connections_7d",
  "items": [
    {
      "cve_id": "CVE-2024-3094",
      "vendor": "xz",
      "product": "xz-utils",
      "severity": "critical",
      "cvss": 10.0,
      "epss_score": 0.9741,
      "cisa_kev": true,
      "iot": false,
      "vulnerability_class": "supply-chain",
      "connections_7d": 218412,
      "connections_30d": 874103,
      "connections_90d": 2104981,
      "connections_total": 3198476,
      "action_priority": 1,
      "nvd_published": "2024-03-29",
      "summary_as_of": "2026-05-28"
    },
    {
      "cve_id": "CVE-2023-44487",
      "vendor": "apache",
      "product": "tomcat",
      "severity": "high",
      "cvss": 7.5,
      "epss_score": 0.8823,
      "cisa_kev": true,
      "iot": false,
      "vulnerability_class": "denial-of-service",
      "connections_7d": 104837,
      "connections_30d": 412904,
      "connections_90d": 1021433,
      "connections_total": 2108745,
      "action_priority": 2,
      "nvd_published": "2023-10-10",
      "summary_as_of": "2026-05-28"
    }
  ],
  "generated_at": "2026-05-29T08:14:22.341Z"
}

The full MCP envelope (including _meta.precursor with request ID and credit details) is described in Response Format.

Response fields

countintegeroptional

Number of items returned (equals items.length).

daysintegeroptional

The look-back window used for this query, in days.

limitintegeroptional

The maximum row count applied to this query.

sort_columnstringoptional

The connection-count column used to rank results: connections_7d, connections_30d, or connections_90d, depending on the days value.

itemsarrayoptional

CVE records ranked by connection volume, highest first. Each item contains the fields listed below.

items[].cve_idstringoptional

CVE identifier (for example, CVE-2024-3094).

items[].vendorstringoptional

Vendor name associated with the CVE.

items[].productstringoptional

Product name associated with the CVE.

items[].severitystringoptional

CVSS severity label: critical, high, medium, or low.

items[].cvssnumberoptional

CVSS base score (0.0–10.0).

items[].epss_scorenumberoptional

EPSS probability score (0.0–1.0).

items[].cisa_kevbooleanoptional

Whether the CVE appears in the CISA Known Exploited Vulnerabilities catalog.

items[].iotbooleanoptional

Whether the CVE is associated with IoT devices.

items[].vulnerability_classstringoptional

Vulnerability class or category (for example, rce, denial-of-service).

items[].connections_7dintegeroptional

Total honeypot connections observed in the last 7 days.

items[].connections_30dintegeroptional

Total honeypot connections observed in the last 30 days.

items[].connections_90dintegeroptional

Total honeypot connections observed in the last 90 days.

items[].connections_totalintegeroptional

Total honeypot connections observed across all time.

items[].action_priorityintegeroptional

Remediation priority ranking assigned to this CVE.

items[].nvd_publishedstringoptional

Date the CVE was published in NVD (ISO 8601 date).

items[].summary_as_ofstringoptional

Date through which the summary data was last computed (ISO 8601 date).

generated_atstringoptional

ISO 8601 timestamp indicating when the response was produced.

Errors

Code	Message	When
`-32602`	`invalid_params: days: min:7`	`days` is less than 7.
`-32602`	`invalid_params: days: max:90`	`days` is greater than 90.
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1.
`-32602`	`invalid_params: limit: max:100`	`limit` is greater than 100.
`-32001`	`unauthorized`	API key is invalid, revoked, or the request IP is not on the allowlist.
`-32002`	`insufficient_credits`	Your credit balance is zero. Top up from the dashboard.
`-32603`	`internal`	An unexpected server error occurred. The credit is automatically refunded.