Shadowserver

`list_shadowserver_top_vendors`

Returns the top vendors ranked by Shadowserver honeypot connection volume over a configurable look-back window. Use this to identify which vendor ecosystems are most actively targeted at a given moment. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

daysintegeroptionaldefault: 30

Look-back window in days. Must be between 1 and 30.

limitintegeroptionaldefault: 25

Maximum number of vendors to return. Must be between 1 and 50.

Example invocation

Ask your agent: "Which vendors are seeing the most Shadowserver honeypot activity over the last 7 days?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_shadowserver_top_vendors","arguments":{"days":7,"limit":10}}}'

Response

result.content[0].text (parsed)

{
  "count": 10,
  "days": 7,
  "limit": 10,
  "items": [
    { "vendor": "microsoft", "connections": 81412, "cve_count": 14 },
    { "vendor": "fortinet",  "connections": 42188, "cve_count": 9  },
    { "vendor": "cisco",     "connections": 31047, "cve_count": 7  }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope, including _meta.precursor with request ID and credit info, is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: days: min:1`	`days` is less than 1
`-32602`	`invalid_params: days: max:30`	`days` exceeds 30
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:50`	`limit` exceeds 50
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero

See Errors for the full error reference.