Threat Actors

`list_threat_actor_cves`

The CVEs a threat actor is reported to have exploited, each with the evidence quote and source URL, plus CVSS, EPSS, CISA KEV status and action priority. Ordered KEV-first then by exploit probability. This is the tool for "group X is in the news, what should we patch?" — it answers in one call. Accepts a slug, alias or display name. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

namestringrequired

Slug, alias, or display name — all three resolve. 1–120 characters. Examples: "safepay", "Cozy Bear", "APT29".

limitintegeroptional

1–200. Defaults to 50.

Example invocation

Ask your agent:

SafePay is in the news. Which vulnerabilities do they exploit, and which should we patch first?

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "list_threat_actor_cves",
      "arguments": { "name": "safepay" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "actor": {
    "name": "SafePay",
    "slug": "safepay",
    "query": "safepay",
    "matched_on": "slug"
  },
  "count": 2,
  "total": 2,
  "limit": 50,
  "items": [
    {
      "cve_id": "CVE-2023-27997",
      "relation": "exploited",
      "evidence_quote": "FortiOS SSL VPN Heap Buffer Overflow CVE-2023-27997 Pre-authentication module vulnerability allows remote code execution through heap overflow exploitation",
      "source_url": "https://www.halcyon.ai/threat-group/safepay",
      "cvss_score": 9.8,
      "epss_score": 0.85689,
      "risk_score": 88,
      "action_priority": "Emergency patch",
      "cisa_kev_listed": true,
      "cisa_kev_due": "2023-07-04"
    },
    {
      "cve_id": "CVE-2024-21762",
      "relation": "exploited",
      "evidence_quote": "FortiOS SSL VPN Out-of-Bounds Write CVE-2024-21762 9.8 Enables remote unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests",
      "source_url": "https://www.halcyon.ai/threat-group/safepay",
      "cvss_score": 9.8,
      "epss_score": 0.80835,
      "risk_score": 90,
      "action_priority": "Emergency patch",
      "cisa_kev_listed": true,
      "cisa_kev_due": "2024-02-16"
    }
  ],
  "generated_at": "2026-08-04T10:20:34.843Z"
}

Ordering

CISA KEV first, then EPSS descending, then CVSS descending — the order a remediation queue wants, not ingestion order. An agent can read the list top-down and the answer is already prioritised.

Using this well

Pair it with the caller's own exposure

This tool returns what the actor exploits, not what you run. Cross-reference with list_my_vulnerabilities or map_assets_to_actor (both mcp:org) to turn "they exploit these" into "you are exposed to these".

Absence is not evidence

An empty items array means no ingested source links this actor to a CVE. Report it as "no CVE attribution on record", never as "this group exploits nothing".

One row per CVE

If several sources attribute the same CVE to the actor, it appears once with its strongest citation. For every citation, use get_cve_threat_actors on that CVE.

get_cve_threat_actors — the reverse lookup, from a CVE to the actors exploiting it.
get_threat_actor — full dossier.
get_cve — the full record for any CVE listed here.

Errors

Code	Message	When
`-32602`	`invalid_params: name: required_string`	The `name` argument is missing.
`-32602`	`invalid_params: name: length`	Name exceeds 120 characters.
`-32602`	`invalid_params: limit: range`	`limit` is outside 1–200.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

An unknown actor is a success, and it is billed

A well-formed name matching nothing returns a successful response with { "error": "not_found", "name": "…" }. The credit is not refunded — refunds only fire when the query errors or times out. Check for an error key first.

list_threat_actor_cves