Threat Actors

`list_threat_actors`

Returns the top threat actors ranked by reporting frequency. Accepts an optional limit to control how many actors are returned. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

limitintegeroptionaldefault: 25

Maximum number of actors to return. Accepted range: 1–100.

Example invocation

Ask your agent: "Show me the top 10 most-reported threat actor groups right now."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_threat_actors","arguments":{"limit":10}}}'

Response

result.content[0].text (parsed)

{
  "count": 10,
  "items": [
    {
      "name": "APT29",
      "aliases": ["Cozy Bear", "NOBELIUM"],
      "mention_count": 412
    },
    {
      "name": "Lazarus Group",
      "aliases": ["Hidden Cobra", "ZINC"],
      "mention_count": 318
    },
    {
      "name": "APT41",
      "aliases": ["Double Dragon", "Winnti"],
      "mention_count": 276
    }
  ],
  "generated_at": "2026-05-29T09:15:04.321Z"
}

The count field reflects the number of items returned, not a grand total. For the full MCP envelope (including _meta.precursor with request_id, credits, and response_truncated), see Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:100`	`limit` exceeds 100
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero