Threat Actors

`list_threat_actors_by_industry`

Threat actors reported to target a given industry (e.g. "Financial Services", "Healthcare", "Manufacturing"), each with the evidence quote and source URL. Industry names, slugs and aliases all match, and the response echoes which industry the query resolved to. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

industrystringrequired

Industry name, slug, or alias. 1–80 characters. Matching ignores case, spaces and punctuation, so "Financial Services", "financial-services" and "financialservices" all resolve to the same industry.

limitintegeroptional

1–100. Defaults to 50.

Example invocation

Ask your agent:

We're a healthcare provider. Which threat actors target our sector, and what's the evidence for each?

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "list_threat_actors_by_industry",
      "arguments": { "industry": "Healthcare", "limit": 5 }
    }
  }'

Response

result.content[0].text (parsed)

{
  "count": 5,
  "industry": "Healthcare",
  "matched_industries": [
    { "name": "Healthcare", "slug": "healthcare" }
  ],
  "limit": 5,
  "items": [
    {
      "name": "APT29",
      "slug": "apt29",
      "actor_type": "apt",
      "suspected_origin_country": "Russia (SVR)",
      "motivation": "espionage",
      "mitre_attack_id": "G0016",
      "relation": "targeted",
      "evidence_quote": "The group targeted COVID-19 vaccine research organisations across the UK, US and Canada.",
      "source_url": "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development",
      "counts": { "techniques": 66, "cves": 7 }
    }
  ],
  "generated_at": "2026-08-04T10:20:34.843Z"
}

Always check matched_industries

It reports what your string actually resolved to. An empty array means nothing matched — say "I couldn't resolve that industry", not "no actors target it". Those are very different answers.

One row per actor

An actor claimed against the same industry by several sources appears once, carrying its strongest citation. Call get_threat_actor for that actor's full industry list with every citation.

get_threat_actor — full dossier for one actor.
get_my_industry — the caller's own industry, so an agent can run this without asking.

Errors

Code	Message	When
`-32602`	`invalid_params: industry: required_string`	The `industry` argument is missing.
`-32602`	`invalid_params: industry: length`	Industry exceeds 80 characters.
`-32602`	`invalid_params: limit: range`	`limit` is outside 1–100.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

An unrecognised industry returns a successful response with empty matched_industries and items. The credit is charged.

list_threat_actors_by_industry

Parameters

Example invocation

Response

Related tools

Errors

`list_threat_actors_by_industry`