Malware Samples

`list_top_malware`

Returns the most-referenced malware families across intelligence reporting, ranked by mention count. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

limitintegeroptionaldefault: 10

Maximum number of malware families to return. Accepts 1–50.

Example invocation

Ask your agent: "What are the top 15 malware families showing up most frequently in threat reporting?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_top_malware","arguments":{"limit":15}}}'

Response

result.content[0].text (parsed)

{
  "count": 15,
  "items": [
    { "family": "Cobalt Strike", "mention_count": 412, "first_blogged": "2014-03-01" },
    { "family": "QakBot",        "mention_count": 287, "first_blogged": "2008-09-15" },
    { "family": "Emotet",        "mention_count": 261, "first_blogged": "2014-06-10" }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:50`	`limit` exceeds 50
`-32001`	`unauthorized`	API key is invalid, revoked, or not permitted from this IP
`-32002`	`insufficient_credits`	Account has no remaining credits