MITRE ATT&CK

`list_top_mitre_techniques`

Returns the most-referenced MITRE ATT&CK techniques across intelligence reporting, ranked by mention count. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

limitintegeroptionaldefault: 10

Number of techniques to return. Accepts 1 to 50.

Example invocation

Ask your agent: "Which MITRE ATT&CK techniques appear most often in threat intelligence reporting?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_top_mitre_techniques","arguments":{"limit":10}}}'

Response

result.content[0].text (parsed)

{
  "count": 10,
  "items": [
    { "technique_id": "T1059.001", "name": "PowerShell", "mention_count": 312 },
    { "technique_id": "T1566.001", "name": "Spearphishing Attachment", "mention_count": 287 },
    { "technique_id": "T1078", "name": "Valid Accounts", "mention_count": 241 },
    { "technique_id": "T1486", "name": "Data Encrypted for Impact", "mention_count": 198 }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope (including _meta.precursor with request ID and credit info) is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:50`	`limit` exceeds 50
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero