IOCs

`lookup_ioc`

Performs an exact-match lookup of a single IOC value across the IOC feed and blog-derived IOC references, returning enrichment data when the value is known. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

valuestringrequired

The exact IOC value to look up (domain, IP address, URL, or file hash). Must be 1–255 characters. This tool performs exact matching only; for substring search across 1M+ IOCs use search_iocs.

Example invocation

Ask your agent: "Is evil-azure-update.com a known IOC? What threat type is it associated with?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_ioc","arguments":{"value":"evil-azure-update.com"}}}'

Response

result.content[0].text (parsed)

{
  "value": "evil-azure-update.com",
  "iocs": [
    {
      "id": 4819023,
      "ioc_type": "domain",
      "threat_type": "botnet_cc",
      "malware": "cobalt_strike",
      "malware_printable": "Cobalt Strike",
      "confidence_level": 90,
      "first_seen_utc": "2026-05-16T11:00:00Z",
      "last_seen_utc": "2026-05-27T03:14:00Z",
      "is_compromised": false,
      "tags": ["c2", "cobalt-strike"],
      "reporter": "community"
    }
  ],
  "blog_iocs": [
    {
      "blog_guid": "3f2a1b4c-9e8d-4a2b-b1c3-7d6e5f4a3b2c",
      "ioc_type": "domain",
      "context": "C2 domain used in Cobalt Strike campaign targeting financial sector",
      "confidence": 85,
      "verified": true,
      "false_positive": false,
      "created_at": "2026-05-17T08:00:00Z"
    }
  ],
  "blog_enrichment": [
    {
      "source": "threat_report",
      "data": {
        "threat_actors": ["FIN7"],
        "report_url": "https://example.com/cobalt-strike-campaign"
      },
      "created_at": "2026-05-17T08:05:00Z"
    }
  ],
  "generated_at": "2026-05-29T10:24:31.118Z"
}

When the value is not found in any source, the response is a successful call with all arrays empty:

result.content[0].text (parsed, not found)

{
  "value": "not-a-known-ioc.example.com",
  "iocs": [],
  "blog_iocs": [],
  "blog_enrichment": [],
  "generated_at": "2026-05-29T10:24:31.118Z"
}

The full MCP envelope (including _meta.precursor with request_id, credits, and generated_at) is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: value: required_string`	`value` was not provided
`-32602`	`invalid_params: value: length:1..255`	`value` is empty or exceeds 255 characters
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; credit is automatically refunded