Blacklists

`lookup_ssl_blacklist`

Check the SSL blacklist to determine whether a SHA-1 TLS certificate fingerprint is associated with botnet command-and-control infrastructure or malware distribution. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

sha1_fingerprintstringrequired

SHA-1 fingerprint of the TLS certificate to look up. Must be exactly 40 hexadecimal characters (pattern ^[0-9a-fA-F]{40}$). Normalized to lowercase server-side before matching.

Example invocation

Ask your agent: "Is the certificate with SHA-1 fingerprint a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4 on the SSL blacklist?"

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_ssl_blacklist","arguments":{"sha1_fingerprint":"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4"}}}'

Response

When the fingerprint is found in the blacklist:

result.content[0].text (parsed, match)

{
  "sha1_fingerprint": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4",
  "listed": true,
  "listing_date": "2025-09-14T00:00:00Z",
  "listing_reason": "Cobalt Strike C2",
  "generated_at": "2026-05-29T11:04:22.381Z"
}

When the fingerprint is not found:

result.content[0].text (parsed, no match)

{
  "sha1_fingerprint": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4",
  "listed": false,
  "generated_at": "2026-05-29T11:04:22.381Z"
}

The full MCP envelope (including _meta.precursor with request_id, credits, and generated_at) is described in Response Format.

A fingerprint that is not present in the blacklist returns a successful response with listed: false. No credit is charged for a lookup that produces no match.

Errors

Code	Message	When
`-32602`	`invalid_params: sha1_fingerprint: required_string`	`sha1_fingerprint` was not provided
`-32602`	`invalid_params: sha1_fingerprint: pattern`	Value is not a valid 40-character hex string
`-32001`	`unauthorized`	API key is invalid, revoked, or the request IP is not on the allowlist
`-32002`	`insufficient_credits`	Your credit balance is zero
`-32603`	`internal`	Unexpected server error; credit is automatically refunded