IOCs

`search_iocs`

Search 1M+ IOCs by substring across our IOC intelligence, optionally filtered by type, threat type, or malware family. Returns results sorted by first_seen_utc descending. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: array-rows

Parameters

querystringrequired

Substring to match against IOC values. 3–200 characters.

ioc_typestringoptional

Filter to a single IOC type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Common values: domain, ip, url, md5_hash, sha256_hash.

threat_typestringoptional

Filter to a threat type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Examples: botnet_cc, payload_delivery, malware_download.

malwarestringoptional

Filter to a malware family name. Maximum 80 characters.

limitintegeroptionaldefault: 50

Number of results to return. 1–200.

offsetintegeroptionaldefault: 0

Row offset for pagination. 0–2000.

Example invocation

Ask your agent: "Find recent Cobalt Strike C2 domains with 'azure' in the hostname."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_iocs","arguments":{"query":"azure","ioc_type":"domain","threat_type":"botnet_cc","malware":"Cobalt Strike","limit":25}}}'

Response

result.content[0].text (parsed)

{
  "count": 3,
  "items": [
    {
      "ioc_value": "azure-update-cdn.net",
      "ioc_type": "domain",
      "threat_type": "botnet_cc",
      "malware": "Cobalt Strike",
      "confidence": 90,
      "first_seen_utc": "2026-05-16T11:00:00Z",
      "last_seen_utc": "2026-05-17T22:18:00Z"
    },
    {
      "ioc_value": "azure-telemetry-svc.com",
      "ioc_type": "domain",
      "threat_type": "botnet_cc",
      "malware": "Cobalt Strike",
      "confidence": 85,
      "first_seen_utc": "2026-05-14T08:31:00Z",
      "last_seen_utc": "2026-05-17T19:45:00Z"
    }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope, including _meta.precursor with credit and request details, is described in Response Format.

Filter to avoid truncation

With 1M+ IOCs in the dataset, an unfiltered substring search will frequently hit the 1 MiB response cap. Provide ioc_type or threat_type whenever possible to narrow results. If the response is truncated, _meta.precursor.response_truncated is set to true.

Errors

Code	Message	When
`-32602`	`invalid_params: query: length:3..200`	`query` is fewer than 3 or more than 200 characters
`-32602`	`invalid_params: ioc_type: pattern`	`ioc_type` contains characters outside `^[a-z0-9_-]+$` or exceeds 40 characters
`-32602`	`invalid_params: threat_type: pattern`	`threat_type` contains characters outside `^[a-z0-9_-]+$` or exceeds 40 characters
`-32602`	`invalid_params: malware: max:80`	`malware` exceeds 80 characters
`-32602`	`invalid_params: limit: max:200`	`limit` is outside 1–200
`-32602`	`invalid_params: offset: max:2000`	`offset` is outside 0–2000
`-32001`	`unauthorized`	API key is invalid, revoked, or the request originates from a disallowed IP
`-32002`	`insufficient_credits`	Account has no remaining credits

Argument validation failures are never charged. See Errors for the full error reference.