Malware Samples

`search_malware_samples`

Search the malware sample corpus by substring match across file name, signature, or hash values. Returns paginated results ordered by most recently seen. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: array-rows

Parameters

querystringrequired

Substring to match against file name, signature, SHA-256, SHA-1, or MD5 hash. Must be 3–200 characters.

file_typestringoptional

Filter results to a specific file type (for example, exe, dll, apk). Maximum 32 characters.

signaturestringoptional

Filter results to a specific malware signature or family name. Maximum 80 characters.

pageintegeroptionaldefault: 1

Page number for paginated results. Must be between 1 and 20.

page_sizeintegeroptionaldefault: 25

Number of items per page. Must be between 1 and 100.

Example invocation

Ask your agent: "Find QakBot DLL samples in the malware corpus."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_malware_samples","arguments":{"query":"qakbot","file_type":"dll","signature":"QakBot","page":1,"page_size":25}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "items": [
    {
      "sha256_hash": "a3f1e2b94c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2",
      "sha3_384_hash": null,
      "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
      "file_name": "update.dll",
      "file_size": 1245120,
      "file_type": "dll",
      "file_type_mime": "application/x-dosexec",
      "file_format": "PE32",
      "file_arch": "x86",
      "first_seen": "2026-05-17T08:11:00Z",
      "last_seen": "2026-05-19T12:04:00Z",
      "reporter": "analyst_42",
      "anonymous": false,
      "origin_country": "RU",
      "signature": "QakBot",
      "imphash": "7f4b9c2d1e8a3f6b0c5d2e9a4b7f1c3d",
      "tlsh": "T1A3A0027B2E8...",
      "telfhash": null,
      "gimphash": null,
      "ssdeep": "24576:abc123def456:xyz",
      "dhash_icon": null,
      "magika": "pebin",
      "trid": null,
      "archive_pw": null,
      "delivery_method": "email",
      "tags": ["dll", "QakBot", "dropped-by-emotet"],
      "intelligence": {"downloads": 12, "uploads": 1, "mail": {}},
      "code_signing": null,
      "yara_rules": [{"rule_name": "QakBot_loader", "author": "ditekshen", "description": "Detects QakBot loader", "reference": "https://github.com/ditekshen/detection"}],
      "vendor_intelligence": {},
      "comments": [],
      "references": [],
      "context": {},
      "file_information": {},
      "created_at": "2026-05-17T08:15:00Z",
      "updated_at": "2026-05-19T12:10:00Z"
    }
  ],
  "generated_at": "2026-05-29T10:24:31.118Z"
}

The full MCP envelope, including _meta.precursor with request_id, credits, and response_truncated, is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: query: length:3..200`	`query` is shorter than 3 characters or longer than 200
`-32602`	`invalid_params: file_type: max:32`	`file_type` exceeds 32 characters
`-32602`	`invalid_params: signature: max:80`	`signature` exceeds 80 characters
`-32602`	`invalid_params: page: min:1 / max:20`	`page` is outside the range 1–20
`-32602`	`invalid_params: page_size: min:1 / max:100`	`page_size` is outside the range 1–100
`-32001`	`unauthorized`	API key is invalid, revoked, or not permitted from this IP
`-32002`	`insufficient_credits`	Account has no remaining credits

Argument-validation errors never charge a credit. See Errors for the full error reference.