Protocol

Transport

The Precursor Intelligence MCP server implements the MCP Streamable HTTP transport at protocol version 2025-06-18. This page is the wire-level reference. Most users will never need it, but if you are writing a custom client or debugging a hung connection, everything below is exact.

Endpoint

POST

https://mcp.precursorintelligence.com

A single URL serves every JSON-RPC method. There are no method-specific paths.

Request

Aspect	Value
HTTP method	`POST` (only)
Content-Type	`application/json`
Body	A single JSON-RPC 2.0 request object
Max body size	64 KiB (`65536` bytes)
Max JSON nesting	16 levels
Batch requests	Not supported
Required headers	`Authorization`, `Content-Type`

The jsonrpc field on the request must equal "2.0". The method field must be a string. Anything else returns -32600 invalid_request.

CORS preflight

OPTIONS requests return HTTP 204 with:

allow: POST, OPTIONS
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: authorization, content-type, mcp-protocol-version, mcp-session-id
access-control-max-age: 86400

No Access-Control-Allow-Origin header is set, so browsers cannot make direct cross-origin requests. See Authentication.

Response

Aspect	Value
HTTP status (success)	`200` for replies, `202` for `notifications/*`
Content-Type	`application/json; charset=utf-8`
Max response size	1 MiB (payloads above this are truncated)
Response shape	A single JSON-RPC 2.0 response object

There is no Server-Sent Events stream. Despite the "Streamable HTTP" label, every request returns a single response and the connection closes. The server never initiates messages to the client, so subscribing to a stream would yield nothing.

Truncation

If a tool's response payload exceeds 1 MiB after JSON serialisation, the text is truncated with the literal suffix "...[truncated]" and the envelope's _meta.precursor.response_truncated flag is set to true. Tighten your query (lower limit, add filters) to avoid this; there is no pagination cursor across truncation.

Supported JSON-RPC methods

Method	Auth	Credit	Behaviour
`initialize`	Bearer required	Free	Returns protocol, capabilities, server info.
`tools/list`	Bearer required	Free	Returns all 41 tools with `inputSchema`.
`ping`	Bearer required	Free	Returns `{}`.
`tools/call`	Bearer required	1 credit (`account_status` is free)	Validates args, charges, runs query, replies.
`notifications/initialized` (and any `notifications/*`)	none	Free	Returns HTTP 202 with empty body.
Anything else	n/a	n/a	`-32601 method_not_found`.

Methods explicitly not implemented (each returns method_not_found): resources/list, resources/read, prompts/list, prompts/get, completion/complete, logging/setLevel, tools/list_changed.

`initialize` response

200 OK

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "protocolVersion": "2025-06-18",
    "capabilities": { "tools": { "listChanged": false } },
    "serverInfo": {
      "name": "precursor-intelligence",
      "title": "Precursor Intelligence MCP",
      "version": "1.0.0"
    },
    "instructions": "Threat-intelligence MCP backed by NVD, EPSS, CISA KEV, MITRE ATT&CK, Atomic Red Team, IOC intelligence, malware sample dataset, Shadowserver honeypot, and Precursor Intelligence proprietary scoring. Most tools cost 1 credit per call; account_status is free."
  }
}

The instructions string is intended for the LLM's system prompt; most clients automatically merge it.

Limits at a glance

Body sizebytesoptional

Max 65,536 bytes. Larger requests return -32600 invalid_request with data: { max_bytes: 65536 }.

JSON depthlevelsoptional

Max 16 nested levels. Deeper structures return -32600 invalid_request.

Response sizebytesoptional

Soft cap at 1,048,576 bytes. Larger payloads are truncated with a ...[truncated] suffix and the response_truncated meta flag.

RPC timeoutsecondsoptional

Per-tool calls time out at 15 seconds. Charged credits are automatically refunded on timeout.

Security headers

Every response includes:

x-content-type-options: nosniff
referrer-policy: no-referrer
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: DENY
content-security-policy: default-src 'none'
cache-control: no-store
x-request-id: <uuid>

Quote x-request-id in support tickets; it lines up with result._meta.precursor.request_id in JSON-RPC responses.