Put your security data where you already work. API, MCP, webhooks and imports.
A REST API and an MCP server give your scripts and AI assistants our intelligence and your own data. Webhooks send your alerts to your own systems, and Tenable sync and scan uploads bring findings in.
What can you connect? Everything in, and out.
Ten ways to move data between Precursor Intelligence and the tools you already run, from a single API call to a monthly brand report.
REST API
HTTPS and JSON with a bearer key. Look up flaws, products, weaknesses, threat groups, indicators, malware and supply-chain incidents.
Your organisation's data
Your matched flaws, alerts and scans, the changes between scans, and whether you are exposed to a given CVE. Leaked passwords are never returned.
MCP server
Give Claude, Cursor or any MCP-capable assistant 71 tools over your estate and our intelligence.
Outbound webhooks
Your vulnerability and supply-chain alerts posted as JSON to a URL you choose, with an optional secret header stored encrypted.
Chat and log formats
Lookalike-domain alerts formatted for Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel, with each webhook limited to the categories and events you pick.
Tenable sync
Connect Tenable Vulnerability Management with its API keys. We check them, store them encrypted and keep your findings in sync, or pull them on demand.
Scan-file upload
Exports from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap, OpenVAS or Greenbone, Qualys VM, Qualys WAS and OWASP ZAP, up to 50 MB.
PDF reports
Organisation report, risk register, AI action plans, attack surface scans and comparisons, threat-group dossiers and single-CVE reports.
Brand exports
Lookalike findings as CSV or STIX 2.1, a DNS blocklist (RPZ), a Microsoft 365 block list, evidence packs and a monthly brand PDF.
Audit log export
Admins can export the organisation's audit log of actions and sign-ins as a CSV file.
How do you get started? Four steps, all in Settings.
There is nothing to install. Anyone in your organisation with edit rights can create a key in the browser and start calling the API straight away.
- Admin or Member
Create a key
In Settings, name the key and choose what it can reach. Public intelligence is on by default; your own organisation's data is opt-in.
- Recommended
Lock it down
Limit the key to up to 20 IP addresses and give it an expiry date. The secret is shown once and we keep only a hash.
- Any time
Call the API or connect an assistant
Send the key as a bearer token to the REST API or the MCP server.
- When you are ready
Add webhooks and imports
Register a webhook for your alerts, connect Tenable or upload a scan file so existing findings are matched to our intelligence.
What can the API give you? Our intelligence, and your own data.
One HTTPS API for scripts, dashboards and security tools. Public endpoints answer questions about any flaw or threat. Organisation endpoints answer questions about you.
- Public intelligence: CVEs and the flaws most likely to be exploited, vendors and products, weaknesses, threat groups, indicators, malware and supply-chain incidents.
- Your organisation: your flaws, alerts and scans, the changes between two scans, and whether you are exposed to a given CVE.
- Scoped by the key itself. A request can never name another organisation.
- Locked down by default. Each key works only from the addresses you allow, and can expire.
Authentication, every endpoint and example requests are in the developer docs.
HTTPS · JSON · Bearer key · api.precursorintelligence.com
Example REST API calls for the fictional company Acme. Choose a request to see its response. Every response carries the same meta block: the request id and the rate limit of 60 requests a minute for the key.
Can your AI assistant use it too? Yes, with the same key.
The MCP server turns Precursor Intelligence into tools an AI assistant can call. Ask a question and the assistant fetches the facts before it answers.
MCP server · mcp.precursorintelligence.com
Connect Claude, Cursor or any assistant that speaks MCP, and ask about your estate. It answers with your real data, using the same key as the REST API.
- 71
- Tools: 43 for public intelligence, 28 for your own organisation
- 60
- Calls a minute per key, the same for every key
How do alerts reach your own systems? We post them to you.
Register a URL and we post your alerts to it, so your own tools can act on them without anyone logging in.
- Your URL, your secret. Add an optional authentication header. Its value is stored encrypted.
- Send a test whenever you like, to check your endpoint answers.
- We keep watching. When a new vulnerability affects you, your endpoint hears about it as soon as we know.
- Choose what each webhook gets: domain impersonation, vulnerabilities or supply chain, down to individual events.
- Lookalike alerts in the format you need: Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel. Vulnerability and supply-chain alerts are sent as JSON.
Webhooks sit alongside email and in-app alerts. More on alerts and reports
JSON · vulnerability.alert · supply_chain.alert · Test send
Already run a scanner? Bring its findings with you.
Keep the scanner you have. Connect Tenable or upload an export, and its findings are matched to our intelligence.
- Tenable Vulnerability Management sync. Connect with your Tenable API keys. We check they work, store them encrypted and keep your findings in sync, or pull them whenever you ask.
- Upload a scan file from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap (XML), OpenVAS or Greenbone (CSV), Qualys VM, Qualys WAS or OWASP ZAP, up to 50 MB.
- Parsed and matched for you, so a finding from another tool picks up what we know about that flaw.
Tenable is the only scanner with a direct sync. For any other scanner, upload an export. To track software without a scanner, tell us what you run.
Tenable sync · Nessus · Nexpose · InsightVM · Nikto · Nmap · OpenVAS · Qualys · ZAP
Only if you allow it. New keys get public intelligence only. Organisation access is a separate scope you switch on per key, and the key itself decides which organisation it reads, so a request can never ask for anyone else's data.
Each key is shown to you once and is never stored in a form anyone could read back. Keys work only from the IP addresses you allow, which is on by default, and can be given an expiry date.
We monitor continuously, and your webhooks receive an alert as soon as we spot something that affects you. You can send a test to your endpoint at any time.
There are no built-in ticketing or on-call paging connectors. Point a webhook at your own endpoint, or use the API, to create tickets in the tools you already run. Lookalike-domain alerts can also be formatted for Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel.
Tenable Vulnerability Management connects directly and stays in sync. You can also upload exports from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap (XML), OpenVAS or Greenbone (CSV), Qualys VM, Qualys WAS and OWASP ZAP, up to 50 MB each.
Connect it to your stack. Without building anything.
Pull your flaws, scans and our intelligence into your own scripts, let AI assistants ask about your estate, send alerts where your team already works and bring in findings from the scanners you run.