# Integrations: API, MCP and webhooks | Precursor Intelligence

**Put your security data where you already work. API, MCP, webhooks and imports.**

> Integrations connect Precursor Intelligence to the rest of your stack. A REST API and an MCP server give your scripts and AI assistants our intelligence and your own data, with one key. Webhooks send your alerts to your own systems as soon as we spot something. Tenable sync and scan-file upload bring your existing scanner findings in. It is for IT and security teams.

Canonical page: https://www.precursorintelligence.com/features/integrations
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Integrations
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

60 API calls a minute per key. Alerts to Slack, Teams or your SIEM. Keys locked to your IP addresses.

Example data on this page uses the fictional company Acme (acme.co.uk, documentation-range IP addresses such as 203.0.113.24).

## Contents

1. [What can you connect?](#what-can-you-connect)
2. [How do you get started?](#how-do-you-get-started)
3. [What can the API give you?](#what-can-the-api-give-you)
4. [Can your AI assistant use it too?](#can-your-ai-assistant-use-it-too)
5. [How do alerts reach your own systems?](#how-do-alerts-reach-your-own-systems)
6. [Already run a scanner?](#already-run-a-scanner)
7. [Questions](#questions)
8. [Related features](#related-features)

## What can you connect?

Ten ways to move data between Precursor Intelligence and the tools you already run, from a single API call to a monthly brand report:

1. **REST API.** HTTPS and JSON with a bearer key at `https://api.precursorintelligence.com/functions/v1/`. Look up flaws, products, weaknesses, threat groups, indicators, malware and supply-chain incidents.
2. **Your organisation's data.** The `/my/*` endpoints: your matched flaws, alerts and scans, the changes between scans, and whether you are exposed to a given CVE. Leaked passwords are never returned.
3. **MCP server.** Give Claude, Cursor or any MCP-capable assistant 71 tools over your estate and our intelligence. See [MCP server](https://www.precursorintelligence.com/features/mcp-server).
4. **Outbound webhooks.** Your vulnerability and supply-chain alerts posted as JSON to a URL you choose, with an optional secret header stored encrypted.
5. **Chat and log formats.** Lookalike-domain alerts formatted for Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel, with each webhook limited to the categories and events you pick.
6. **Tenable sync.** Connect Tenable Vulnerability Management with its API keys. We check them, store them encrypted and keep your findings in sync, or pull them on demand.
7. **Scan-file upload.** Exports from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap, OpenVAS or Greenbone, Qualys VM, Qualys WAS and OWASP ZAP, up to 50 MB.
8. **PDF reports.** Organisation report, risk register, AI action plans, attack surface scans and comparisons, threat-group dossiers and single-CVE reports.
9. **Brand exports.** Lookalike findings as CSV or STIX 2.1, a DNS blocklist (RPZ), a Microsoft 365 block list, evidence packs and a monthly brand PDF. See [brand protection](https://www.precursorintelligence.com/features/brand-protection).
10. **Audit log export.** Admins can export the organisation's audit log of actions and sign-ins as a CSV file.

## How do you get started?

There is nothing to install. Anyone in your organisation with edit rights can create a key in the browser and start calling the API straight away.

1. **Create a key (Admin or Member).** In Settings, name the key and choose what it can reach. Public intelligence is on by default; your own organisation's data is opt-in. Scopes: `api:read`, `api:org`, `mcp:read`, `mcp:org`.
2. **Lock it down (recommended).** Limit the key to up to 20 IP addresses and give it an expiry date. The secret is shown once and we keep only a hash.
3. **Call the API or connect an assistant (any time).** Send the key as a bearer token (`Authorization: Bearer <key>`) to the REST API or the MCP server.
4. **Add webhooks and imports (when you are ready).** Register a webhook for your alerts, connect Tenable or upload a scan file so existing findings are matched to our intelligence.

## What can the API give you?

**REST API.** One HTTPS API for scripts, dashboards and security tools. Public endpoints answer questions about any flaw or threat. Organisation endpoints answer questions about you.

- Public intelligence: CVEs and the flaws most likely to be exploited, vendors and products, weaknesses, threat groups, indicators, malware and supply-chain incidents.
- Your organisation: your flaws, alerts and scans, the changes between two scans, and whether you are exposed to a given CVE.
- Scoped by the key itself. A request can never name another organisation.
- Locked down by default: each key works only from the addresses you allow, and can expire.

Every response is JSON with a `data` block and a `meta` block carrying the request id and the key's rate limit. Example (Acme):

```
curl https://api.precursorintelligence.com/functions/v1/my/exposure/CVE-2024-3400 \
  -H "Authorization: Bearer $PRECURSOR_KEY"

{
  "data": {
    "cve_id": "CVE-2024-3400",
    "exposure": "confirmed",
    "my_findings": { "count": 1, "items": [{ "title": "VPN gateway flaw on vpn.acme.co.uk", "severity": "critical", "status": "open" }] },
    ...
  },
  "meta": {
    "request_id": "req_7f2c...",
    "rate": { "limit": 60, "remaining": 58 }
  }
}
```


Authentication, every endpoint and example requests are in the developer docs: https://docs.precursorintelligence.com

## Can your AI assistant use it too?

Yes, with the same key. The MCP server (`https://mcp.precursorintelligence.com`) turns Precursor Intelligence into tools an AI assistant can call. Connect Claude, Cursor or any assistant that speaks MCP and ask about your estate.

- 71 tools: 43 for public intelligence, 28 for your own organisation.
- 60 calls a minute per key, the same for every key.

Example (Acme): asked "Are we exposed to CVE-2024-3400?", the assistant calls `assess_cve_exposure` (confirmed, 1 host, vpn.acme.co.uk) and `get_cve` (VPN gateway flaw, known exploited), then answers: "Yes. Your VPN gateway runs an affected version and the flaw is known to be exploited. Patch it first."

See every tool on the [MCP server](https://www.precursorintelligence.com/features/mcp-server) page.

## How do alerts reach your own systems?

**Outbound webhooks.** Register a URL and we post your alerts to it, so your own tools can act on them without anyone logging in.

- Your URL, your secret. Add an optional authentication header. Its value is stored encrypted.
- Send a test whenever you like, to check your endpoint answers.
- We keep watching. When a new vulnerability affects you, your endpoint hears about it as soon as we know.
- Choose what each webhook gets: domain impersonation, vulnerabilities or supply chain, down to individual events.
- Lookalike alerts in the format you need: Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel. Vulnerability and supply-chain alerts are sent as JSON (events `vulnerability.alert` and `supply_chain.alert`).

Example body (Acme):

```
{
  "event": "vulnerability.alert",
  "delivered_at": "2026-10-15T09:42:17Z",
  "organisation_name": "Acme",
  "count": 2,
  "truncated": false,
  "items": [{ "cve_id": "CVE-2024-3400", "cvss_score": 10.0, "severity": "CRITICAL", "published": "2024-04-12", ... }, ...]
}
```

Webhooks sit alongside email and in-app alerts. More on [alerts and reports](https://www.precursorintelligence.com/features/alerts-and-reporting).

## Already run a scanner?

**Bring findings in.** Keep the scanner you have. Connect Tenable or upload an export, and its findings are matched to our intelligence.

- Tenable Vulnerability Management sync. Connect with your Tenable API keys. We check they work, store them encrypted and keep your findings in sync, or pull them whenever you ask.
- Upload a scan file from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap (XML), OpenVAS or Greenbone (CSV), Qualys VM, Qualys WAS or OWASP ZAP, up to 50 MB.
- Parsed and matched for you, so a finding from another tool picks up what we know about that flaw.

Example (Acme): an uploaded `acme-external-2026-10.nessus` file is parsed and matched: CVE-2024-3400 on vpn.acme.co.uk (VPN gateway, known exploited), CVE-2024-36404 on maps.acme.co.uk (mapping library, public exploit code), CVE-2023-42116 on mail.acme.co.uk (mail server).

Tenable is the only scanner with a direct sync. For any other scanner, upload an export. To track software without a scanner, [tell us what you run](https://www.precursorintelligence.com/features/vulnerability-management).

## Questions

### Can an API key see my organisation's data?

Only if you allow it. New keys get public intelligence only. Organisation access is a separate scope you switch on per key, and the key itself decides which organisation it reads, so a request can never ask for anyone else's data.

### How are API keys kept safe?

Each key is shown to you once and is never stored in a form anyone could read back. Keys work only from the IP addresses you allow, which is on by default, and can be given an expiry date.

### When do webhooks fire?

We monitor continuously, and your webhooks receive an alert as soon as we spot something that affects you. You can send a test to your endpoint at any time.

### Do you connect to ticketing tools?

There are no built-in ticketing or on-call paging connectors. Point a webhook at your own endpoint, or use the API, to create tickets in the tools you already run. Lookalike-domain alerts can also be formatted for Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel.

### Which scanners can I import from?

Tenable Vulnerability Management connects directly and stays in sync. You can also upload exports from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap (XML), OpenVAS or Greenbone (CSV), Qualys VM, Qualys WAS and OWASP ZAP, up to 50 MB each.

## Related features

- [MCP server](https://www.precursorintelligence.com/features/mcp-server): ask Claude, Cursor or any MCP assistant about your own estate and current threats, with real data behind the answer.
- [Alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting): alerts by email, in the app or by webhook as soon as we spot something, plus PDF reports you can share.
- [Vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management): tell us the software you run and see only the known flaws that affect it.
- [Attack surface management](https://www.precursorintelligence.com/features/attack-surface-management): see what your business has open to the internet and what changed since last time.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Connect it to your stack, without building anything. Pull your flaws, scans and our intelligence into your own scripts, let AI assistants ask about your estate, send alerts where your team already works and bring in findings from the scanners you run.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Developer docs: https://docs.precursorintelligence.com
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone