Ask your AI assistant about your own security. It answers with real data.

Our MCP server lets AI assistants such as Claude and Cursor use Precursor Intelligence as a set of tools. Ask a question and the assistant looks up your vulnerabilities, hosts, alerts and domains, plus current threat intelligence, then answers with the evidence. It is for IT and security teams who already work with an assistant.

Start free Book a demo

Works with Claude and Cursor
71 tools
Scoped to your organisation

The tools

Which tools can your assistant use? Here is the catalogue.

MCP, the Model Context Protocol, is an open standard that lets AI assistants call outside tools. Ours has 71: 28 that read your own organisation's data and 43 for public intelligence. Your assistant picks the right ones for each question.

mcp:org Needs organisation access, which you switch on per key.

Your flaws and alerts 8

assess_cve_exposureWhether one CVE affects you, across your scans, tracked software and alerts.
list_my_vulnerabilitiesFlaws your scans found, filtered by severity.
list_my_relevant_cvesFlaws matched to the software you track.
list_my_triage_findingsYour scored flaws with an action priority, highest first.
list_my_alertsYour vulnerability alerts, newest first.
get_my_alert_configWhat you track and who receives your alert emails.
list_my_action_plansYour AI action plans.
list_my_reportsThreat reports you have mapped to attack techniques.

Your code 2

list_my_lockfilesThe dependency files you have uploaded, with package counts.
check_my_supply_chain_exposureWhether a hijacked or malicious package is in those files.

Threats to you 4

get_my_industryThe industry set for your organisation.
list_my_favorite_threat_groupsThe threat groups you follow.
map_assets_to_actorWhich of your assets match a threat group's methods and flaws.
appliances_exploited_by_actorWhich of your firewalls, VPNs and gateways have flaws being exploited now.

Your hosts and network 7

list_my_assetsYour attack surface scans, with counts of hosts, services and flaws.
list_my_hostsHosts your scans found, with their IP addresses and open-port counts.
list_my_portsPorts across your hosts, filtered by state, number or host.
get_open_portsThe open ports, and the service on each, for one host or IP address.
list_my_servicesServices answering on your hosts, with product and version.
list_my_ip_addressesIP addresses your scans found, with who runs the network.
list_my_network_rangesThe network ranges linked to your organisation.

Your domains, certificates and software 4

list_my_dns_recordsDNS records found for your domains, by record type.
list_my_discovered_domainsDomains your scans found, with registrar and expiry dates.
list_my_ssl_certificatesCertificates on your services, soonest to expire first.
list_my_softwareSoftware found on your assets and your website.

Your domains and people 3

list_my_domainsThe domains you monitor for lookalikes.
list_my_domain_alertsAlerts for new lookalike domains and changes to them.
list_my_exposed_credentialsStaff logins found in other companies' breaches. Passwords are never returned.

Threat groups 6

list_threat_actorsCriminal and state-backed groups, by type.
get_threat_actorA group's full profile, each claim with a quote and source.
list_threat_actors_by_industryThe groups reported to target an industry.
list_threat_actor_cvesThe flaws a group is reported to exploit.
get_cve_threat_actorsThe groups reported to exploit one CVE.
get_threat_actor_techniquesHow a group operates, technique by technique.

Indicators and malware 9

search_iocsSearch malicious IPs, domains, URLs and file hashes.
lookup_iocCheck one exact IP, domain, URL or hash.
list_recent_iocsIndicators first seen in the last few days.
search_malware_samplesSearch malware samples by name, type or signature.
get_malware_sampleOne sample's details, by its file hash.
list_recent_malware_samplesRecently seen malware samples.
list_top_malwareThe malware families most written about.
lookup_ssl_blacklistWhether a certificate fingerprint is linked to malware.
lookup_ja3_blacklistWhether a connection fingerprint is linked to malware.

And ten more 10

Tools for the government list of exploited flaws, exploit-likelihood scores, attack techniques and what internet attack sensors are seeing. Their exact names are in the developer docs.

Vulnerabilities 6

get_cveEverything on one CVE, including the groups reported to exploit it.
search_cves_by_vendorA vendor's flaws, most likely to be exploited first.
list_recent_notable_eventsRecent notable changes to flaws, such as a new exploited listing.
get_top_affected_systemsThe systems most written about in security reporting.
list_remediation_summaryAI-written fix summaries for a CVE.
list_recent_remediation_queueFlaws recently queued for a fix summary.

Products and weaknesses 8

get_vendorA vendor's products and how many flaws each has.
get_vendor_productA product's versions and the flaws in each.
get_vendor_product_versionThe flaws in one exact version.
search_productsFind a product by name.
list_top_vendors_by_cve_countThe vendors with the most published flaws.
get_cweOne weakness type, with its consequences and fixes.
list_cwesSearch the catalogue of weakness types.
list_top_cwesThe weakness types behind the most flaws.

Attack simulation tests 3

list_art_techniquesThe techniques that have ready-made tests.
list_art_atomic_testsTests for a technique and platform.
get_art_atomic_testOne test in full, with how to run it.

Your account 1

account_statusYour key details, rate limit and account balance.

How it works

What happens when you ask? Four steps, every time.

Your assistant does the talking. We supply the facts it looks up, and you only pay for the tool calls that return data.

You
Ask a question
Type it the way you would ask a colleague, such as "Are we exposed to CVE-2024-3400?"
Your assistant
It picks the tools
It reads our tool list and calls the tools that fit the question.
Precursor Intelligence
We check the key and reply
The key's scopes decide which tools work, and only for your organisation.
Your assistant
You get an answer with evidence
It answers from what the tools returned, such as the host affected and whether the flaw is being exploited.

Connect

How do you connect it? One URL and one key.

Add the server to your assistant once. It uses the same API key as our REST API, so there is nothing else to set up.

Claude, Cursor or any MCP-capable assistant, connected over Streamable HTTP.
Admins and Members create keys in Settings.
Lock the key to your IP addresses and give it an expiry date. The secret is shown once and we keep only a hash.

Setup steps for each assistant are in the developer docs.

Streamable HTTP · Bearer key · mcp.precursorintelligence.com

Server URLhttps://mcp.precursorintelligence.com

Run once in your terminal

claude mcp add --transport http precursor-intelligence \
  https://mcp.precursorintelligence.com \
  --header "Authorization: Bearer <YOUR_API_KEY>"

{
  "mcpServers": {
    "precursor-intelligence": {
      "type": "http",
      "url": "https://mcp.precursorintelligence.com",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "precursor-intelligence": {
      "type": "http",
      "url": "https://mcp.precursorintelligence.com",
      "headers": {
        "Authorization": "Bearer ${env:PRECURSOR_API_KEY}"
      }
    }
  }
}

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"account_status","arguments":{}}}'

Replace the placeholder with an API key that has the MCP scopes you want.

Scopes

What can your assistant see? Only what you allow.

Every key carries scopes. Public intelligence is on by default. Your own organisation's data is a separate switch, per key. Try it on the example.

mcp:read opens the 43 public intelligence tools. Every new key has it.
mcp:org adds the 28 tools that read your scans, flaws, alerts, domains and code.
The key decides the organisation. No request can ask for another organisation's data.
Leaked passwords never reach the assistant. The exposed-logins tool says who is affected, not what their password was.
The tools look things up. None of them start scans, unlock results or change your settings.

Every credential failure gets the same response, so nobody can probe for a working key.

mcp:read · mcp:org · IP lock · Expiry

New API key

acme-assistant

Expires in 3 months

Access

REST APIQuery public threat intelligence over the REST API.api:read
MCPConnect an assistant to public threat intelligence.mcp:read
REST API - your dataRead your own organisation's data over the REST API.api:org

71tools your assistant can use

get_cveget_threat_actorlookup_iocassess_cve_exposurelist_my_hostslist_my_exposed_credentialsmap_assets_to_actor

Locked to 203.0.113.10. The secret is shown once and we keep only a hash of it.

Try asking

What could you ask it? Eight good starting points.

Questions in your own words, and the tools an assistant would reach for to answer them. Example answers on this page use the fictional company Acme.

Are we exposed to CVE-2024-3400?
Checks your scans, tracked software and alerts for that one flaw, then pulls its details.
assess_cve_exposure · get_cve
What is open to the internet on 203.0.113.24?
Lists the open ports on that address and the service answering on each.
get_open_ports
Which of our certificates expire soonest?
Lists the certificates on your services, soonest to expire first.
list_my_ssl_certificates
Have any staff logins leaked?
Lists staff addresses found in other companies' breaches, without the passwords.
list_my_exposed_credentials
Is anyone using a lookalike of our domain?
Shows the domains you monitor and the latest lookalike alerts for them.
list_my_domains · list_my_domain_alerts
Is a hijacked package in our code?
Checks your uploaded dependency files against known supply-chain incidents.
check_my_supply_chain_exposure
Who targets our industry, and do we run what they exploit?
Finds your industry, the groups reported to target it, and which of your assets match their methods and flaws.
get_my_industry · list_threat_actors_by_industry · map_assets_to_actor
Is any firewall or VPN of ours running an exploited flaw?
Lists your edge devices tied to flaws that are being exploited, optionally for one named group.
appliances_exploited_by_actor

FAQ

Questions about the MCP server.

Something else? Talk to the team

Claude, Cursor and any other assistant that supports MCP over Streamable HTTP. You add one server URL, https://mcp.precursorintelligence.com, and your API key as a bearer token.

Only if its key has the mcp:org scope, which is off for new keys. Without it, the assistant can use the 43 public intelligence tools only. The key decides which organisation it reads, so it can never reach anyone else's data.

No. The tools look information up and return it to your assistant. None of them start a scan, unlock results or change settings.

60 requests a minute per key, the same for every key.

Get started

Give your assistant real answers. About your own estate.

Add one URL to Claude, Cursor or any MCP assistant and ask about your vulnerabilities, hosts, alerts and domains, plus who is targeting your sector, and get answers backed by evidence.

Start free Book a demo

Nothing to install
Unlimited team members
Data stored in London
Two-factor sign-in for everyone

Ask your AI assistant about your own security. It answers with real data.

Which tools can your assistant use? Here is the catalogue.

Your flaws and alerts 8

Your code 2

Threats to you 4

Your hosts and network 7

Your domains, certificates and software 4

Your domains and people 3

Threat groups 6

Indicators and malware 9

And ten more 10

Vulnerabilities 6

Products and weaknesses 8

Attack simulation tests 3

Your account 1

What happens when you ask? Four steps, every time.

Ask a question

It picks the tools

We check the key and reply

You get an answer with evidence

How do you connect it? One URL and one key.

What can your assistant see? Only what you allow.

What could you ask it? Eight good starting points.

Are we exposed to CVE-2024-3400?

What is open to the internet on 203.0.113.24?

Which of our certificates expire soonest?

Have any staff logins leaked?

Is anyone using a lookalike of our domain?

Is a hijacked package in our code?

Who targets our industry, and do we run what they exploit?

Is any firewall or VPN of ours running an exploited flaw?

Questions about the MCP server.

Which AI assistants does it work with?

Can the assistant see my organisation's data?

Can it change anything in my account?

Is there a rate limit?

Related features. One account, all of them.

Give your assistant real answers. About your own estate.