Threat intelligence
for the AI era.
Your scanner finds thousands of issues. Now your agent can ask which ones actually matter. 41 read-only intelligence tools for Claude Code, Cursor and any MCP client.
The Precursor Intelligence MCP server is a read-only threat intelligence server for AI agents. It exposes 41 tools over the Model Context Protocol (Streamable HTTP), so tools like Claude Code, Claude Desktop, Cursor and Zed can query CVE, EPSS, CISA KEV, MITRE ATT&CK, IOC and Shadowserver honeypot data and answer "which vulnerabilities actually matter to my stack?".
Install it, ask a question, get an answer
One command adds Precursor Intelligence to your agent. From then on, security context is a question away.
claude mcp add --transport http precursor-intelligence \
https://mcp.precursorintelligence.com \
--header "Authorization: Bearer <YOUR_API_KEY>"One server, the whole intelligence graph
Every dataset the platform curates, queryable by your agent through a single connection.
Full intelligence on any CVE, including EPSS probability, KEV status and honeypot activity.
Map CVEs to specific vendors, products and versions across the CPE dictionary.
Look up the underlying weakness classes behind vulnerabilities.
Techniques, tactics and sub-techniques with detection and kill-chain context.
Atomic tests mapped to ATT&CK techniques for detection validation.
Groups by aliases, sponsor, target industry and incident type.
Search and enrich IOCs across the ThreatFox feed and blog-derived indicators.
MalwareBazaar samples by hash, file type or signature.
Check SSL certificate and JA3 fingerprints against abuse.ch blacklists.
Live honeypot exploitation activity per CVE, vendor and day.
AI-generated remediation summaries, the remediation queue, data freshness and account status.
Stop reading advisories. Start asking questions.
Which CVEs affecting Fortinet are actively being exploited right now?
Give me the highest-EPSS vulnerabilities added to CISA KEV in the last 14 days.
Write a remediation plan for CVE-2025-53770.
Map CVE-2024-3400 to the MITRE ATT&CK techniques it enables.
Which threat actors target healthcare, and what do they use?
Is this SHA1 certificate fingerprint linked to known C2 infrastructure?
Read-only by design
All 41 tools are read-only. The server returns intelligence, it cannot modify your data, write to your systems or trigger scans. Access is a bearer key you mint and revoke yourself.
Read the security modelSecurity context, where the work already happens
Give your agent real security context
Mint a free key, add the server, and ask your first question in under two minutes. Explore the full platform or read how the exploitation risk score works.
Already have a key? Log in.
The MCP server, explained
How the Precursor Intelligence MCP works, and what it can and cannot do.
It is a read-only threat intelligence server for AI agents. It exposes 41 tools over the Model Context Protocol, so an agent like Claude Code or Cursor can pull CVE, EPSS, CISA KEV, MITRE ATT&CK, IOC, malware and Shadowserver honeypot data directly into your workflow and tell you which vulnerabilities actually matter.
It works with Claude Code, Claude Desktop, Cursor, Zed, and any MCP-compatible client. It uses the Streamable HTTP transport, so you point the client at the server URL and add your API key as a bearer token.
No. Every one of the 41 tools is read-only. The server can look up and return intelligence, but it cannot modify your data, write to your systems, or trigger network scans. Attack surface scanning is a separate dashboard feature and is not exposed over the MCP.
With a bearer API key generated in the platform under Settings, then API Keys. You pass it in the Authorization header. There is no OAuth and no password exchange, and a key can be revoked at any time.
Yes, there is a free tier. You mint an API key from the dashboard and start querying. Usage is metered per tool call, and lightweight calls such as checking your account status are free.
The public intelligence datasets Precursor Intelligence curates: CVEs with EPSS and CISA KEV status, CWE weaknesses, MITRE ATT&CK techniques, threat actors, IOCs, malware samples, C2 blacklists and Shadowserver honeypot activity. It does not access your internal systems or code.