# EdgeProtect: API & MCP Documentation > Developer documentation for the EdgeProtect threat & vulnerability intelligence platform: a public REST API and an MCP server exposing CVE/EPSS, CISA KEV, CPE, CWE, MITRE ATT&CK, threat actors, malware, IOCs, blacklists, Shadowserver activity, supply-chain incidents and remediation data. Every page on this site is available as Markdown. Append `.md` to any URL (e.g. `/api-reference/cve.md`), or request the page with the header `Accept: text/markdown`. Content is served as `text/markdown; charset=utf-8`. ## REST API ### Getting Started - [Introduction](https://docs.edgeprotect.io/index.md): Real-time CVE and CPE threat intelligence. Authenticate with a single bearer token, pay per call in credits, and get the same vulnerability data that powers the EdgeProtect platform. - [Quickstart](https://docs.edgeprotect.io/quickstart.md): Make your first authenticated request in two steps. You'll need an EdgeProtect Intelligence account and a few minutes. - [Authentication](https://docs.edgeprotect.io/authentication.md): The EdgeProtect API uses bearer tokens for every request. There are no cookies, no session state, no OAuth dance: just one header. ### Concepts - [Credits & Billing](https://docs.edgeprotect.io/credits.md): EdgeProtect uses a pay-per-call credit model. Every successful call debits one credit from the organisation that owns the API key. Credits are shared across the REST API and the EdgeProtect MCP ser… - [Errors](https://docs.edgeprotect.io/errors.md): The API returns conventional HTTP status codes. The body is always JSON in the shape { "error": "" }. Human descriptions are intentionally not returned, as they can leak which… - [Security Model](https://docs.edgeprotect.io/security.md): The EdgeProtect API is designed for production use by security teams. The controls below describe what we guarantee at the API boundary. ### API Reference - [Overview](https://docs.edgeprotect.io/api-reference.md): The EdgeProtect REST API is a set of GET endpoints that return JSON. All endpoints share the same authentication and credit model. - [Interactive Explorer](https://docs.edgeprotect.io/reference.md) _(OpenAPI)_ ### CVE & EPSS - [Get CVE](https://docs.edgeprotect.io/api-reference/cve.md) _(GET)_: Fetch the full intelligence record for a single CVE, including CVSS severity, EPSS probability, CISA KEV status, Shadowserver honeypot activity, risk scoring, and a chronological event timeline. - [Search CVEs](https://docs.edgeprotect.io/api-reference/cve-search.md) _(GET)_: Search the CVE catalogue by keyword or CVE-ID prefix. Keyword queries resolve through the CPE product and vendor taxonomy, matching the same logic as the platform's vulnerability search. Use it to… - [CVE Threat Actors](https://docs.edgeprotect.io/api-reference/cve-actors.md) _(GET)_: Threat actors reported to have exploited a given CVE, each with the quote that attributes it and the URL that quote came from. - [List High-EPSS CVEs](https://docs.edgeprotect.io/api-reference/cve-high-epss.md) _(GET)_: Return CVEs whose EPSS exploit-probability score meets or exceeds a minimum threshold, sorted by EPSS score descending. Use it to surface the CVEs most likely to be exploited in the wild right now. - [Recent CISA KEV](https://docs.edgeprotect.io/api-reference/cve-kev-recent.md) _(GET)_: Return CISA Known Exploited Vulnerabilities catalog entries added within the last N days, so you can track recently disclosed exploited vulnerabilities. - [Notable CVE Events](https://docs.edgeprotect.io/api-reference/cve-notable-events.md) _(GET)_: Return CVE notable events recorded within a rolling time window: new NVD entries, high EPSS score jumps, CISA KEV additions, and similar signals. - [Top CVEs by Vendor](https://docs.edgeprotect.io/api-reference/cve-by-vendor.md) _(GET)_: Return the highest-EPSS CVEs for a given vendor, sorted by EPSS score descending. Use it to quickly surface the most likely-to-be-exploited vulnerabilities across a vendor's product portfolio. ### CPE & Products - [Get Vendor](https://docs.edgeprotect.io/api-reference/cpe-vendor.md) _(GET)_: Return the CVE count, product count, and per-product CVE lists for a single CPE vendor. - [Get Product](https://docs.edgeprotect.io/api-reference/cpe-product.md) _(GET)_: Returns vulnerability counts and a per-version breakdown for a specific vendor/product pair tracked in the CPE catalog. - [Get Version](https://docs.edgeprotect.io/api-reference/cpe-version.md) _(GET)_: Retrieve up to 200 full CVE records affecting a specific vendor, product, and version combination. - [Search Products](https://docs.edgeprotect.io/api-reference/cpe-search.md) _(GET)_: Full-text search across product and vendor names in the CPE catalog. Returns matching product entries with their vendor. This endpoint shares the /v1/cpe collection path with List Top Vendors and i… - [Top Vendors](https://docs.edgeprotect.io/api-reference/cpe-top-vendors.md) _(GET)_: Return the top N CPE vendors ranked by total CVE count, giving you a quick view of which vendors carry the largest vulnerability surface. This endpoint shares the /v1/cpe collection path with Searc… ### CWE - [Get CWE](https://docs.edgeprotect.io/api-reference/cwe.md) _(GET)_: Retrieve a single CWE record: name, abstraction level, structure, status, description, likelihood of exploit, related weaknesses, applicable platforms, modes of introduction, common consequences, d… - [Search CWEs](https://docs.edgeprotect.io/api-reference/cwe-search.md) _(GET)_: Search the CWE catalogue by keyword. Returns matching weaknesses with their abstraction level, status, likelihood of exploit, and description. Omit q to return the full catalogue page up to limit. - [Top CWEs](https://docs.edgeprotect.io/api-reference/cwe-top.md) _(GET)_: Return the most-referenced CWEs across all scored CVEs, ranked by how often each weakness appears across the CVE dataset. Useful for identifying systemic vulnerability patterns in a portfolio. ### MITRE ATT&CK - [Get Technique](https://docs.edgeprotect.io/api-reference/mitre-technique.md) _(GET)_: Fetch a single MITRE ATT&CK Enterprise technique by its identifier, including description, platforms, kill-chain phases, detection guidance, and data sources. The REST response is enriched: alongsi… - [List Techniques](https://docs.edgeprotect.io/api-reference/mitre-techniques.md) _(GET)_: Return MITRE ATT&CK Enterprise techniques, optionally filtered by tactic shortname. Results are sorted by technique ID and capped by limit. - [Top Techniques](https://docs.edgeprotect.io/api-reference/mitre-techniques-top.md) _(GET)_: Return the most-referenced MITRE ATT&CK techniques across intelligence reporting, ranked by mention count. - [List Tactics](https://docs.edgeprotect.io/api-reference/mitre-tactics.md) _(GET)_: Return all 14 ATT&CK Enterprise tactics with per-tactic statistics, including technique counts. - [List Groups](https://docs.edgeprotect.io/api-reference/mitre-groups.md) _(GET)_: Return MITRE ATT&CK groups (intrusion sets), optionally filtered by a free-text query that matches the group name, ATT&CK ID, or any known alias. Results are sorted by name and capped by limit. - [Get Group](https://docs.edgeprotect.io/api-reference/mitre-group.md) _(GET)_: Fetch the full record for a single MITRE ATT&CK group (intrusion set) by its ATT&CK identifier, including its aliases, description, domains, and the STIX identifier MITRE assigns it. ### Atomic Red Team - [List Techniques](https://docs.edgeprotect.io/api-reference/atomics-techniques.md) _(GET)_: Return the Atomic Red Team technique index, with an optional substring filter on technique ID or name. Use this to discover which ATT&CK techniques have atomic test coverage before enumerating tests. - [List Tests](https://docs.edgeprotect.io/api-reference/atomics-tests.md) _(GET)_: Return a paged list of Atomic Red Team atomic tests, optionally filtered by ATT&CK technique ID and platform. Useful for enumerating available test coverage before retrieving full test details. - [Get Test](https://docs.edgeprotect.io/api-reference/atomics-test.md) _(GET)_: Fetch the full details of a single Atomic Red Team test by its internal id, including executors, input arguments, and dependencies. ### Threat Actors - [List Actors](https://docs.edgeprotect.io/api-reference/actors.md) _(GET)_: Tracked threat actors, ranked by how much corroborated evidence exists for each. - [Get Actor](https://docs.edgeprotect.io/api-reference/actor.md) _(GET)_: Full dossier for one threat actor: description, origin, motivation, aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft, and the CVEs it exploits, industries it targets and… - [Actor CVEs](https://docs.edgeprotect.io/api-reference/actor-cves.md) _(GET)_: The CVEs a threat actor is reported to have exploited, each with the quote that attributes it, the source URL, and the severity signals you need to act: CVSS, EPSS, CISA KEV status and EdgeProtect'… - [Actors by Industry](https://docs.edgeprotect.io/api-reference/actors-by-industry.md) _(GET)_: Threat actors reported to target a given industry, each with the quote that says so and the URL it came from. ### IOCs - [Look up IOC](https://docs.edgeprotect.io/api-reference/ioc-lookup.md) _(GET)_: Perform an exact-match lookup of a single IOC value (domain, IP address, URL, or file hash) across the IOC feed and blog-derived IOC references, returning enrichment data when the value is known. - [Search IOCs](https://docs.edgeprotect.io/api-reference/ioc-search.md) _(GET)_: Search 1M+ IOCs by substring across our IOC intelligence, optionally filtered by type, threat type, or malware family. Results are sorted by firstseenutc descending. - [Recent IOCs](https://docs.edgeprotect.io/api-reference/ioc-recent.md) _(GET)_: Return IOCs first seen in the last N days, optionally filtered by IOC type. The look-back window is intentionally short because broader windows can exceed the response size cap. ### Malware Samples - [Search Samples](https://docs.edgeprotect.io/api-reference/malware-search.md) _(GET)_: Search the malware sample corpus by substring match across file name, signature, or hash values. Returns paginated results ordered by most recently seen. - [Get Sample](https://docs.edgeprotect.io/api-reference/malware-sample.md) _(GET)_: Retrieve a single malware sample from the malware sample corpus by its SHA-256 hash, returning key metadata and the detected signature. - [Recent Samples](https://docs.edgeprotect.io/api-reference/malware-recent.md) _(GET)_: Return recently observed malware samples from the malware sample corpus, optionally filtered by file type and look-back window. - [Top Malware](https://docs.edgeprotect.io/api-reference/malware-top.md) _(GET)_: Return the most-referenced malware families across intelligence reporting, ranked by mention count. ### Blacklists - [SSL Blacklist](https://docs.edgeprotect.io/api-reference/blacklist-ssl.md) _(GET)_: Check the abuse.ch SSL Blacklist (SSLBL) to determine whether a SHA-1 TLS certificate fingerprint is associated with botnet command-and-control infrastructure or malware distribution. - [JA3 Blacklist](https://docs.edgeprotect.io/api-reference/blacklist-ja3.md) _(GET)_: Check the JA3 Blacklist to determine whether a JA3 MD5 TLS client fingerprint has been observed in connection with known malicious infrastructure such as malware or command-and-control activity. ### Shadowserver - [CVE Activity](https://docs.edgeprotect.io/api-reference/shadowserver-cve.md) _(GET)_: Return daily Shadowserver honeypot observations for a single CVE over a configurable look-back window, alongside aggregate summary statistics, so you can understand how actively a vulnerability is… - [Top CVEs](https://docs.edgeprotect.io/api-reference/shadowserver-top-cves.md) _(GET)_: Return the top CVEs ranked by Shadowserver honeypot connection volume over a configurable look-back window, so you can spot which vulnerabilities are being actively probed at scale right now. - [Top Vendors](https://docs.edgeprotect.io/api-reference/shadowserver-top-vendors.md) _(GET)_: Return the top vendors ranked by Shadowserver honeypot connection volume over a configurable look-back window, so you can identify which vendor ecosystems are most actively targeted at a given moment. - [Daily Stats](https://docs.edgeprotect.io/api-reference/shadowserver-daily-stats.md) _(GET)_: Return aggregate Shadowserver honeypot statistics for each day in the requested window, including unique IP counts, total connections, and the number of active and distinct CVEs observed. ### Remediation - [Remediation Summaries](https://docs.edgeprotect.io/api-reference/remediation-summary.md) _(GET)_: Return the latest AI-generated remediation summaries for a single CVE, drawn from intelligence reporting and analysis. The result is capped at the 5 most recent summaries, newest first. - [Affected Systems](https://docs.edgeprotect.io/api-reference/remediation-affected-systems.md) _(GET)_: Return the most-referenced affected systems across intelligence reporting, ranked by mention count (highest first). ### Supply Chain - [List Incidents](https://docs.edgeprotect.io/api-reference/supply-chain-incidents.md) _(GET)_: Return recent software supply-chain incidents (compromised packages, registry attacks, typosquats, and maintainer takeovers), newest first, with optional filters for severity and a published-date w… - [Get Incident](https://docs.edgeprotect.io/api-reference/supply-chain-incident.md) _(GET)_: Fetch the full record for a single supply-chain incident, including the long-form description, impact and recommendation lists, references, attribution, and the list of affected packages. - [Find by Package](https://docs.edgeprotect.io/api-reference/supply-chain-packages.md) _(GET)_: Search supply-chain incidents by an affected package name. Matches are case-insensitive and substring-based, so ethers matches ethers-jss. Results are returned newest first by the incident's publis… ### Account & Meta - [Account Status](https://docs.edgeprotect.io/api-reference/meta-account.md) _(FREE)_: Return the caller's credit balance and API-key metadata. This endpoint is free: it does not charge a credit, so meta.credits.charged is always 0. Use it to confirm authentication and check your rem… ### Your Data · Vulnerability Intelligence - [Relevant CVEs](https://docs.edgeprotect.io/api-reference/my-cves.md) _(ORG)_: CVEs matched to your organisation's watched vendors and products, worst first: ordered by EPSS exploit probability, so the top of page one is always the thing most likely to be exploited. Each row… - [Triage Findings](https://docs.edgeprotect.io/api-reference/my-triage.md) _(ORG)_: Your organisation's triaged CVEs: EdgeProtect's own vulnerability score and action priority for each, enriched with the threat-actor, malware and industry context that justified the score. Ordered… - [Alert Feed](https://docs.edgeprotect.io/api-reference/my-alerts.md) _(ORG)_: Watchlist alerts that fired for your organisation, newest first: a new CVE matched something you watch, or an existing match crossed a notification threshold. Each alert names what matched (vendor… - [CVE Exposure](https://docs.edgeprotect.io/api-reference/my-exposure.md) _(ORG)_: "Am I exposed to this CVE?" as one self-contained resource. A new KEV entry lands, you ask this once, and the answer combines everything the platform knows: confirmed findings on your scanned attac… ### Your Data · Attack Surface - [Your Vulnerabilities](https://docs.edgeprotect.io/api-reference/my-vulnerabilities.md) _(ORG)_: EdgeProtect findings across your current attack surface: the latest scan of every target, flattened into one collection, worst first. Each finding carries its instance count, so one row answers bot… - [List Your Scans](https://docs.edgeprotect.io/api-reference/my-scans.md) _(ORG)_: Every EdgeProtect attack-surface scan run for your organisation, newest first. Each row embeds the target it ran against and rollup counts for everything the scan found: hosts, ports, services, dom… - [Get a Scan](https://docs.edgeprotect.io/api-reference/my-scan.md) _(ORG)_: One whole EdgeProtect scan as a single document, for a single credit: the scan summary with its rollup counts, plus hosts (each with its IP addresses and open ports, and what is listening on them),… - [Scan Delta](https://docs.edgeprotect.io/api-reference/my-scan-delta.md) _(ORG)_: What changed between this scan and the previous scan of the same target (new and removed hosts, ports, services, certificates, findings) as a precomputed summary plus an ordered event list. The dif… - [Exposed Credentials](https://docs.edgeprotect.io/api-reference/my-scan-credentials.md) _(ORG)_: Breach-exposed credentials discovered for a scan's domain: which accounts appeared in which breach corpus, and whether a plaintext or hashed password was recovered. Enough to drive a password-reset… ## MCP Server ### Getting Started - [Overview](https://docs.edgeprotect.io/mcp/overview.md): The EdgeProtect MCP server gives any MCP-compatible client (Claude Desktop, Claude Code, Cursor, Zed, or your own agent) direct, typed access to the same threat-intelligence dataset that powers the… - [Setup](https://docs.edgeprotect.io/mcp/setup.md): The EdgeProtect MCP server is remote: a single hosted HTTP endpoint. There is nothing to install locally. You only need: - [Authentication](https://docs.edgeprotect.io/mcp/authentication.md): Every request to the EdgeProtect MCP server must include a bearer token. The same API key works for both the MCP server and the REST API. ### Protocol - [Transport](https://docs.edgeprotect.io/mcp/transport.md): The EdgeProtect MCP server implements the MCP Streamable HTTP transport at protocol version 2025-06-18. This page is the wire-level reference. Most users will never need it, but if you are writing… - [Response Format](https://docs.edgeprotect.io/mcp/response-format.md): Every successful tools/call returns a standard MCP CallToolResult wrapped in a JSON-RPC 2.0 envelope. The structure is identical across all 69 tools; only the payload inside the single text block c… - [Errors](https://docs.edgeprotect.io/mcp/errors.md): The EdgeProtect MCP server uses standard JSON-RPC 2.0 error envelopes with extension codes for authentication and credit failures. Tool-level failures (a query that errored or timed out) come back… - [Credits & Billing](https://docs.edgeprotect.io/mcp/credits.md): Credits are organisation-wide, not per-key. They are shared with the REST API: any credits purchased for your account are usable across both surfaces. ### Tools - [All Tools](https://docs.edgeprotect.io/mcp/tools.md): The EdgeProtect MCP server exposes 71 tools. All cost 1 credit per successful call except accountstatus, which is free. Click any tool for full parameter, response, and example detail. ### CVE & EPSS - [get_cve](https://docs.edgeprotect.io/mcp/tools/get_cve.md) _(TOOL)_: Fetch full intelligence on a single CVE: NVD record, CVSS scores, EPSS probability and trend, CISA KEV status, Shadowserver honeypot activity, CPE applicability, a timeline of notable events, and t… - [get_cve_threat_actors](https://docs.edgeprotect.io/mcp/tools/get_cve_threat_actors.md) _(TOOL)_: Threat actors reported to have exploited a given CVE, each with the evidence quote and source URL that attributes it. The reverse of listthreatactorcves, and the fastest way to answer "is anyone ac… - [search_cves_by_vendor](https://docs.edgeprotect.io/mcp/tools/search_cves_by_vendor.md) _(TOOL)_: Returns the highest-EPSS CVEs for a given vendor, sorted by EPSS score descending. Use this tool to quickly surface the most likely-to-be-exploited vulnerabilities across a vendor's product portfol… - [list_kev_recent](https://docs.edgeprotect.io/mcp/tools/list_kev_recent.md) _(TOOL)_: Returns CISA KEV catalog entries added within the last N days, so you can track recently disclosed exploited vulnerabilities. Costs 1 credit. - [list_high_epss_cves](https://docs.edgeprotect.io/mcp/tools/list_high_epss_cves.md) _(TOOL)_: Returns CVEs whose EPSS exploit-probability score meets or exceeds a minimum threshold, sorted by EPSS score descending. Use it to surface the CVEs most likely to be exploited in the wild right now… - [list_recent_notable_events](https://docs.edgeprotect.io/mcp/tools/list_recent_notable_events.md) _(TOOL)_: Returns CVE notable events recorded within a rolling time window: new NVD entries, high EPSS score jumps, CISA KEV additions, and similar signals. Costs 1 credit. ### CPE & Vendors - [get_vendor](https://docs.edgeprotect.io/mcp/tools/get_vendor.md) _(TOOL)_: Returns a vendor summary: total CVE count, product count, and a per-product list of associated CVE IDs. Costs 1 credit. - [get_vendor_product](https://docs.edgeprotect.io/mcp/tools/get_vendor_product.md) _(TOOL)_: Returns a product summary for a given vendor and product: total CVE count, version count, and a per-version breakdown with associated CVE IDs. Costs 1 credit. - [get_vendor_product_version](https://docs.edgeprotect.io/mcp/tools/get_vendor_product_version.md) _(TOOL)_: Returns up to 200 CVEs affecting a specific vendor, product, and version, with full compact CVE records and a truncation flag when the result set exceeds the 200-record cap. Costs 1 credit. - [search_products](https://docs.edgeprotect.io/mcp/tools/search_products.md) _(TOOL)_: Full-text search across product and vendor names in the CPE catalog. Returns matching product entries with their vendor. Costs 1 credit. - [list_top_vendors_by_cve_count](https://docs.edgeprotect.io/mcp/tools/list_top_vendors_by_cve_count.md) _(TOOL)_: Returns the top N CPE vendors ranked by total CVE count, giving you a quick view of which vendors carry the largest vulnerability surface. Costs 1 credit. ### CWE - [get_cwe](https://docs.edgeprotect.io/mcp/tools/get_cwe.md) _(TOOL)_: Retrieves a single CWE record: name, abstraction level, structure, status, description, extended description, likelihood of exploit, related weaknesses, applicable platforms, modes of introduction,… - [list_cwes](https://docs.edgeprotect.io/mcp/tools/list_cwes.md) _(TOOL)_: Search the CWE catalog (~964 records) by keyword. Returns matching weaknesses with their abstraction level and description. Costs 1 credit. - [list_top_cwes](https://docs.edgeprotect.io/mcp/tools/list_top_cwes.md) _(TOOL)_: Returns the most-referenced CWEs across all scored CVEs, ranked by how often each weakness appears across the CVE dataset. Useful for identifying systemic vulnerability patterns in a portfolio. Cos… ### MITRE ATT&CK - [get_mitre_technique](https://docs.edgeprotect.io/mcp/tools/get_mitre_technique.md) _(TOOL)_: Retrieve a single MITRE ATT&CK Enterprise technique by its identifier (e.g. T1059 or T1059.001), including description, platforms, kill-chain phases, detection guidance, and associated data sources… - [list_mitre_tactics](https://docs.edgeprotect.io/mcp/tools/list_mitre_tactics.md) _(TOOL)_: Returns all 14 ATT&CK Enterprise tactics with per-tactic statistics, including technique counts. Costs 1 credit. - [list_mitre_techniques](https://docs.edgeprotect.io/mcp/tools/list_mitre_techniques.md) _(TOOL)_: Returns MITRE ATT&CK Enterprise techniques, optionally filtered by tactic shortname (e.g. initial-access). Results are sorted by technique ID and capped by limit. Costs 1 credit. - [list_top_mitre_techniques](https://docs.edgeprotect.io/mcp/tools/list_top_mitre_techniques.md) _(TOOL)_: Returns the most-referenced MITRE ATT&CK techniques across intelligence reporting, ranked by mention count. Costs 1 credit. ### Atomic Red Team - [list_art_techniques](https://docs.edgeprotect.io/mcp/tools/list_art_techniques.md) _(TOOL)_: Returns the Atomic Red Team technique index (324 techniques), with an optional substring filter on technique ID or name. Costs 1 credit. - [list_art_atomic_tests](https://docs.edgeprotect.io/mcp/tools/list_art_atomic_tests.md) _(TOOL)_: Returns a paged list of Atomic Red Team atomic tests, optionally filtered by ATT&CK technique ID and platform. Useful for enumerating available test coverage before retrieving full test details wit… - [get_art_atomic_test](https://docs.edgeprotect.io/mcp/tools/get_art_atomic_test.md) _(TOOL)_: Fetches the full details of a single Atomic Red Team test by its internal id, including executors, input arguments, and dependencies. Costs 1 credit. ### Threat Actors - [list_threat_actors](https://docs.edgeprotect.io/mcp/tools/list_threat_actors.md) _(TOOL)_: List tracked threat actors, ranked by how much corroborated evidence exists for each (techniques + campaigns + CVEs + industries + malware). Optionally filter by type: ransomware, apt, cybercrime,… - [get_threat_actor](https://docs.edgeprotect.io/mcp/tools/get_threat_actor.md) _(TOOL)_: Full dossier for one threat actor: description, origin, motivation, aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft (leak site, RaaS model, initial access, sanctions),… - [list_threat_actor_cves](https://docs.edgeprotect.io/mcp/tools/list_threat_actor_cves.md) _(TOOL)_: The CVEs a threat actor is reported to have exploited, each with the evidence quote and source URL, plus CVSS, EPSS, CISA KEV status and action priority. Ordered KEV-first then by exploit probabili… - [get_cve_threat_actors](https://docs.edgeprotect.io/mcp/tools/get_cve_threat_actors.md) _(TOOL)_: Threat actors reported to have exploited a given CVE, each with the evidence quote and source URL that attributes it. The reverse of listthreatactorcves, and the fastest way to answer "is anyone ac… - [list_threat_actors_by_industry](https://docs.edgeprotect.io/mcp/tools/list_threat_actors_by_industry.md) _(TOOL)_: Threat actors reported to target a given industry (e.g. "Financial Services", "Healthcare", "Manufacturing"), each with the evidence quote and source URL. Industry names, slugs and aliases all matc… - [get_threat_actor_techniques](https://docs.edgeprotect.io/mcp/tools/get_threat_actor_techniques.md) _(TOOL)_: Full technique set for a threat actor. Uses MITRE ATT&CK where the actor is one of the ~170 named intrusion sets (returning MITRE's own cited usage text), and falls back to the in-house dataset for… ### IOCs - [search_iocs](https://docs.edgeprotect.io/mcp/tools/search_iocs.md) _(TOOL)_: Search 1M+ IOCs by substring across our IOC intelligence, optionally filtered by type, threat type, or malware family. Returns results sorted by firstseenutc descending. Costs 1 credit. - [lookup_ioc](https://docs.edgeprotect.io/mcp/tools/lookup_ioc.md) _(TOOL)_: Performs an exact-match lookup of a single IOC value across the IOC feed and blog-derived IOC references, returning enrichment data when the value is known. Costs 1 credit. - [list_recent_iocs](https://docs.edgeprotect.io/mcp/tools/list_recent_iocs.md) _(TOOL)_: Returns IOCs first seen in the last N days, optionally filtered by IOC type. Costs 1 credit. ### Malware Samples - [search_malware_samples](https://docs.edgeprotect.io/mcp/tools/search_malware_samples.md) _(TOOL)_: Search the malware sample corpus by substring match across file name, signature, or hash values. Returns paginated results ordered by most recently seen. Costs 1 credit. - [get_malware_sample](https://docs.edgeprotect.io/mcp/tools/get_malware_sample.md) _(TOOL)_: Retrieves a single malware sample from the malware sample corpus by its SHA-256 hash, returning key metadata and the detected signature. Costs 1 credit. - [list_recent_malware_samples](https://docs.edgeprotect.io/mcp/tools/list_recent_malware_samples.md) _(TOOL)_: Returns recently observed malware samples from the malware sample corpus, optionally filtered by file type and look-back window. Costs 1 credit. - [list_top_malware](https://docs.edgeprotect.io/mcp/tools/list_top_malware.md) _(TOOL)_: Returns the most-referenced malware families across intelligence reporting, ranked by mention count. Costs 1 credit. ### Blacklists - [lookup_ssl_blacklist](https://docs.edgeprotect.io/mcp/tools/lookup_ssl_blacklist.md) _(TOOL)_: Check the SSL blacklist to determine whether a SHA-1 TLS certificate fingerprint is associated with botnet command-and-control infrastructure or malware distribution. Costs 1 credit. - [lookup_ja3_blacklist](https://docs.edgeprotect.io/mcp/tools/lookup_ja3_blacklist.md) _(TOOL)_: Check the JA3 blacklist: is this JA3 MD5 fingerprint associated with malware or C2 activity? A match indicates the TLS client fingerprint has been observed in connection with known malicious infras… ### Shadowserver - [get_shadowserver_cve_activity](https://docs.edgeprotect.io/mcp/tools/get_shadowserver_cve_activity.md) _(TOOL)_: Returns daily Shadowserver honeypot observations for a single CVE over a configurable look-back window. Use this tool to understand how actively a vulnerability is being scanned or exploited across… - [list_shadowserver_top_cves](https://docs.edgeprotect.io/mcp/tools/list_shadowserver_top_cves.md) _(TOOL)_: Returns the top CVEs ranked by Shadowserver honeypot connection volume over a configurable look-back window. Use it to spot which vulnerabilities are being actively probed at scale right now. Costs… - [list_shadowserver_top_vendors](https://docs.edgeprotect.io/mcp/tools/list_shadowserver_top_vendors.md) _(TOOL)_: Returns the top vendors ranked by Shadowserver honeypot connection volume over a configurable look-back window. Use this to identify which vendor ecosystems are most actively targeted at a given mo… - [get_shadowserver_daily_stats](https://docs.edgeprotect.io/mcp/tools/get_shadowserver_daily_stats.md) _(TOOL)_: Returns aggregate Shadowserver honeypot statistics for each day in the requested window, including unique IP counts, total connections, and the number of active and distinct CVEs observed. Costs 1… ### Remediation - [get_top_affected_systems](https://docs.edgeprotect.io/mcp/tools/get_top_affected_systems.md) _(TOOL)_: Returns the most-referenced affected systems across intelligence reporting, ranked by mention count. Costs 1 credit. - [list_remediation_summary](https://docs.edgeprotect.io/mcp/tools/list_remediation_summary.md) _(TOOL)_: Returns the latest 5 AI-generated remediation summaries for a CVE, drawn from intelligence reporting and analysis. Costs 1 credit. - [list_recent_remediation_queue](https://docs.edgeprotect.io/mcp/tools/list_recent_remediation_queue.md) _(TOOL)_: Returns CVEs recently added to the remediation queue, ordered by queue insertion time. Costs 1 credit. ### Account & Meta - [account_status](https://docs.edgeprotect.io/mcp/tools/account_status.md) _(FREE)_: Returns the caller's credit balance and key metadata. Does not consume a credit. Free. ### Your Data · Cross-Reference - [assess_cve_exposure](https://docs.edgeprotect.io/mcp/tools/assess_cve_exposure.md) _(ORG)_: Assess your organisation's exposure to a specific CVE: your own EdgeProtect scan findings and affected assets, whether it's on your watchlist or alerts, inferred matches against your discovered sof… - [map_assets_to_actor](https://docs.edgeprotect.io/mcp/tools/map_assets_to_actor.md) _(ORG)_: Map your organisation's assets to a threat actor's TTPs. Resolves the actor (e.g. "Akira", "Qilin") to its MITRE ATT&CK techniques and linked CVEs, lists your matching discovered assets (optionally… - [appliances_exploited_by_actor](https://docs.edgeprotect.io/mcp/tools/appliances_exploited_by_actor.md) _(ORG)_: Which of your edge appliances (firewalls/VPNs/gateways) are tied to CVEs being actively exploited in the wild in the last N days, optionally attributed to a named actor (e.g. "Qilin"). Edge applian… ### Your Data · Attack Surface - [list_my_assets](https://docs.edgeprotect.io/mcp/tools/list_my_assets.md) _(ORG)_: List your organisation's EdgeProtect attack-surface scans with their target and roll-up counts (hosts, services, vulnerabilities). Costs 1 credit. - [list_my_software](https://docs.edgeprotect.io/mcp/tools/list_my_software.md) _(ORG)_: List the software discovered across your organisation's assets: CPE products (vendor/product/version) from EdgeProtect scans plus detected website technologies. Costs 1 credit. - [list_my_vulnerabilities](https://docs.edgeprotect.io/mcp/tools/list_my_vulnerabilities.md) _(ORG)_: List your organisation's EdgeProtect vulnerability findings with per-finding instance counts. Filter by severity, minimum CVSS, KEV-only, or has-CVE. Costs 1 credit. - [list_my_hosts](https://docs.edgeprotect.io/mcp/tools/list_my_hosts.md) _(ORG)_: List hosts discovered across your organisation's EdgeProtect scans (hostname, FQDN, OS) with IP and open-port counts. Costs 1 credit. - [get_open_ports](https://docs.edgeprotect.io/mcp/tools/get_open_ports.md) _(ORG)_: Which ports are open on a specific asset? Resolves the target (hostname, FQDN, or IP) within your assets and returns its open ports plus the detected service on each. Costs 1 credit. - [list_my_ports](https://docs.edgeprotect.io/mcp/tools/list_my_ports.md) _(ORG)_: List ports across your assets with host, IP and detected service. Filter by state (e.g. "open"), port number, protocol, or host (hostname/FQDN/IP substring). Costs 1 credit. - [list_my_services](https://docs.edgeprotect.io/mcp/tools/list_my_services.md) _(ORG)_: List detected services across your assets (product/version, HTTP server/title, TLS flag). Filter by product, port, or SSL-only. Costs 1 credit. - [list_my_ip_addresses](https://docs.edgeprotect.io/mcp/tools/list_my_ip_addresses.md) _(ORG)_: List IP addresses discovered across your assets, with geo/ASN/ISP enrichment. Costs 1 credit. - [list_my_network_ranges](https://docs.edgeprotect.io/mcp/tools/list_my_network_ranges.md) _(ORG)_: List the network CIDR ranges attributed to your organisation. Costs 1 credit. - [list_my_ssl_certificates](https://docs.edgeprotect.io/mcp/tools/list_my_ssl_certificates.md) _(ORG)_: List TLS certificates observed on your services, ordered by expiry. Set expiredonly to surface expired certs. Costs 1 credit. - [list_my_dns_records](https://docs.edgeprotect.io/mcp/tools/list_my_dns_records.md) _(ORG)_: List DNS records discovered for your domains. Filter by record type (A, AAAA, MX, TXT, CNAME, NS, ...). Costs 1 credit. - [list_my_discovered_domains](https://docs.edgeprotect.io/mcp/tools/list_my_discovered_domains.md) _(ORG)_: List domains found by your EdgeProtect discovery (registrar, registration/expiry, nameservers). Distinct from the brand-protection monitored list (see listmydomains). Costs 1 credit. - [list_my_exposed_credentials](https://docs.edgeprotect.io/mcp/tools/list_my_exposed_credentials.md) _(ORG)_: List breached/leaked credentials discovered for your domains: email, username and breach source, plus a total and a breakdown by source. Actual passwords (plaintext and hashes) are never returned,… ### Your Data · Watchlist - [list_my_relevant_cves](https://docs.edgeprotect.io/mcp/tools/list_my_relevant_cves.md) _(ORG)_: List CVEs flagged relevant to your organisation (matched to your vendors/products): your vulnerability watchlist, sorted by EPSS. Filter by KEV-only or minimum EPSS. Costs 1 credit. - [list_my_favorite_threat_groups](https://docs.edgeprotect.io/mcp/tools/list_my_favorite_threat_groups.md) _(ORG)_: List the threat groups/actors your organisation has favourited / follows. Costs 1 credit. - [get_my_industry](https://docs.edgeprotect.io/mcp/tools/get_my_industry.md) _(ORG)_: Get the industry group(s) configured for your organisation (drives industry-targeted threat relevance). Costs 1 credit. ### Your Data · Alerts - [list_my_alerts](https://docs.edgeprotect.io/mcp/tools/list_my_alerts.md) _(ORG)_: List your organisation's CVE alert/notification feed (triggered matches against your watched vendors/products), newest first. Set unseenonly to show only unread. Costs 1 credit. - [get_my_alert_config](https://docs.edgeprotect.io/mcp/tools/get_my_alert_config.md) _(ORG)_: Get your organisation's alert configuration: the watchlist entries (vendors/products/CVEs being monitored) and the notification recipient list. Costs 1 credit. - [list_my_domain_alerts](https://docs.edgeprotect.io/mcp/tools/list_my_domain_alerts.md) _(ORG)_: List your organisation's brand/domain intelligence alerts (new lookalike domains, DNS/WHOIS changes, disappearances), newest first. Set unreadonly to show only unread. Costs 1 credit. ### Your Data · Supply Chain - [list_my_lockfiles](https://docs.edgeprotect.io/mcp/tools/list_my_lockfiles.md) _(ORG)_: List the dependency lockfiles (SBOM) your organisation has uploaded, with package and findings counts. Costs 1 credit. - [check_my_supply_chain_exposure](https://docs.edgeprotect.io/mcp/tools/check_my_supply_chain_exposure.md) _(ORG)_: Match your organisation's lockfile dependencies against known software-supply-chain incidents (compromised/malicious packages). Returns candidate hits by package + ecosystem with installed vs affec… ### Your Data · Posture - [list_my_triage_findings](https://docs.edgeprotect.io/mcp/tools/list_my_triage_findings.md) _(ORG)_: List your organisation's triaged vulnerabilities (scored, with threat-actor / malware enrichment and an action priority), highest score first. Filter by action priority. Costs 1 credit. - [list_my_domains](https://docs.edgeprotect.io/mcp/tools/list_my_domains.md) _(ORG)_: List the domains your organisation monitors (brand/domain intelligence). Costs 1 credit. - [list_my_action_plans](https://docs.edgeprotect.io/mcp/tools/list_my_action_plans.md) _(ORG)_: List the AI-generated remediation action plans (to-do lists) for your organisation. Costs 1 credit. - [list_my_reports](https://docs.edgeprotect.io/mcp/tools/list_my_reports.md) _(ORG)_: List the threat-report analyses your organisation has run (report URL + extracted ATT&CK technique count). Costs 1 credit. ## Optional - [Sitemap](https://docs.edgeprotect.io/sitemap.xml): Full index of every documentation URL.