EdgeProtect
Tools

All Tools

The EdgeProtect MCP server exposes 71 tools. All cost 1 credit per successful call except account_status, which is free. Click any tool for full parameter, response, and example detail.

The Your Data tools (the *_my_*, get_open_ports, assess_cve_exposure, map_assets_to_actor, and appliances_exploited_by_actor tools) return your own organisation's data (assets, alerts, watchlist, supply-chain, and more) and cross-reference it with the threat intel. They require the mcp:org scope on your key; the organisation is resolved from the key and never read from the request. See Authentication.

Every tool's name is the exact string you pass to tools/call:

{ "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "<tool>", "arguments": { } } }

CVE, EPSS & KEV

Tool What it does
get_cve Full intelligence on a single CVE: NVD record, CVSS, EPSS, CISA KEV status, Shadowserver honeypot activity, notable events, and attributed threat actors with citations.
search_cves_by_vendor Highest-EPSS CVEs for a vendor, sorted by EPSS descending.
list_kev_recent CISA KEV entries added within the last N days.
list_high_epss_cves CVEs at or above an EPSS threshold, sorted descending.
list_recent_notable_events CVE events such as new NVD entries, high EPSS deltas, and CISA KEV additions.

CPE & Vendors

Tool What it does
get_vendor Vendor summary: total CVE count, product count, and product-to-CVE map.
get_vendor_product Product summary: CVE count, version count, and version-to-CVE map.
get_vendor_product_version Up to 200 CVEs affecting a specific vendor/product/version triple, with a truncation flag.
search_products Full-text search across CPE product names.
list_top_vendors_by_cve_count Top CPE vendors by total tracked CVE count.

CWE

Tool What it does
get_cwe Single CWE record: description, abstraction, related weaknesses, consequences, and mitigations.
list_cwes Search or page the CWE catalog (approximately 964 records).
list_top_cwes Most-referenced CWEs across scored CVEs.

MITRE ATT&CK

Tool What it does
get_mitre_technique Single ATT&CK technique or sub-technique: description, platforms, detection, and kill-chain phases.
list_mitre_tactics All 14 ATT&CK Enterprise tactics with per-tactic statistics.
list_mitre_techniques Techniques list, optionally filtered by tactic shortname.
list_top_mitre_techniques Most-referenced ATT&CK techniques across intelligence reporting.

Atomic Red Team

Tool What it does
list_art_techniques Atomic Red Team technique index (324 techniques), with optional substring filter.
list_art_atomic_tests Paged atomic test list, filterable by ATT&CK technique ID and platform.
get_art_atomic_test Full atomic test detail: executors, dependencies, and input arguments.

Threat Actors

Tool What it does
list_threat_actors Tracked actors ranked by corroborated evidence volume. Filterable by type (ransomware / apt / cybercrime / hacktivist).
get_threat_actor Full dossier: aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft, and linked CVEs / industries / malware, each with an evidence quote and source URL.
list_threat_actor_cves CVEs an actor is reported to exploit, with evidence quotes plus CVSS, EPSS, KEV status and action priority. KEV-first ordering.
get_cve_threat_actors Threat actors reported to have exploited a given CVE, each with the quote and source URL attributing it.
list_threat_actors_by_industry Threat actors reported to target a given industry, with citations. Matches industry names, slugs and aliases.
get_threat_actor_techniques Full technique set for an actor: MITRE ATT&CK where it is a named intrusion set, in-house data for the ~800 actors ATT&CK does not name.

IOCs

Tool What it does
search_iocs Substring search across 1M+ IOCs from our IOC intelligence, with filters by type, threat type, and malware family.
lookup_ioc Exact-match IOC lookup across the IOC feed and blog-derived IOCs, with enrichment.
list_recent_iocs IOCs first seen within the last N days.

Malware Samples

Tool What it does
search_malware_samples Search the malware sample corpus by substring, file type, or signature.
get_malware_sample Single sample by SHA-256 hash, with key metadata and signature.
list_recent_malware_samples Recently observed samples from our malware dataset, optionally filtered by file type.
list_top_malware Most-referenced malware families across intelligence reporting.

Blacklists

Tool What it does
lookup_ssl_blacklist Check whether a SHA-1 certificate fingerprint appears on the SSL blacklist as associated with botnet C2 or malware.
lookup_ja3_blacklist Check whether a JA3 MD5 fingerprint appears on the JA3 blacklist as associated with malware or C2.

Shadowserver Honeypot

Tool What it does
get_shadowserver_cve_activity Daily Shadowserver honeypot observations for a single CVE over N days.
list_shadowserver_top_cves Top CVEs by Shadowserver honeypot connections over a configurable window.
list_shadowserver_top_vendors Top vendors by Shadowserver honeypot connections.
get_shadowserver_daily_stats Aggregate Shadowserver daily statistics: unique IPs, connections, and active CVEs.

Remediation

Tool What it does
get_top_affected_systems Most-referenced affected systems across intelligence reporting.
list_remediation_summary Latest AI-generated remediation summaries for a CVE.
list_recent_remediation_queue CVEs recently added to the remediation queue.

Account & Meta

Tool What it does
account_status Free. Caller's current credit balance and API key metadata.

Your Data (scope mcp:org)

These tools return your own organisation's data and require the mcp:org scope. The organisation is resolved from your API key and injected server-side; it is never read from the request, so a key can only ever read its own org.

Your Data · Cross-Reference

Join your own assets and findings with EdgeProtect's threat intel.

Tool What it does
assess_cve_exposure Your exposure to a specific CVE: your findings + affected assets, watchlist/alert membership, inferred CPE matches, public intel, and recent exploitation.
map_assets_to_actor Map your assets to a threat actor's ATT&CK TTPs and linked CVEs, optionally filtered by vendor.
appliances_exploited_by_actor Your edge appliances tied to CVEs exploited in the wild in the last N days, optionally attributed to a named actor.

Your Data · Attack Surface

Your EdgeProtect attack-surface inventory: assets, ports, services, certs, and more.

Tool What it does
list_my_assets Your EdgeProtect scans with target and roll-up counts.
list_my_software Discovered software: CPE products + detected website technologies.
list_my_vulnerabilities Your vulnerability findings with instance counts; filter by severity/CVSS/KEV/has-CVE.
list_my_hosts Discovered hosts (hostname/FQDN/OS) with IP and open-port counts.
get_open_ports Which ports are open on a specific asset (hostname/FQDN/IP), with the service on each.
list_my_ports Ports across your assets with host/IP/service; filter by state, port, protocol, or host.
list_my_services Detected services (product/version, HTTP server/title, TLS); filter by product/port/SSL.
list_my_ip_addresses IP addresses with geo/ASN/ISP enrichment.
list_my_network_ranges Network CIDR ranges attributed to your organisation.
list_my_ssl_certificates TLS certificates on your services, ordered by expiry.
list_my_dns_records DNS records for your domains; filter by record type.
list_my_discovered_domains Domains found by EdgeProtect discovery (registrar/expiry/nameservers).
list_my_exposed_credentials Breached credentials for your domains (email/username/source). Passwords are never returned.

Your Data · Watchlist

Tool What it does
list_my_relevant_cves CVEs flagged relevant to your stack, sorted by EPSS.
list_my_favorite_threat_groups Threat groups your organisation follows.
get_my_industry The industry group(s) configured for your organisation.

Your Data · Alerts

Tool What it does
list_my_alerts Your CVE alert/notification feed; unseen_only available.
get_my_alert_config Your alert watchlist entries and notification recipients.
list_my_domain_alerts Brand/domain intelligence alerts; unread_only available.

Your Data · Supply Chain

Tool What it does
list_my_lockfiles Dependency lockfiles (SBOM) you've uploaded, with package/findings counts.
check_my_supply_chain_exposure Your dependencies matched against known software-supply-chain incidents.

Your Data · Posture

Tool What it does
list_my_triage_findings Your triaged vulnerabilities (scored, with actor/malware enrichment and action priority).
list_my_domains Domains your organisation monitors.
list_my_action_plans AI-generated remediation to-do lists.
list_my_reports Threat-report analyses you've run.