Your Data · Cross-Reference

`appliances_exploited_by_actor`

Which of your edge appliances (firewalls/VPNs/gateways) are tied to CVEs being actively exploited in the wild in the last N days, optionally attributed to a named actor (e.g. "Qilin"). Edge appliances are identified by a curated vendor allowlist, overridable via "vendors". Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only: the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

actorstringoptional

Optional threat actor / group name or alias to attribute exploitation to, e.g. Qilin. Maximum 120 characters.

daysintegeroptionaldefault 7

Shadowserver exploitation window, in days. Accepted range: 1–90.

vendorsarrayoptional

Optional override of the curated edge-appliance vendor allowlist. Provide lowercase CPE vendor slugs. Maximum 40 items.

Example invocation

Ask your agent:

Which of my edge appliances are being exploited by Qilin this week?

Raw JSON-RPC:

curl -s https://api.edgeprotect.io/functions/v1/mcp \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "appliances_exploited_by_actor",
      "arguments": { "actor": "Qilin", "days": 7 }
    }
  }'

Response

{
  "actor": "Qilin",
  "actor_slug": "qilin",
  "actor_aliases": ["Agenda", "Water Galura"],
  "window_days": 7,
  "my_appliances": [
    {
      "vendor": "f5",
      "product": "big-ip",
      "version": "17.1.0",
      "cpe": "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*"
    },
    {
      "vendor": "sonicwall",
      "product": "sonicos",
      "version": "7.0.1",
      "cpe": "cpe:2.3:o:sonicwall:sonicos:7.0.1:*:*:*:*:*:*:*"
    }
  ],
  "recently_exploited_for_my_appliances": [
    {
      "cve_id": "CVE-2023-46805",
      "vendor": "f5",
      "product": "big-ip",
      "connections": 967,
      "last_observed": "2026-06-17",
      "severity": "CRITICAL",
      "cisa_kev": true
    }
  ],
  "attributed_to_actor": ["CVE-2023-46805"],
  "note": null,
  "generated_at": "2026-06-18T09:30:00.000Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

actorstring | nulloptional

The resolved canonical actor name: from MITRE ATT&CK if it matched there, otherwise from the in-house dataset. null when no actor argument was supplied, or when the name resolved against neither dataset. A non-null value is your confirmation that the name was understood.

actor_slugstring | nulloptional

The actor's slug when it exists in the in-house dataset. Pass it to get_threat_actor for the full dossier.

actor_aliasesarrayoptional

Known aliases for the resolved actor. Empty when no actor was supplied or the actor could not be resolved.

window_daysintegeroptional

The Shadowserver exploitation window used for this request, in days.

my_appliancesarrayoptional

Your discovered edge appliances matched against the (curated or overridden) vendor allowlist. Each entry has vendor, product, version, and cpe.

recently_exploited_for_my_appliancesarrayoptional

CVEs tied to your appliances that show recent in-the-wild exploitation. Each entry has cve_id, vendor, product, connections (count over the window), last_observed (date), severity, and cisa_kev (boolean).

attributed_to_actorarrayoptional

CVE identifiers from recently_exploited_for_my_appliances that are attributed to the named actor. Attribution is the union of the legacy CVE-attribution set and the in-house cited actor_cve claims. Empty when no actor was supplied, when the name did not resolve, or when none of your recently-exploited appliance CVEs are attributed to that actor.

notestring | nulloptional

Set when no edge appliance in your attack surface matched the vendor allowlist, i.e. the whole result is empty because nothing was in scope, not because nothing was found. Otherwise null.

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: days: min:1`	`days` is less than 1.
`-32602`	`invalid_params: days: max:90`	`days` exceeds 90.
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

For a complete reference of JSON-RPC error codes, see Errors.