Mitre Attack MCP server
io.github.imouiche/mitre-attack-mcp-server·v0.1.1·5 starsMCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations
5 stars60 downloads/wk
Reviews
Write oneNobody has reviewed Mitre Attack yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Mitre Attack tools (65)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
generate_layerGenerate an ATT&CK Navigator layer for visualization.
get_all_assetsGet all ATT&CK assets in a domain (primarily ICS).
get_all_campaignsGet all ATT&CK campaigns in a domain.
get_all_datacomponentsGet all ATT&CK data components in a domain.
get_all_datasourcesGet all ATT&CK data sources in a domain.
get_all_groupsGet all APT groups (intrusion sets) in a domain.
get_all_matricesGet all ATT&CK matrices in a domain.
get_all_mitigationsGet all mitigations (defensive countermeasures) in a domain.
get_all_parent_techniquesGet all parent techniques (exclude subtechniques) in a given domain.
get_all_softwareGet all software (malware and tools) in a domain.
get_all_subtechniquesGet all subtechniques in a given ATT&CK domain.
get_all_tacticsGet all ATT&CK tactics for a domain.
get_all_techniquesGet all ATT&CK techniques for a given domain.
get_assets_targeted_by_techniqueGet all ICS assets targeted by a specific technique.
get_attack_idConvert a STIX UUID into its human-readable ATT&CK ID.
get_campaigns_attributed_to_groupGet all campaigns attributed to a specific intrusion set (APT group), identified by its STIX ID.
get_campaigns_by_aliasGet campaigns by their alias.
get_campaigns_using_softwareGet all campaigns that use specific software/malware.
get_campaigns_using_techniqueGet all campaigns that use a specific technique.
get_data_statsReturn statistics about downloaded MITRE ATT&CK STIX data.
get_datacomponents_detecting_techniqueGet all data components that can detect a specific technique.
get_group_by_nameRetrieve an intrusion set (APT group) by name or alias (case-insensitive match).
get_group_techniquesGet all techniques used by a specific APT group (intrusion set).
get_groups_attributing_to_campaignGet all APT groups (intrusion sets) attributed to a specific campaign.
get_groups_by_aliasGet APT groups (intrusion sets) matching a given alias.
get_groups_using_softwareGet all APT groups (intrusion sets) that use a specific software/malware.
get_groups_using_techniqueGet all APT groups (intrusion sets) that use a specific technique.
get_layer_metadataReturn a standard ATT&CK Navigator layer metadata template.
get_mitigations_mitigating_techniqueGet all mitigations that address a specific technique.
get_nameResolve the human-readable object name for a given STIX ID.
get_object_by_attack_idRetrieve any MITRE ATT&CK object by its external ATT&CK ID and STIX type.
get_object_by_stix_idRetrieve any MITRE ATT&CK object by its STIX ID (UUID).
get_objects_by_contentSearch MITRE ATT&CK objects by matching text inside their description field.
get_objects_by_nameRetrieve MITRE ATT&CK objects by exact name match (case-sensitive).
get_objects_by_typeGet all objects of a specific STIX type.
get_objects_created_afterGet all ATT&CK objects created after a specific timestamp.
get_objects_modified_afterGet all ATT&CK objects modified after a specific timestamp.
get_parent_technique_of_subtechniqueGet the parent technique of a subtechnique.
get_procedure_examples_by_tacticGet all procedure examples for techniques in a specific tactic.
get_procedure_examples_by_techniqueGet procedure examples showing how threat groups used a specific technique.
get_revoked_techniquesGet all revoked techniques for a domain.
get_softwareGet all software (malware and tools) in a given ATT&CK domain.
get_software_by_aliasFind software/malware by alias (e.g., 'Beacon', 'Mimilib').
get_software_used_by_campaignGet all software/malware used in a specific campaign.
get_software_used_by_groupGet all software (malware and tools) used by a specific APT group, identified by its STIX ID.
get_software_using_techniqueGet all software (malware/tools) that use a specific technique.
get_statsGet basic statistics about the loaded ATT&CK data for a given domain.
get_stix_typeDetermine the STIX object type for a given STIX ID.
get_subtechniques_of_techniqueGet all subtechniques of a parent technique.
get_tactics_by_matrixGet all ATT&CK tactics belonging to a specific matrix.
get_tactics_by_techniqueGet all tactics associated with a specific ATT&CK technique.
get_technique_by_id" Retrieve a MITRE ATT&CK technique by its external ATT&CK ID (e.g., "T1055", "T1053.005").
get_technique_tacticsGet the ATT&CK tactic names associated with a given technique.
get_techniques_by_platformGet all ATT&CK techniques that apply to a specific platform.
get_techniques_by_tacticGet all techniques associated with a specific ATT&CK tactic.
get_techniques_detected_by_datacomponentGet all techniques that can be detected by a specific data component.
get_techniques_mitigated_by_mitigationGet all techniques mitigated by a specific mitigation (by STIX ID).
get_techniques_targeting_assetGet all techniques that target a specific ICS asset.
get_techniques_used_by_campaignGet all techniques used in a specific campaign.
get_techniques_used_by_groupGet all techniques used by a specific APT group, identified by its STIX ID.
get_techniques_used_by_group_softwareGet techniques used by the software that a group uses (Group → Software → Techniques).
get_techniques_used_by_softwareGet all techniques used by specific software/malware.
search_groupsSearch MITRE ATT&CK intrusion sets (APT groups) by name, alias, or description (case-insensitive).
search_softwareSearch MITRE ATT&CK software (malware & tools) by keyword in name or description (case-insensitive).
search_techniquesSearch MITRE ATT&CK techniques by keyword in their name or description.
Public scan report
scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it
- Code scan7 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 284 days ago4/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Mitre Attack compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 75/100
- higher than 45% of 48,255 servers
- Tools
- 65
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 5
- more than 83% of 28,688 servers
- Downloads a week
- 60
- more than 49% of 12,191 servers with a package
What its tools let an agent do: 64 read · 1 create
Install Mitre Attack in Claude Code, Cursor or VS Code
Runs npx -y @imouiche/mitre-attack-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-server
What the publisher says
From the Mitre Attack repository's README, as published. We do not edit it. Read it on GitHub
🛡️ MITRE ATT&CK MCP Server
AI-Native Access to the World's Leading Threat Intelligence Framework
Features • Installation • Quick Start • Tools • Examples • Roadmap
🎯 Overview
The MITRE ATT&CK MCP Server transforms the world's leading adversary knowledge base into an AI-native interface. Built for the Model Context Protocol, it enables LLMs and agentic systems to:
- 🔍 Query 200+ techniques, 140+ groups, 700+ software entries
- 🧠 Reason over complex threat relationships and TTPs
- 📊 Visualize coverage gaps with ATT&CK Navigator layers
- ⚡ Scale threat intelligence workflows with structured tools
Perfect for: Security teams, threat hunters, detection engineers, AI researchers, and anyone building intelligent security systems.
What is this?
mitre-attack-mcp-server is a self-contained MCP server that provides machine-callable access to the MITRE ATT&CK framework using official STIX data with LLMs friendly structured outputs.
It enables:
- 🤖 LLMs to reason about ATT&CK techniques, groups, software, and mitigations
- 🧠 Agentic workflows to generate threat explanations and coverage maps
- 🔍 Security teams to query ATT&CK relationships programmatically
- 📊 Visualization via ATT&CK Navigator layers
No scraping. No fragile APIs. Just official MITRE data, structured and reliable.
📑 Table of Contents
- Overview
- Key Features
- Installation
- Quick Start
- MCP Registry
- Available Tools
- Example Queries
- ATT&CK Navigator
- Technical Details
- Roadmap & Vision
- Contributing
- License
✨ Key Features
- ✅ 65+ MCP tools across ATT&CK domains (Enterprise, Mobile, ICS)
- ✅ Automatic STIX download & caching on first run
- ✅ Native ATT&CK Navigator layer generation
- ✅ Designed for LLMs & MCP-compatible clients
- ✅ In-memory caching for instant query responses
- ✅ Type-safe with Pydantic models
- ✅ Clean, production-ready, self-contained server
- ✅ Comprehensive test coverage
📦 Installation
Via PyPI (recommended) - Python Users
pip install mitre-mcp-servernpm
npm install -g @imouiche/mitre-attack-mcp-servernpx (no installation required)
npx @imouiche/mitre-attack-mcp-serverVia uv (Modern Python)
uv pip install mitre-mcp-serverLocal Development
git clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git
cd complete-mitre-attack-mcp-server
npm installUsing uv (Python package manager)
git clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git
cd complete-mitre-attack-mcp-server
uv sync⚡ Quick Start
1. Install
pip install mitre-mcp-server2. Configure Claude Desktop
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Mitre Attack: common questions
- Is Mitre Attack MCP server safe?
- Mostly: it is graded B (75/100). Read the Mitre Attack safety report
- How do I install Mitre Attack?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Mitre Attack need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Mitre Attack maintained?
- The last commit was 317 days ago (2025-12-22). The latest release is v0.1.1.
- How does Mitre Attack compare with other MCP servers?
- safety score 75/100 (higher than 45% of 48,255 servers); tools 65 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.