Stig MCP server

stig-mcp

Local MCP server that maps MITRE ATT&CK® techniques (and actors) to the NIST 800-53r5 controls that mitigate them, with the DISA STIG fix and check steps for the systems under consideration, severity-ordered.

<!-- mcp-name: io.github.jeneric/stig-mcp -->

Install

stig-mcp is on PyPI. With uv, a client runs it with no separate install step:

uvx stig-mcp

uvx comes with uv; install uv first if uvx --version does not run. The VS Code badge and the Claude Code plugin below both need it.

From a source checkout instead, install the dependencies with:

uv sync

The commands below are written for a checkout (uv run ...). Without one, run the same entry point with uvx --from stig-mcp, for example uvx --from stig-mcp stig-mcp-install-kb.

Quickstart

tool, which downloads the newest published release from this project's GitHub releases and verifies its SHA-256 before installing it. From a terminal the same is uv run stig-mcp-install-kb. A host that cannot reach GitHub installs from a file; see docs/operations.md, "Install a prebuilt knowledge base".

1. Wire the server into a client (see "Run the server" below) and start it.
2. Ask the agent to install the knowledge base. It calls the installknowledgebase

800-53 catalog, and DISA's STIG content. This transfers roughly a gigabyte and refuses to start with less than 2 GiB free. Then uv run stig-mcp-ingest builds the knowledge base.

1. Or build it yourself: uv run stig-mcp-fetch downloads ATT&CK, the CTID mapping, the

On a host that cannot reach dl.dod.cyber.mil, place the artifacts in the sources directory yourself and go straight to stig-mcp-ingest. That is a first-class path rather than a fallback: the ingest reads a directory and never consults the fetch. See docs/operations.md, "Placing the sources by hand".

Afterwards, uv run stig-mcp-fetch --check reports what MITRE ATT&CK, CTID, NIST and DISA have published since, exiting 10 when there is something to take and 3 when a source could not be reached, and --refresh takes it. Neither rebuilds the knowledge base; see "Keeping current" in the same document.

Run the server

uvx stig-mcp

or, from a checkout, uv run stig-mcp.

This is a stdio MCP server: it speaks JSON-RPC on stdin/stdout and logs to stderr, so it is launched by an MCP client rather than run standalone.

It starts whether or not the knowledge base exists, and it never answers from one it cannot trust. Called before the knowledge base is installed, or against one an older release wrote, every tool returns a notready payload instead of an answer: the reason, which source files it can and cannot see, the sources directory it looked in, and the next steps, led by the installknowledgebase tool and followed by the commands to run. Each command comes in two forms: run, which works from the server's own environment, and asinstalled, which a person can type into a terminal, written for how the server was installed (uvx, a checkout, or an installed copy). That is deliberate, so an agent can read the remedy from the tool result rather than the operator having to find a log pane. Install or rebuild the knowledge base and the running server picks it up without a restart.

The checksources tool tells an agent whether a newer knowledge base is published. It and installknowledge_base are the only two tools that contact the network, and they reach only this project's GitHub releases.

GitHub Copilot in VS Code

Shortened. The full README is on GitHub.