MITRE ATT&CK MCP server
io.github.luongnv89/mitre-mcp·v0.3.1·15 starsMCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK.
15 stars74 downloads/wk
Reviews
Write oneNobody has reviewed MITRE ATT&CK yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
MITRE ATT&CK tools (9)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
get_groupsGet all groups from the MITRE ATT&CK framework.
get_mitigationsGet all mitigations from the MITRE ATT&CK framework.
get_softwareGet all software from the MITRE ATT&CK framework.
get_tacticsGet all tactics from the MITRE ATT&CK framework.
get_technique_by_idGet a technique by its MITRE ATT&CK ID.
get_techniquesGet techniques from the MITRE ATT&CK framework with token-optimized responses.
get_techniques_by_tacticGet techniques by tactic.
get_techniques_mitigated_by_mitigationGet techniques mitigated by a mitigation.
get_techniques_used_by_groupGet techniques used by a group.
Public scan report
scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it
- Code scan9 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 2 days ago15/15
- Maintainer identitynamespace and repository owner differ; GitHub account older than a year6/10
How MITRE ATT&CK compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 89/100
- higher than 80% of 48,255 servers
- Tools
- 9
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 15
- more than 90% of 28,688 servers
- Downloads a week
- 74
- more than 55% of 12,191 servers with a package
What its tools let an agent do: 9 read
Install MITRE ATT&CK in Claude Code, Cursor or VS Code
claude mcp add mitre-mcp -- uvx mitre-mcp
What the publisher says
From the MITRE ATT&CK repository's README, as published. We do not edit it. Read it on GitHub
<!-- mcp-name: io.github.luongnv89/mitre-mcp -->
mitre-mcp: MITRE ATT&CK MCP Server
Production-ready Model Context Protocol (MCP) server that exposes the MITRE ATT&CK® framework to LLMs, AI assistants, and automation workflows. Built with the official MCP Python SDK and mitreattack-python library for secure, high-performance access to adversary tactics, techniques, groups, software, and mitigations.
Available in the MCP Registry (search for io.github.luongnv89/mitre-mcp).
Highlights
- LLM-native experience – Seamless integration with Claude, Windsurf, Cursor, and any MCP-compatible client
- Secure-by-default – Validated inputs, TLS verification, disk-space checks, and structured error handling
- High performance – O(1) technique lookups using pre-built indices (80-95% faster than scanning)
- Flexible deployment – stdio for local clients or HTTP server for web-based integrations
Table of Contents
- Features
- Available MCP Tools
- Quick Start
- Web Frontend
- Documentation
- Configuration
- Performance
- Programmatic API
- Development
- Troubleshooting
- FAQ
- License
Features
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
MITRE ATT&CK: common questions
- Is MITRE ATT&CK MCP server safe?
- Yes, by our scan: it is graded A (89/100). Read the MITRE ATT&CK safety report
- How do I install MITRE ATT&CK?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does MITRE ATT&CK need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is MITRE ATT&CK maintained?
- The last commit was 35 days ago (2026-09-30). The latest release is v0.3.1.
- How does MITRE ATT&CK compare with other MCP servers?
- safety score 89/100 (higher than 80% of 48,255 servers); tools 9 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.