MITRE ATT&CK

Provides access to MITRE ATT&CK data via an MCP-compatible server with tools for querying techniques, groups, software, and mitigations, plus Navigator layer generation.

python

1

GitHub Stars

python

Language

4 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "imouiche-complete-mitre-attack-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@imouiche/mitre-attack-mcp-server"
      ]
    }
  }
}

You will learn how to use the MITRE ATT&CK MCP Server to access and reason about the MITRE ATT&CK framework through an MCP-compatible client. This server provides machine-callable, structured outputs from official MITRE data, enabling you to query techniques, groups, software, and mitigations, generate ATT&CK Navigator layers, and reason about threat relationships with low latency and strong type safety.

How to use

You can interact with the MCP Server using MCP-compatible clients or tools that support the Model Context Protocol. Start by installing the MCP server as described in the installation section, then connect your client to the server using the MCP URL or the local runtime command. Once connected, you can perform these practical tasks:

How to install

Prerequisites: Python 3.12+ and Node.js 16+ for NPM-based installation.

pip install mitre-mcp-server

npm install -g @imouiche/mitre-attack-mcp-server

npx @imouiche/mitre-attack-mcp-server

Additional sections

Configuration notes, data caching details, and usage tips are provided to help you tailor the MCP server to your environment.

Quick start steps include installing the server, ensuring the data download completes automatically on first run, and then starting queries against ATT&CK techniques, groups, and software.

Notes on usage

Data downloads occur automatically on first run and are cached locally. The default local cache directory is ~/.mitre-mcp-server/data/. You can generate ATT&CK Navigator layers for visualization and offline analysis by requesting a Navigator-compatible JSON payload from the server.

Available tools

get_data_stats

Show download status, file paths, sizes, and ATT&CK release version

generate_layer

Generate an ATT&CK Navigator layer (JSON output)

get_layer_metadata

Return Navigator layer metadata template

get_technique_by_id

Get a technique by ATT&CK ID (e.g., T1055)

search_techniques

Search techniques by name or description

get_all_techniques

Retrieve all techniques

get_all_parent_techniques

Parent techniques only

get_all_subtechniques

All subtechniques

get_subtechniques_of_technique

Subtechniques of a parent

get_parent_technique_of_subtechnique

Parent of a subtechnique

get_technique_tactics

Tactics associated with a technique

get_techniques_by_tactic

Techniques under a tactic

get_techniques_by_platform

Techniques for a platform

get_revoked_techniques

Revoked techniques

get_group_by_name

Find group by name or alias

search_groups

Search groups

get_all_groups

All ATT&CK groups

get_groups_by_alias

Lookup groups by alias

get_groups_using_technique

Groups using a technique

get_groups_using_software

Groups using software

get_groups_attributing_to_campaign

Groups attributed to a campaign

get_software

Get all software

search_software

Search software

get_software_by_alias

Lookup software by alias

get_software_used_by_group

Software used by a group

get_software_used_by_campaign

Software used in campaigns

get_software_using_technique

Software using a technique

get_all_campaigns

Get all campaigns

get_campaigns_by_alias

Lookup campaigns by alias

get_campaigns_using_technique

Campaigns using a technique

get_campaigns_using_software

Campaigns using software

get_campaigns_attributed_to_group

Campaign attribution

get_all_mitigations

Get all mitigations

get_mitigations_mitigating_technique

Mitigations for a technique

get_techniques_mitigated_by_mitigation

Techniques mitigated by a mitigation

get_all_tactics

Get all tactics

get_all_datasources

Get all data sources

get_all_datacomponents

Get all data components

get_datacomponents_detecting_technique

Data components detecting a technique

get_all_assets

Get ICS assets

get_assets_targeted_by_technique

Assets targeted by a technique