# MITRE ATT&CK [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Montimage/mitre-mcp  
**GitHub Stars:** 15  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mitre-att-ck

## Description
MCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK.

## Tools
Capabilities this server exposes over MCP:

- **get_techniques** — Get techniques from the MITRE ATT&CK framework with token-optimized responses.

    Args:
        ctx: FastMCP request context (injected by the server)
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        include_subtechniques: Include subtechniques in the result
        remove_revoked_deprecated: Remove revoked or deprecated objects
        include_descriptions: Whether to include technique descriptions (uses more tokens)
        limit: Maximum number of techniques to return (default: 20)
        offset: Index to start from when returning techniques (for pagination)

    Returns:
        Dictionary containing a list of techniques and pagination metadata
    
- **get_tactics** — Get tactics from the MITRE ATT&CK framework with token-optimized responses.

    Args:
        ctx: FastMCP request context (injected by the server)
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        remove_revoked_deprecated: Remove revoked or deprecated objects
        limit: Maximum number of tactics to return (default: 20)
        offset: Index to start from when returning tactics (for pagination)

    Returns:
        Dictionary containing a list of tactics and pagination metadata
    
- **get_groups** — Get groups from the MITRE ATT&CK framework with token-optimized responses.

    Args:
        ctx: FastMCP request context (injected by the server)
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        remove_revoked_deprecated: Remove revoked or deprecated objects
        limit: Maximum number of groups to return (default: 20)
        offset: Index to start from when returning groups (for pagination)

    Returns:
        Dictionary containing a list of groups and pagination metadata
    
- **get_software** — Get software from the MITRE ATT&CK framework with token-optimized responses.

    Args:
        ctx: FastMCP request context (injected by the server)
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        remove_revoked_deprecated: Remove revoked or deprecated objects
        software_types: Optional list of ATT&CK object types to include (e.g., ["malware"])
        limit: Maximum number of software to return (default: 20)
        offset: Index to start from when returning software (for pagination)

    Returns:
        Dictionary containing a list of software and pagination metadata
    
- **get_techniques_by_tactic** — Get techniques by tactic.

    Args:
        ctx: FastMCP request context (injected by the server)
        tactic_shortname: The shortname of the tactic (e.g., 'defense-evasion')
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        remove_revoked_deprecated: Remove revoked or deprecated objects
        limit: Maximum number of techniques to return (default: 20)
        offset: Index to start from when returning techniques (for pagination)

    Returns:
        Dictionary containing a list of techniques and pagination metadata
    
- **get_techniques_used_by_group** — Get techniques used by a group.

    Args:
        ctx: FastMCP request context (injected by the server)
        group_name: The name of the group
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        limit: Maximum number of techniques to return (default: 20)
        offset: Index to start from when returning techniques (for pagination)

    Returns:
        Dictionary containing the group, a list of techniques and pagination metadata
    
- **get_mitigations** — Get mitigations from the MITRE ATT&CK framework with token-optimized responses.

    Args:
        ctx: FastMCP request context (injected by the server)
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        remove_revoked_deprecated: Remove revoked or deprecated objects
        limit: Maximum number of mitigations to return (default: 20)
        offset: Index to start from when returning mitigations (for pagination)

    Returns:
        Dictionary containing a list of mitigations and pagination metadata
    
- **get_techniques_mitigated_by_mitigation** — Get techniques mitigated by a mitigation.

    Args:
        ctx: FastMCP request context (injected by the server)
        mitigation_name: The name of the mitigation
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)
        limit: Maximum number of techniques to return (default: 20)
        offset: Index to start from when returning techniques (for pagination)

    Returns:
        Dictionary containing the mitigation, a list of techniques and pagination metadata
    
- **get_technique_by_id** — Get a technique by its MITRE ATT&CK ID.

    Args:
        ctx: FastMCP request context (injected by the server)
        technique_id: The MITRE ATT&CK ID of the technique (e.g., 'T1055')
        domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)

    Returns:
        Dictionary containing the technique
    

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mitre-att-ck": {
    "command": "uvx",
    "args": ["mitre-mcp"]
  }
}
```

## Documentation

## What the MITRE ATT&CK MCP server does

The MITRE ATT&CK MCP server makes ATT&CK knowledge available to language models, assistants, and automation workflows through MCP. It covers Enterprise, Mobile, and ICS domains and provides access to techniques, tactical categories, threat groups, malware and tools, and security mitigations.

The server is suited to agents that need to look up ATT&CK entries or follow relationships in the framework. For example, an agent can find techniques associated with a tactic, identify techniques used by a group such as APT29, or retrieve the techniques addressed by a particular mitigation.

## How it works

The MITRE ATT&CK MCP server is built with the official MCP Python SDK and the mitreattack-python library. It can run locally over stdio or as an HTTP service using a streamable MCP endpoint. HTTP mode supports multiple simultaneous clients, asynchronous operation, and cross-origin requests for web-based clients.

ATT&CK data is cached per user. The cache supports conditional refreshes, stale results while a background refresh runs, and configurable expiration; the default expiration is 14 days. Enterprise data loads at startup, while Mobile and ICS data load when first requested. Pre-built indices provide constant-time technique lookups rather than scanning the full dataset for each ID query.

List and relationship operations use pagination. The default page size is 20, the maximum is 200, and responses include total count, offset, limit, and a flag indicating whether more results exist.

## Setup and configuration

Install the package from PyPI in a Python virtual environment, then run `mitre-mcp --help` to verify the installation. Start `mitre-mcp` for stdio transport, or use `mitre-mcp --http` to expose the MCP endpoint at the default local address. Clients using HTTP can connect to the `/mcp` path.

The server accepts custom HTTP host and port values. A non-loopback bind is unauthenticated unless `MITRE_HTTP_AUTH_TOKEN` is set or an authenticating reverse proxy is placed in front of the service. The token is sent as a Bearer token. Use absolute executable paths in stdio client configurations.

## Tools and capabilities

The MITRE ATT&CK MCP server exposes these tools:

- `get_techniques` lists techniques with filtering options.
- `get_technique_by_id` retrieves a technique such as `T1055`.
- `get_techniques_by_tactic` filters techniques by tactic.
- `get_tactics` lists tactical categories.
- `get_groups` lists threat actor groups.
- `get_techniques_used_by_group` returns techniques associated with a named group.
- `get_software` lists malware and other software with filtering.
- `get_mitigations` lists security mitigations.
- `get_techniques_mitigated_by_mitigation` returns techniques addressed by a mitigation.

Inputs are validated and responses are structured. The indexed technique data is intended to reduce lookup time, while paging keeps larger list results bounded.

## Limitations and notes

The endpoint contains public ATT&CK framework data and does not provide authentication automatically when bound to a non-loopback address. Exposing HTTP mode beyond localhost therefore requires the token setting or an authenticated reverse proxy.

Results are constrained by the paging defaults and maximum page size, so callers needing a complete collection must follow pagination metadata. Mobile and ICS data are not loaded until a request needs those domains.

_Full upstream README: https://allmcps.com/mcp/mitre-att-ck/readme_