# Mitre Attck [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-mitre-attck  
**GitHub Stars:** 0  
**npm Downloads (last month):** 693  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mitre-attck

## Description
MITRE ATT&CK adversary TTPs (STIX bundles)

## Tools
Capabilities this server exposes over MCP:

- **technique** — Technique by ATT&CK id.
- **tactic** — Tactic by id or short name.
- **group** — Threat group (e.g. G0007).
- **software** — Software/malware (e.g. S0002).
- **mitigation** — Mitigation.
- **search** — Substring search across the bundle.
- **domains** — List loaded STIX bundles.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mitre-attck": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-mitre-attck"]
  }
}
```

## Documentation

## What Mitre Attck does

Mitre Attck exposes MITRE ATT&CK content to MCP-compatible AI clients. Its data comes from MITRE's official CTI repository in STIX 2.1 format and covers three loaded domains: enterprise, mobile, and ICS. The integration is independent and unofficial.

The pack is useful for retrieving a record when an agent already has an ATT&CK identifier, or for finding records through text search. Example identifiers include `T1190` for a technique, `T1059.001` for a sub-technique, `G0007` for a threat group, and `S0002` for software.

## How it works

The hosted MCP endpoint is available at `https://gateway.pipeworx.io/mitre-attck/mcp`. A client can connect to that URL directly, or launch the npm package `@pipeworx/mcp-mitre-attck` with `npx`; the package forwards requests to the same gateway. Both approaches need network connectivity and have no offline mode.

The gateway caches the loaded ATT&CK data for one hour. Pack endpoints also expose shared Pipeworx meta-tools alongside the pack's own tools. The local bridge lists only the pack tools by default; setting `PIPEWORX_META_TOOLS=1` adds the gateway-wide tools, including `ask_pipeworx`. The full gateway is also available at `https://gateway.pipeworx.io/mcp`.

Direct HTTP calls are supported through the gateway's tools API. For example, a technique lookup can be sent as a JSON POST request to `/v1/tools/technique`.

## Setup and configuration

A hosted connection can be added to an MCP client with this configuration:

```json
{
  "mcpServers": {
    "mitre-attck": {
      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"
    }
  }
}
```

For a local stdio connection, use:

```json
{
  "mcpServers": {
    "mitre-attck": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-mitre-attck"]
    }
  }
}
```

Anonymous use is capped at 50 calls per day. A free Pipeworx account raises the limit to 200 calls per day; provide its key as `PIPEWORX_API_KEY` in the MCP server's environment. Set `NODE_USE_ENV_PROXY=1` when using a Node release that supports built-in proxy handling and the runtime must honor `HTTPS_PROXY`.

## Tools and capabilities

The pack provides these operations:

- `technique(id)` retrieves a technique by ATT&CK ID.
- `tactic(id_or_short_name)` retrieves a tactic record.
- `group(id)` retrieves a threat group.
- `software(id)` retrieves software or malware.
- `mitigation(id)` retrieves a mitigation.
- `search(query, type?)` performs substring searches across the loaded bundle.
- `domains()` lists the loaded enterprise, mobile, and ICS bundles.

The gateway's `ask_pipeworx` tool can accept a plain-language question and select a tool and arguments automatically. HTTP callers can inspect a tool with `GET /v1/tools/{name}`.

## Limitations and notes

This integration depends on the remote Pipeworx gateway and MITRE bundle availability. It is not an offline database. The scoped endpoint includes shared gateway meta-tools, so an MCP client's reported tool count can exceed the pack's seven ATT&CK-specific operations. API usage is metered when a key is supplied, and the integration is not affiliated with MITRE.

_Full upstream README: https://allmcps.com/mcp/mitre-attck/readme_