Alex Llm Attack MCP Server

What alex-llm-attack-mcp-server MCP server does

The alex-llm-attack-mcp-server MCP server provides an MCP interface to ATT&CK techniques and tactics. Its data source is the enterprise-attack.json dataset, which should be present in the project root when starting the service directly.

The server supports lookups by ATT&CK technique ID or by name. Name searches can use partial matches, so an agent can search for a term such as phishing without knowing the exact technique title. The returned ATT&CK information can include technique identifiers, names, descriptions, platforms, kill-chain phases, references, sub-techniques, and mitigations.

How it works

After an MCP client connects, it can call six tools:

• query_technique looks up a technique by optional ID or name.
• search_technique_full returns more complete technique records; name searches return a results list and count.
• query_mitigations retrieves mitigations for a required technique ID.
• query_detections retrieves detection guidance for a required technique ID.
• list_tactics returns the available ATT&CK tactics without arguments.
• server_info returns service, dataset, maintainer, and Git information without arguments.

The alex-llm-attack-mcp-server MCP server defaults to stdio when launched with python main.py, which suits local MCP client integrations. It can also run in HTTP mode and expose a streamable endpoint such as http://127.0.0.1:8081/mcp. HTTP mode is useful for remote, development, debugging, or container deployments.

Setup and configuration

Clone the repository and install dependencies with pip install -r requirements.txt. Ensure enterprise-attack.json is in the project root, then start the default local mode with:

python main.py

For HTTP mode, use a command such as:

python main.py --mode http --host 127.0.0.1 --port 8081

The supported environment settings include ATTACK_MCP_MODE, ATTACK_MCP_HOST, ATTACK_MCP_PORT, and ATTACK_MCP_LOG_LEVEL. The process can also read PORT in hosted environments. Docker deployment is supported by building the repository image and publishing port 8081.

Tools and capabilities

Use technique_id for exact identifier lookups such as T1059.001, or tech_name for partial-name searches. Use search_technique_full when the agent needs the broader record rather than a basic query result. Mitigation and detection calls require a technique ID, while tactic and server metadata calls require no arguments.

These capabilities make the alex-llm-attack-mcp-server MCP server suitable for agents that need to identify ATT&CK techniques, inspect related defensive measures, review detection guidance, enumerate tactics, or check the loaded service and dataset versions.

Limitations and notes

The material describes ATT&CK querying and does not document write operations, live threat-intelligence retrieval, or data updates. The dataset must be available locally for direct execution. Client-specific configuration is not included; the MCP client must be configured with the local command or HTTP endpoint and the tool names.

The server supports both stdio and streamable HTTP transports. Hosted environments may provide PORT or transport-related settings, and the application can fall back to HTTP for several streamable transport values. Verify the selected client’s configuration format before connecting.