MITRE ATT&CK

What the MITRE ATT&CK MCP server does

The MITRE ATT&CK MCP server makes ATT&CK knowledge available to language models, assistants, and automation workflows through MCP. It covers Enterprise, Mobile, and ICS domains and provides access to techniques, tactical categories, threat groups, malware and tools, and security mitigations.

The server is suited to agents that need to look up ATT&CK entries or follow relationships in the framework. For example, an agent can find techniques associated with a tactic, identify techniques used by a group such as APT29, or retrieve the techniques addressed by a particular mitigation.

How it works

The MITRE ATT&CK MCP server is built with the official MCP Python SDK and the mitreattack-python library. It can run locally over stdio or as an HTTP service using a streamable MCP endpoint. HTTP mode supports multiple simultaneous clients, asynchronous operation, and cross-origin requests for web-based clients.

ATT&CK data is cached per user. The cache supports conditional refreshes, stale results while a background refresh runs, and configurable expiration; the default expiration is 14 days. Enterprise data loads at startup, while Mobile and ICS data load when first requested. Pre-built indices provide constant-time technique lookups rather than scanning the full dataset for each ID query.

List and relationship operations use pagination. The default page size is 20, the maximum is 200, and responses include total count, offset, limit, and a flag indicating whether more results exist.

Setup and configuration

Install the package from PyPI in a Python virtual environment, then run mitre-mcp --help to verify the installation. Start mitre-mcp for stdio transport, or use mitre-mcp --http to expose the MCP endpoint at the default local address. Clients using HTTP can connect to the /mcp path.

The server accepts custom HTTP host and port values. A non-loopback bind is unauthenticated unless MITRE_HTTP_AUTH_TOKEN is set or an authenticating reverse proxy is placed in front of the service. The token is sent as a Bearer token. Use absolute executable paths in stdio client configurations.

Tools and capabilities

The MITRE ATT&CK MCP server exposes these tools:

• get_techniques lists techniques with filtering options.
• get_technique_by_id retrieves a technique such as T1055.
• get_techniques_by_tactic filters techniques by tactic.
• get_tactics lists tactical categories.
• get_groups lists threat actor groups.
• get_techniques_used_by_group returns techniques associated with a named group.
• get_software lists malware and other software with filtering.
• get_mitigations lists security mitigations.
• get_techniques_mitigated_by_mitigation returns techniques addressed by a mitigation.

Inputs are validated and responses are structured. The indexed technique data is intended to reduce lookup time, while paging keeps larger list results bounded.

Limitations and notes

The endpoint contains public ATT&CK framework data and does not provide authentication automatically when bound to a non-loopback address. Exposing HTTP mode beyond localhost therefore requires the token setting or an authenticated reverse proxy.

Results are constrained by the paging defaults and maximum page size, so callers needing a complete collection must follow pagination metadata. Mobile and ICS data are not loaded until a request needs those domains.