mitre-mcp: MITRE ATT&CK MCP Server

Production-ready Model Context Protocol (MCP) server that exposes the MITRE ATT&CK® framework to LLMs, AI assistants, and automation workflows. Built with the official MCP Python SDK and mitreattack-python library for secure, high-performance access to adversary tactics, techniques, groups, software, and mitigations.

Available in the MCP Registry (search for io.github.luongnv89/mitre-mcp).

Highlights

• LLM-native experience – Seamless integration with Claude, Windsurf, Cursor, and any MCP-compatible client
• Secure-by-default – Validated inputs, TLS verification, disk-space checks, and structured error handling
• High performance – O(1) technique lookups using pre-built indices (80-95% faster than scanning)
• Flexible deployment – stdio for local clients or HTTP server for web-based integrations

Table of Contents

• Features
• Available MCP Tools
• Quick Start
• Web Frontend
• Documentation
• Configuration
• Performance
• Programmatic API
• Development
• Troubleshooting
• FAQ
• License

Features

• Comprehensive MITRE ATT&CK Coverage - All techniques, tactics, groups, software, and mitigations
• Multi-Domain Support - Enterprise, Mobile, and ICS ATT&CK domains
• Intelligent Caching - Automatic caching with configurable expiry (default: 24 hours)
• Performance Optimized - O(1) lookups using pre-built indices (80-95% faster)
• Dual Transport Modes - stdio for local clients, HTTP for web integrations
• CORS-Enabled HTTP Server - Async notifications and cross-origin request support
• Comprehensive Testing - 114 tests with 66% code coverage
• Pre-commit Quality Checks - Automated formatting, linting, type checking, and security scanning
• Input Validation - Secure-by-default with validated inputs and sanitized responses
• Programmatic API - Python and Node.js clients (see API-INTEGRATION.md)

Available MCP Tools

Quick Start

Installation

1. Create and activate a virtual environment:

python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate.bat

2. Install from PyPI:

pip install mitre-mcp

3. Verify installation:

mitre-mcp --help

HTTP Mode (Recommended)

Start the server:

mitre-mcp --http

Expected output:

2025-11-17 22:40:10,991 - mitre_mcp.mitre_mcp_server - INFO - Starting MITRE ATT&CK MCP Server (HTTP mode on localhost:8000)
======================================================================
MCP Client Configuration (Streamable HTTP Transport)
Server URL: http://localhost:8000
MCP Endpoint: http://localhost:8000/mcp

Add this to your MCP client configuration:
{
  "mcpServers": {
    "mitreattack": {
      "url": "http://localhost:8000/mcp"
    }
  }
}
======================================================================

Configure your MCP client:

Add this JSON to your client's configuration file:

{
  "mcpServers": {
    "mitreattack": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

Configuration file locations:

• macOS (Claude Desktop): ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows (Claude Desktop): %APPDATA%\Claude\claude_desktop_config.json
• Linux (Claude Desktop): ~/.config/Claude/claude_desktop_config.json
• VSCode: Configure in your MCP extension settings

Custom host and port:

mitre-mcp --http --host 0.0.0.0 --port 8080

Then use http://your-server-ip:8080/mcp in your client configuration.

Why HTTP mode?

• Multiple clients can connect simultaneously
• Better concurrency and async support
• Easier debugging with HTTP tools
• CORS support for web-based clients
• No path configuration needed

stdio Mode (Alternative)

For local-only clients that require stdio transport:

mitre-mcp

Client configuration:

{
  "mcpServers": {
    "mitreattack": {
      "command": "/absolute/path/to/.venv/bin/python",
      "args": ["-m", "mitre_mcp.mitre_mcp_server"]
    }
  }
}

Note: Use absolute paths. HTTP mode is recommended for most use cases.

Force Data Download

Force a fresh download of MITRE ATT&CK data:

mitre-mcp --http --force-download

Example Screenshots

VSCode Configuration:

Tool Invocation:

Results:

Web Frontend

A modern React-based web interface is available in the frontend/ directory for interactive exploration of MITRE ATT&CK through a chat interface.

Features:

• Clean, minimal design with black/white/gray aesthetic
• Interactive chatbox powered by LangGraphJS
• Pre-built scenario playbooks for common security workflows
• Real-time query processing with the MCP server

Quick Start:

cd frontend
npm install
npm run dev

Then open http://localhost:5173 in your browser.

Prerequisites:

• Node.js 18+ installed
• MCP server running: mitre-mcp --http --port 8000

For more details, see the frontend/README.md documentation.

Documentation

We provide three comprehensive guides tailored to different use cases:

1. Beginner's Guide

Beginner-Playbook.md - For those new to MITRE ATT&CK or cybersecurity

Ideal for:

• Non-technical users
• Security awareness training
• Basic threat intelligence
• General cybersecurity education

2. Advanced Playbook

Playbook.md - For security professionals using MCP clients

Ideal for:

• Security analysts
• Threat hunters
• Incident responders
• Security engineers

Includes 10 ready-to-use scenarios:

• Threat Intelligence
• Detection Engineering
• Threat Hunting
• Red Teaming
• Security Assessment
• Incident Response
• Security Operations
• Security Training
• Vendor Evaluation
• Risk Management

3. API Integration Guide

API-INTEGRATION.md - For developers building automation and custom integrations

Ideal for:

• Backend developers
• Automation engineers
• Data pipeline developers
• Custom tooling projects

Includes:

• Complete Python and Node.js client implementations
• Protocol requirements and examples
• Testing and debugging tools
• Common integration patterns

Configuration

Environment Variables

Set before starting mitre-mcp to customize behavior: