Mitre Attack MCP Server

What mitre-attack-mcp-server does

mitre-attack-mcp-server gives MCP-compatible AI clients structured access to the MITRE ATT&CK knowledge base. Its data comes from official STIX content and spans the Enterprise, Mobile, and ICS domains. Agents can inspect ATT&CK objects and traverse relationships among techniques, threat groups, software, campaigns, mitigations, tactics, data sources, data components, and ICS assets.

The server also creates ATT&CK Navigator layers as JSON. This supports workflows such as mapping a group’s techniques, reviewing platform coverage, and preparing a visual representation of selected ATT&CK content.

How it works

On its first run, the server downloads the ATT&CK dataset, approximately 59 MB, and stores it under ~/.mitre-mcp-server/data/. In-memory caching is used for subsequent queries. The get_data_stats tool exposes download status, local file information, sizes, and the ATT&CK release version.

The MCP interface returns structured results intended for language models and agentic workflows. Queries can identify objects directly, search by name or description, filter by tactic or platform, and follow relationships such as groups using software or techniques mitigated by a mitigation.

Setup and configuration

The server can be installed from PyPI with:

pip install mitre-mcp-server

Python users can also use uv pip install mitre-mcp-server. For the npm distribution, install the package globally:

npm install -g @imouiche/mitre-attack-mcp-server

For a one-off launch, use:

npx @imouiche/mitre-attack-mcp-server

Claude Desktop can launch the server through this stdio configuration:

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "@imouiche/mitre-attack-mcp-server"]
    }
  }
}

After adding the entry, restart Claude Desktop. The project also supports local checkout and installation with either npm install or uv sync.

Tools and capabilities

The tool set contains more than 65 operations, including:

• Retrieve, search, and filter techniques by ATT&CK ID, name, description, tactic, platform, parent, subtechnique, or revocation status.
• Find groups by name or alias, list groups, and identify groups associated with techniques, software, or campaigns.
• Search software and aliases, then connect software to groups, campaigns, and techniques.
• List campaigns and examine campaign aliases, technique use, software use, and group attribution.
• List mitigations and connect them to techniques in either direction.
• Retrieve tactics, data sources, data components, ICS assets, and assets targeted by techniques.
• Generate ATT&CK Navigator layers and retrieve layer metadata.
• Inspect downloaded data and local cache details with get_data_stats.

Limitations and notes

The initial data download requires local storage and network access, after which the dataset is cached for the server’s use. The cache location is ~/.mitre-mcp-server/data/. Results reflect the ATT&CK data release available to the server rather than a separately configured external API. Navigator output is generated as JSON layers for use with ATT&CK Navigator.