🎯 Overview

The MITRE ATT&CK MCP Server transforms the world's leading adversary knowledge base into an AI-native interface. Built for the Model Context Protocol, it enables LLMs and agentic systems to:

• 🔍 Query 200+ techniques, 140+ groups, 700+ software entries
• 🧠 Reason over complex threat relationships and TTPs
• 📊 Visualize coverage gaps with ATT&CK Navigator layers
• ⚡ Scale threat intelligence workflows with structured tools

Perfect for: Security teams, threat hunters, detection engineers, AI researchers, and anyone building intelligent security systems.

What is this?

mitre-attack-mcp-server is a self-contained MCP server that provides machine-callable access to the MITRE ATT&CK framework using official STIX data with LLMs friendly structured outputs.

It enables:

• 🤖 LLMs to reason about ATT&CK techniques, groups, software, and mitigations
• 🧠 Agentic workflows to generate threat explanations and coverage maps
• 🔍 Security teams to query ATT&CK relationships programmatically
• 📊 Visualization via ATT&CK Navigator layers

No scraping.
No fragile APIs.
Just official MITRE data, structured and reliable.

📑 Table of Contents

• Overview
• Key Features
• Installation
• Quick Start
• MCP Registry
• Available Tools
• Example Queries
• ATT&CK Navigator
• Technical Details
• Roadmap & Vision
• Contributing
• License
• About the Author
• Acknowledgments

✨ Key Features

• ✅ 65+ MCP tools across ATT&CK domains (Enterprise, Mobile, ICS)
• ✅ Automatic STIX download & caching on first run
• ✅ Native ATT&CK Navigator layer generation
• ✅ Designed for LLMs & MCP-compatible clients
• ✅ In-memory caching for instant query responses
• ✅ Type-safe with Pydantic models
• ✅ Clean, production-ready, self-contained server
• ✅ Comprehensive test coverage

📦 Installation

Via PyPI (recommended) - Python Users

pip install mitre-mcp-server

npm

npm install -g @imouiche/mitre-attack-mcp-server

npx (no installation required)

npx @imouiche/mitre-attack-mcp-server

Via uv (Modern Python)

uv pip install mitre-mcp-server

Local Development

git clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git
cd complete-mitre-attack-mcp-server
npm install

Using uv (Python package manager)

git clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git
cd complete-mitre-attack-mcp-server
uv sync

⚡ Quick Start

1. Install

pip install mitre-mcp-server

2. Configure Claude Desktop

Add to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "@imouiche/mitre-attack-mcp-server"]
    }
  }
}

3. Restart Claude Desktop

Quit Claude Desktop completely (Cmd+Q on macOS) and reopen it.

4. Start Querying!

Ask Claude:

"What techniques does APT29 use for initial access?"
"Generate an ATT&CK Navigator layer for ransomware groups"
"Show me all Windows persistence techniques"

Data downloads automatically on first run (~59MB, cached at ~/.mitre-mcp-server/data/).

📦 MCP Registry

This server is officially registered in the Model Context Protocol (MCP) Registry.

Registry ID: io.github.imouiche/mitre-attack-mcp-server

View in Official Registry: https://registry.modelcontextprotocol.io/?q=mitre-attack-mcp-server

Installation Options

Option 1: Direct NPM

npm install -g @imouiche/mitre-attack-mcp-server

Option 2: NPX (no installation)

npx @imouiche/mitre-attack-mcp-server

Option 3: Discover via Registry

1. Visit MCP Registry
2. Search for "mitre-attack"
3. Click the server card for installation instructions

🛠️ Available Tools

The server exposes 50+ MCP tools covering all major MITRE ATT&CK entities and relationships.

📊 Infrastructure & Metadata

🎯 Techniques

🧑‍💻 Groups (Threat Actors)

🧪 Software (Malware & Tools)

📌 Campaigns

🛡️ Mitigations

🧭 Tactics, Data Sources & ICS

💡 Example Queries

Threat Intelligence

"What techniques does APT29 use for initial access?"
"Which groups target financial institutions?"
"Show me all ransomware-related software"
"What are the aliases for the Lazarus Group?"

Detection Engineering

"What data sources detect credential dumping?"
"Generate a coverage map for EDR capabilities"
"List all techniques for Windows privilege escalation"
"What can detect T1055 (Process Injection)?"

Threat Hunting

"What techniques use PowerShell?"
"Show me lateral movement techniques for Linux"
"Which groups use Cobalt Strike?"
"What persistence techniques target macOS?"

Mitigation & Defense

"What mitigations exist for phishing attacks?"
"Show me all mitigations for privilege escalation"
"What techniques does MFA mitigate?"

Compliance & Gap Analysis

"Generate a layer for all techniques our EDR covers"
"Compare APT29 TTPs against our detection capabilities"
"Show unmitigated techniques in our environment"

📊 ATT&CK Navigator Visualization

The generate_layer tool produces ATT&CK Navigator–compatible JSON.

Usage:

1. Ask Claude to generate a layer:

   "Generate an ATT&CK Navigator layer for all techniques used by APT29"

2. Save the JSON output to a file (e.g., apt29_layer.json)

3. Upload to ATT&CK Navigator

4. Visualize technique coverage, threat actor usage, or mitigation mapping

Real-World Example Using LangGraph