Mitre Attck

What Mitre Attck does

Mitre Attck exposes MITRE ATT&CK content to MCP-compatible AI clients. Its data comes from MITRE's official CTI repository in STIX 2.1 format and covers three loaded domains: enterprise, mobile, and ICS. The integration is independent and unofficial.

The pack is useful for retrieving a record when an agent already has an ATT&CK identifier, or for finding records through text search. Example identifiers include T1190 for a technique, T1059.001 for a sub-technique, G0007 for a threat group, and S0002 for software.

How it works

The hosted MCP endpoint is available at https://gateway.pipeworx.io/mitre-attck/mcp. A client can connect to that URL directly, or launch the npm package @pipeworx/mcp-mitre-attck with npx; the package forwards requests to the same gateway. Both approaches need network connectivity and have no offline mode.

The gateway caches the loaded ATT&CK data for one hour. Pack endpoints also expose shared Pipeworx meta-tools alongside the pack's own tools. The local bridge lists only the pack tools by default; setting PIPEWORX_META_TOOLS=1 adds the gateway-wide tools, including ask_pipeworx. The full gateway is also available at https://gateway.pipeworx.io/mcp.

Direct HTTP calls are supported through the gateway's tools API. For example, a technique lookup can be sent as a JSON POST request to /v1/tools/technique.

Setup and configuration

A hosted connection can be added to an MCP client with this configuration:

{
  "mcpServers": {
    "mitre-attck": {
      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"
    }
  }
}

For a local stdio connection, use:

{
  "mcpServers": {
    "mitre-attck": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-mitre-attck"]
    }
  }
}

Anonymous use is capped at 50 calls per day. A free Pipeworx account raises the limit to 200 calls per day; provide its key as PIPEWORX_API_KEY in the MCP server's environment. Set NODE_USE_ENV_PROXY=1 when using a Node release that supports built-in proxy handling and the runtime must honor HTTPS_PROXY.

Tools and capabilities

The pack provides these operations:

• technique(id) retrieves a technique by ATT&CK ID.
• tactic(id_or_short_name) retrieves a tactic record.
• group(id) retrieves a threat group.
• software(id) retrieves software or malware.
• mitigation(id) retrieves a mitigation.
• search(query, type?) performs substring searches across the loaded bundle.
• domains() lists the loaded enterprise, mobile, and ICS bundles.

The gateway's ask_pipeworx tool can accept a plain-language question and select a tool and arguments automatically. HTTP callers can inspect a tool with GET /v1/tools/{name}.

Limitations and notes

This integration depends on the remote Pipeworx gateway and MITRE bundle availability. It is not an offline database. The scoped endpoint includes shared gateway meta-tools, so an MCP client's reported tool count can exceed the pack's seven ATT&CK-specific operations. API usage is metered when a key is supplied, and the integration is not affiliated with MITRE.