{
  "markdown": "<div align=\"center\">\n\n# 🛡️ MITRE ATT&CK MCP Server\n\n**AI-Native Access to the World's Leading Threat Intelligence Framework**\n\n[![npm](https://img.shields.io/npm/v/@imouiche/mitre-attack-mcp-server.svg)](https://www.npmjs.com/package/@imouiche/mitre-attack-mcp-server)\n[![npm downloads](https://img.shields.io/npm/dm/@imouiche/mitre-attack-mcp-server.svg)](https://www.npmjs.com/package/@imouiche/mitre-attack-mcp-server)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![MCP Registry](https://img.shields.io/badge/MCP-Registered-success)](https://registry.modelcontextprotocol.io)\n[![GitHub release](https://img.shields.io/github/v/release/imouiche/complete-mitre-attack-mcp-server)](https://github.com/imouiche/complete-mitre-attack-mcp-server/releases)\n\n[Features](#-key-features) • [Installation](#-installation) • [Quick Start](#-quick-start) • [Tools](#-available-tools) • [Examples](#-example-queries) • [Roadmap](#-roadmap--vision)\n\n</div>\n\n---\n\n## 🎯 Overview\n\nThe **MITRE ATT&CK MCP Server** transforms the world's leading adversary knowledge base into an **AI-native interface**. Built for the **Model Context Protocol**, it enables LLMs and agentic systems to:\n\n- 🔍 **Query** 200+ techniques, 140+ groups, 700+ software entries\n- 🧠 **Reason** over complex threat relationships and TTPs  \n- 📊 **Visualize** coverage gaps with ATT&CK Navigator layers\n- ⚡ **Scale** threat intelligence workflows with structured tools\n\n**Perfect for**: Security teams, threat hunters, detection engineers, AI researchers, and anyone building intelligent security systems.\n\n### What is this?\n\n`mitre-attack-mcp-server` is a **self-contained MCP server** that provides **machine-callable access** to the MITRE ATT&CK framework using official STIX data with **LLMs** friendly **structured outputs**.\n\nIt enables:\n\n- 🤖 **LLMs** to reason about ATT&CK techniques, groups, software, and mitigations\n- 🧠 **Agentic workflows** to generate threat explanations and coverage maps\n- 🔍 **Security teams** to query ATT&CK relationships programmatically\n- 📊 **Visualization** via ATT&CK Navigator layers\n\nNo scraping.  \nNo fragile APIs.  \nJust **official MITRE data**, structured and reliable.\n\n---\n\n## 📑 Table of Contents\n\n- [Overview](#-overview)\n- [Key Features](#-key-features)\n- [Installation](#-installation)\n- [Quick Start](#-quick-start)\n- [MCP Registry](#-mcp-registry)\n- [Available Tools](#-available-tools)\n- [Example Queries](#-example-queries)\n- [ATT&CK Navigator](#-attck-navigator-visualization)\n- [Technical Details](#-technical-details)\n- [Roadmap & Vision](#-roadmap--vision)\n- [Contributing](#-contributing)\n- [License](#-license)\n- [About the Author](#-about-the-author)\n- [Acknowledgments](#-acknowledgments)\n\n---\n\n## ✨ Key Features\n\n- ✅ **65+ MCP tools** across ATT&CK domains (Enterprise, Mobile, ICS)\n- ✅ Automatic **STIX download & caching** on first run\n- ✅ Native **ATT&CK Navigator layer generation**\n- ✅ Designed for **LLMs & MCP-compatible clients**\n- ✅ **In-memory caching** for instant query responses\n- ✅ **Type-safe** with Pydantic models\n- ✅ Clean, production-ready, self-contained server\n- ✅ Comprehensive test coverage\n\n---\n\n## 📦 Installation\n\n### Via PyPI  (recommended) - Python Users\n\n```bash\npip install mitre-mcp-server\n```\n\n### npm\n\n```bash\nnpm install -g @imouiche/mitre-attack-mcp-server\n```\n\n### npx (no installation required)\n\n```bash\nnpx @imouiche/mitre-attack-mcp-server\n```\n\n\n### Via uv (Modern Python)\n```bash\nuv pip install mitre-mcp-server\n```\n\n### Local Development\n\n```bash\ngit clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git\ncd complete-mitre-attack-mcp-server\nnpm install\n```\n\n### Using uv (Python package manager)\n\n```bash\ngit clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git\ncd complete-mitre-attack-mcp-server\nuv sync\n```\n\n---\n\n## ⚡ Quick Start\n\n### 1. Install\n\n```bash\npip install mitre-mcp-server\n```\n\n### 2. Configure Claude Desktop\n\nAdd to your `claude_desktop_config.json`:\n\n**macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`  \n**Windows**: `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"mitre-attack\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@imouiche/mitre-attack-mcp-server\"]\n    }\n  }\n}\n```\n\n### 3. Restart Claude Desktop\n\nQuit Claude Desktop completely (Cmd+Q on macOS) and reopen it.\n\n### 4. Start Querying!\n\nAsk Claude:\n> \"What techniques does APT29 use for initial access?\"  \n> \"Generate an ATT&CK Navigator layer for ransomware groups\"  \n> \"Show me all Windows persistence techniques\"\n\n**Data downloads automatically on first run** (~59MB, cached at `~/.mitre-mcp-server/data/`).\n\n---\n\n## 📦 MCP Registry\n\nThis server is officially registered in the **Model Context Protocol (MCP) Registry**.\n\n**Registry ID**: `io.github.imouiche/mitre-attack-mcp-server`\n\n**View in Official Registry**: [https://registry.modelcontextprotocol.io/?q=mitre-attack-mcp-server](https://registry.modelcontextprotocol.io/?q=mitre-attack-mcp-server)\n\n### Installation Options\n\n**Option 1: Direct NPM**\n```bash\nnpm install -g @imouiche/mitre-attack-mcp-server\n```\n\n**Option 2: NPX (no installation)**\n```bash\nnpx @imouiche/mitre-attack-mcp-server\n```\n\n**Option 3: Discover via Registry**\n1. Visit [MCP Registry](https://registry.modelcontextprotocol.io)\n2. Search for \"mitre-attack\"\n3. Click the server card for installation instructions\n\n---\n\n## 🛠️ Available Tools\n\nThe server exposes **50+ MCP tools** covering all major MITRE ATT&CK entities and relationships.\n\n---\n\n### 📊 Infrastructure & Metadata\n\n| Tool | Description |\n|---|---|\n| `get_data_stats` | Show download status, file paths, sizes, and ATT&CK release version |\n| `generate_layer` | Generate an ATT&CK Navigator layer (JSON output) |\n| `get_layer_metadata` | Return Navigator layer metadata template |\n\n---\n\n### 🎯 Techniques\n\n| Tool | Description |\n|---|---|\n| `get_technique_by_id` | Get a technique by ATT&CK ID (e.g., T1055) |\n| `search_techniques` | Search techniques by name or description |\n| `get_all_techniques` | Retrieve all techniques |\n| `get_all_parent_techniques` | Parent techniques only |\n| `get_all_subtechniques` | All subtechniques |\n| `get_subtechniques_of_technique` | Subtechniques of a parent |\n| `get_parent_technique_of_subtechnique` | Parent of a subtechnique |\n| `get_technique_tactics` | Tactics associated with a technique |\n| `get_techniques_by_tactic` | Techniques under a tactic |\n| `get_techniques_by_platform` | Techniques for a platform |\n| `get_revoked_techniques` | Revoked techniques |\n\n---\n\n### 🧑‍💻 Groups (Threat Actors)\n\n| Tool | Description |\n|---|---|\n| `get_group_by_name` | Find group by name or alias |\n| `search_groups` | Search groups |\n| `get_all_groups` | All ATT&CK groups |\n| `get_groups_by_alias` | Lookup groups by alias |\n| `get_groups_using_technique` | Groups using a technique |\n| `get_groups_using_software` | Groups using software |\n| `get_groups_attributing_to_campaign` | Groups attributed to a campaign |\n\n---\n\n### 🧪 Software (Malware & Tools)\n\n| Tool | Description |\n|---|---|\n| `get_software` | Get all software |\n| `search_software` | Search software |\n| `get_software_by_alias` | Lookup software by alias |\n| `get_software_used_by_group` | Software used by a group |\n| `get_software_used_by_campaign` | Software used in campaigns |\n| `get_software_using_technique` | Software using a technique |\n\n---\n\n### 📌 Campaigns\n\n| Tool | Description |\n|---|---|\n| `get_all_campaigns` | Get all campaigns |\n| `get_campaigns_by_alias` | Lookup campaigns by alias |\n| `get_campaigns_using_technique` | Campaigns using a technique |\n| `get_campaigns_using_software` | Campaigns using software |\n| `get_campaigns_attributed_to_group` | Campaign attribution |\n\n---\n\n### 🛡️ Mitigations\n\n| Tool | Description |\n|---|---|\n| `get_all_mitigations` | Get all mitigations |\n| `get_mitigations_mitigating_technique` | Mitigations for a technique |\n| `get_techniques_mitigated_by_mitigation` | Techniques mitigated by a mitigation |\n\n---\n\n### 🧭 Tactics, Data Sources & ICS\n\n| Tool | Description |\n|---|---|\n| `get_all_tactics` | Get all tactics |\n| `get_all_datasources` | Get all data sources |\n| `get_all_datacomponents` | Get all data components |\n| `get_datacomponents_detecting_technique` | Data components detecting a technique |\n| `get_all_assets` | Get ICS assets |\n| `get_assets_targeted_by_technique` | Assets targeted by a technique |\n\n---\n\n## 💡 Example Queries\n\n### Threat Intelligence\n```\n\"What techniques does APT29 use for initial access?\"\n\"Which groups target financial institutions?\"\n\"Show me all ransomware-related software\"\n\"What are the aliases for the Lazarus Group?\"\n```\n\n### Detection Engineering\n```\n\"What data sources detect credential dumping?\"\n\"Generate a coverage map for EDR capabilities\"\n\"List all techniques for Windows privilege escalation\"\n\"What can detect T1055 (Process Injection)?\"\n```\n\n### Threat Hunting\n```\n\"What techniques use PowerShell?\"\n\"Show me lateral movement techniques for Linux\"\n\"Which groups use Cobalt Strike?\"\n\"What persistence techniques target macOS?\"\n```\n\n### Mitigation & Defense\n```\n\"What mitigations exist for phishing attacks?\"\n\"Show me all mitigations for privilege escalation\"\n\"What techniques does MFA mitigate?\"\n```\n\n### Compliance & Gap Analysis\n```\n\"Generate a layer for all techniques our EDR covers\"\n\"Compare APT29 TTPs against our detection capabilities\"\n\"Show unmitigated techniques in our environment\"\n```\n\n---\n\n## 📊 ATT&CK Navigator Visualization\n\nThe `generate_layer` tool produces **ATT&CK Navigator–compatible JSON**.\n\n### Usage:\n\n1. Ask Claude to generate a layer:\n   > \"Generate an ATT&CK Navigator layer for all techniques used by APT29\"\n\n2. Save the JSON output to a file (e.g., `apt29_layer.json`)\n\n3. Upload to [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)\n\n4. Visualize technique coverage, threat actor usage, or mitigation mapping\n\n### Real-World Example Using LangGraph\n\n- **Threat Investigation:**  \n  [Read my Medium blog demonstrating how a multi-agent LangGraph system leverages these tools to perform a real-world threat investigation.](https://medium.com/@nsangouinoussa515/from-mitre-att-ck-to-agentic-threat-investigation-58336c22f482)\n\n- **Live Demo:**  \n  [Explore the interactive Gradio 6.2 demo on Hugging Face Spaces.](https://huggingface.co/spaces/Inoussa-guru/mitre-agentic-threat-investigation)\n\n### Example Layer Use Cases:\n\n- **Red Team Coverage**: Map all techniques used in an exercise\n- **Detection Gaps**: Highlight unmonitored techniques\n- **Threat Actor Profile**: Visualize group TTPs\n- **Mitigation Coverage**: Show what's protected vs. exposed\n\n---\n\n## 🔧 Technical Details\n\n### Architecture\n\n- **Language**: Python 3.12+\n- **Framework**: FastMCP for Model Context Protocol\n- **Data Library**: Official `mitreattack-python` (v5.3.0+)\n- **Async/Await**: Optimal performance for concurrent queries\n- **Type Safety**: Full Pydantic models for all data structures\n- **Testing**: Comprehensive pytest coverage\n\n### Data\n\n- **Enterprise ATT&CK**: v18.1+ (~50.9MB)\n- **Mobile ATT&CK**: v18.1+ (~4.9MB)\n- **ICS ATT&CK**: v18.1+ (~3.5MB)\n- **Total**: ~59MB cached locally\n- **Storage**: `~/.mitre-mcp-server/data/v{version}/`\n- **Update**: Auto-downloads on install, uses cached data on subsequent runs\n\n### Performance\n\n- **In-memory caching**: All domains loaded at startup\n- **Query speed**: Sub-second for most operations\n- **Graph traversal**: Efficient relationship queries\n- **Concurrent**: Handles multiple simultaneous requests\n\n### Requirements\n\n- **Python**: 3.12 or higher\n- **Node.js**: 16+ (for NPM installation)\n- **Disk Space**: ~150MB (includes dependencies + data)\n- **Memory**: ~200MB RAM when running\n\n---\n\n## 🚀 Roadmap & Vision\n\nThis project is the **first component** of a larger vision to build **comprehensive agentic security automation** by integrating multiple security knowledge bases and frameworks.\n\n### Current Status\n- ✅ **MITRE ATT&CK** - Threat intelligence & adversary TTPs (v18.1)\n\n### Planned Integrations\n- 🔜 **CVE/NVD** - Vulnerability intelligence and exploit mapping\n- 🔜 **MITRE D3FEND** - Defensive countermeasure knowledge graph\n- 🔜 **Sigma Rules** - Detection rule translation and management\n- 🔜 **CAPEC** - Common Attack Pattern Enumeration\n- 🔜 **CWE** - Software weakness enumeration\n- 🔜 **Agentic Pentesting** - Multi-agent autonomous security testing\n\n### Ultimate Goal\n\nEnable **AI agents to autonomously**:\n- 🎯 Map attack surfaces and identify vulnerabilities\n- 🛡️ Recommend defensive countermeasures\n- 🔍 Generate detection rules and validate coverage\n- 🤖 Orchestrate multi-stage security assessments\n- 📊 Reason about complete attack-defense lifecycles\n\n### Get Involved\n\n**We welcome contributions from:**\n- 🎓 **Students** working on thesis projects (cybersecurity, AI, agentic systems)\n- 🔬 **Researchers** in AI security, threat intelligence, or agent frameworks\n- 💻 **Developers** passionate about security automation\n- 🏢 **Organizations** interested in research partnerships or commercial applications\n\n**Areas of Interest:**\n- Integrating additional security frameworks (CVE, D3FEND, Sigma)\n- Building agentic workflows for pentesting and red teaming\n- Developing detection rule generation pipelines\n- Creating threat intelligence reasoning systems\n- Improving MCP tooling and documentation\n\n📬 **Interested?** Open an issue, start a discussion, or reach out directly!\n\n[Join the Discussion →](https://github.com/imouiche/complete-mitre-attack-mcp-server/discussions)\n\n---\n\n## 🤝 Contributing\n\nFound a bug? Have a feature request? Want to contribute to the roadmap?\n\n- 🐛 [Report Issues](https://github.com/imouiche/complete-mitre-attack-mcp-server/issues)\n- 💡 [Request Features](https://github.com/imouiche/complete-mitre-attack-mcp-server/issues/new)\n- 🔧 [Submit Pull Requests](https://github.com/imouiche/complete-mitre-attack-mcp-server/pulls)\n- 💬 [Start a Discussion](https://github.com/imouiche/complete-mitre-attack-mcp-server/discussions)\n\nAll contributions welcome!\n\n### Development Setup\n\n```bash\ngit clone https://github.com/imouiche/complete-mitre-attack-mcp-server.git\ncd complete-mitre-attack-mcp-server\nuv sync\n# uv run pytest (test/ folder not yet released)\nuv run python -m mitre_mcp_server.server\n```\n\n---\n\n## 📜 License\n\nApache License 2.0\n\nSee [LICENSE](LICENSE) for full details.\n\n---\n\n## 👨‍💻 About the Author\n\n**Inoussa Mouiche, Ph.D.**  \nAI/ML Researcher | Cybersecurity | Agentic AI Systems | Software Engineering\n\n🎓 **University of Windsor** - WASP Lab  \n🔬 **Research Focus**: Threat Intelligence Automation, Machine Learning, Multi-Agent Security Systems, LLM-Powered Security Operations\n\n📫 **Connect**\n- 🐙 GitHub: [@imouiche](https://github.com/imouiche)\n- 📧 Email: mouiche@uwindsor.ca\n- 💼 LinkedIn: [Inoussa Mouiche, Ph.D.](https://www.linkedin.com/in/inoussa-mouiche-ph-d-b5b5138b/)\n- 📚 Google Scholar: [Publications](https://scholar.google.com/citations?user=_d4cEVoAAAAJ&hl=en)\n\n🎓 **Award Nomination** \n- Gold Medal: [The Governor General's Academic Medal ](https://www.gg.ca/en/honours/governor-generals-awards/governor-generals-academic-medal)\n\n💼 **Open to opportunities** in:\n- AI/ML Engineering & Research\n- Cybersecurity & Threat Intelligence\n- Agentic AI Development\n- Security Automation & Orchestration\n- Academic & Industry Collaborations\n\n---\n\n## 🙏 Acknowledgments\n\n- Built on [MITRE ATT&CK®](https://attack.mitre.org/) - the industry standard for adversary tactics and techniques\n- Powered by [mitreattack-python](https://github.com/mitre-attack/mitreattack-python) - official MITRE library\n- Implements [Model Context Protocol](https://modelcontextprotocol.io) - Anthropic's standard for AI-tool integration\n- Inspired by the amazing MCP developer community including [R. Jasper](https://www.remyjaspers.com/blog/mitre_attack_mcp_server/), and more...\n\n**MITRE ATT&CK®** is a registered trademark of The MITRE Corporation.\n\n---\n\n<div align=\"center\">\n\n**⭐ Star this repo if you find it useful!**\n\n**Interested in collaborating on agentic engineering systems?** [Let's connect!](https://www.linkedin.com/in/inoussa-mouiche-ph-d-b5b5138b/)\n\nMade with ❤️ for the cybersecurity and AI communities\n\n[⬆ Back to Top](#-mitre-attck-mcp-server)\n\n</div>\n",
  "bytes": 16297,
  "sha": "ada08aadc5693aab637007ae873030dd0e12f7ee77dbe0bb1179b30bf42bb9de",
  "repo_slug": "imouiche/complete-mitre-attack-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_imouiche_mitre_attack_mcp_serv_134f3dd5/readme"
}