{ "markdown": "\n# mitre-mcp: MITRE ATT&CK MCP Server\n\n[![MCP Registry](https://img.shields.io/badge/MCP-Registry-blue.svg?logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTEyIDJMMiA3TDEyIDEyTDIyIDdMMTIgMloiIHN0cm9rZT0id2hpdGUiIHN0cm9rZS13aWR0aD0iMiIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIi8+CjxwYXRoIGQ9Ik0yIDEyTDEyIDE3TDIyIDEyIiBzdHJva2U9IndoaXRlIiBzdHJva2Utd2lkdGg9IjIiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIvPgo8cGF0aCBkPSJNMiAxN0wxMiAyMkwyMiAxNyIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPC9zdmc+Cg==)](https://registry.modelcontextprotocol.io)\n\"PyPI\n\n[![PyPI version](https://img.shields.io/pypi/v/mitre-mcp.svg?label=PyPI&logo=pypi)](https://pypi.org/project/mitre-mcp/)\n[![Python versions](https://img.shields.io/pypi/pyversions/mitre-mcp.svg?logo=python&logoColor=white)](https://pypi.org/project/mitre-mcp/)\n[![Test status](https://github.com/montimage/mitre-mcp/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/montimage/mitre-mcp/actions/workflows/test.yml)\n[![License](https://img.shields.io/github/license/montimage/mitre-mcp.svg)](LICENSE)\n[![Coverage](https://img.shields.io/badge/coverage-66%25-green.svg)](pytest.ini)\n[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)\n[![Pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit)](https://github.com/pre-commit/pre-commit)\n\nProduction-ready Model Context Protocol (MCP) server that exposes the [MITRE ATT&CK®](https://attack.mitre.org/) framework to LLMs, AI assistants, and automation workflows. Built with the official MCP Python SDK and mitreattack-python library for secure, high-performance access to adversary tactics, techniques, groups, software, and mitigations.\n\n**Available in the [MCP Registry](https://registry.modelcontextprotocol.io)** (search for `io.github.luongnv89/mitre-mcp`).\n\n## Highlights\n\n- **LLM-native experience** – Seamless integration with Claude, Windsurf, Cursor, and any MCP-compatible client\n- **Secure-by-default** – Validated inputs, TLS verification, disk-space checks, and structured error handling\n- **High performance** – O(1) technique lookups using pre-built indices (80-95% faster than scanning)\n- **Flexible deployment** – stdio for local clients or HTTP server for web-based integrations\n\n## Table of Contents\n\n- [Features](#features)\n- [Available MCP Tools](#available-mcp-tools)\n- [Quick Start](#quick-start)\n- [Web Frontend](#web-frontend)\n- [Documentation](#documentation)\n- [Configuration](#configuration)\n- [Performance](#performance)\n- [Programmatic API](#programmatic-api)\n- [Development](#development)\n- [Troubleshooting](#troubleshooting)\n- [FAQ](#faq)\n- [License](#license)\n\n## Features\n\n- **Comprehensive MITRE ATT&CK Coverage** - All techniques, tactics, groups, software, and mitigations\n- **Multi-Domain Support** - Enterprise, Mobile, and ICS ATT&CK domains\n- **Intelligent Caching** - Automatic caching with configurable expiry (default: 24 hours)\n- **Performance Optimized** - O(1) lookups using pre-built indices (80-95% faster)\n- **Dual Transport Modes** - stdio for local clients, HTTP for web integrations\n- **CORS-Enabled HTTP Server** - Async notifications and cross-origin request support\n- **Comprehensive Testing** - 114 tests with 66% code coverage\n- **Pre-commit Quality Checks** - Automated formatting, linting, type checking, and security scanning\n- **Input Validation** - Secure-by-default with validated inputs and sanitized responses\n- **Programmatic API** - Python and Node.js clients (see [API-INTEGRATION.md](API-INTEGRATION.md))\n\n## Available MCP Tools\n\n| Tool Name | Description |\n| ---------------------------------------- | ------------------------------------------------------------------------------- |\n| `get_techniques` | List all techniques with filtering options |\n| `get_technique_by_id` | Look up specific technique by ID (e.g., T1055) |\n| `get_techniques_by_tactic` | Get techniques for a specific tactic (e.g., persistence) |\n| `get_tactics` | List all tactical categories |\n| `get_groups` | List all threat actor groups |\n| `get_techniques_used_by_group` | Get techniques used by a specific group (e.g., APT29) |\n| `get_software` | List malware and tools with filtering |\n| `get_mitigations` | List all security mitigations |\n| `get_techniques_mitigated_by_mitigation` | Get techniques addressed by a specific mitigation |\n\n## Quick Start\n\n### Installation\n\n1. **Create and activate a virtual environment:**\n\n```bash\npython3 -m venv .venv\nsource .venv/bin/activate # On Windows: .venv\\Scripts\\activate.bat\n```\n\n2. **Install from PyPI:**\n\n```bash\npip install mitre-mcp\n```\n\n3. **Verify installation:**\n\n```bash\nmitre-mcp --help\n```\n\n### HTTP Mode (Recommended)\n\n**Start the server:**\n\n```bash\nmitre-mcp --http\n```\n\n**Expected output:**\n```\n2025-11-17 22:40:10,991 - mitre_mcp.mitre_mcp_server - INFO - Starting MITRE ATT&CK MCP Server (HTTP mode on localhost:8000)\n======================================================================\nMCP Client Configuration (Streamable HTTP Transport)\nServer URL: http://localhost:8000\nMCP Endpoint: http://localhost:8000/mcp\n\nAdd this to your MCP client configuration:\n{\n \"mcpServers\": {\n \"mitreattack\": {\n \"url\": \"http://localhost:8000/mcp\"\n }\n }\n}\n======================================================================\n```\n\n**Configure your MCP client:**\n\nAdd this JSON to your client's configuration file:\n\n```json\n{\n \"mcpServers\": {\n \"mitreattack\": {\n \"url\": \"http://localhost:8000/mcp\"\n }\n }\n}\n```\n\n**Configuration file locations:**\n- **macOS (Claude Desktop)**: `~/Library/Application Support/Claude/claude_desktop_config.json`\n- **Windows (Claude Desktop)**: `%APPDATA%\\Claude\\claude_desktop_config.json`\n- **Linux (Claude Desktop)**: `~/.config/Claude/claude_desktop_config.json`\n- **VSCode**: Configure in your MCP extension settings\n\n**Custom host and port:**\n\n```bash\nmitre-mcp --http --host 0.0.0.0 --port 8080\n```\n\nThen use `http://your-server-ip:8080/mcp` in your client configuration.\n\n**Why HTTP mode?**\n- Multiple clients can connect simultaneously\n- Better concurrency and async support\n- Easier debugging with HTTP tools\n- CORS support for web-based clients\n- No path configuration needed\n\n### stdio Mode (Alternative)\n\nFor local-only clients that require stdio transport:\n\n```bash\nmitre-mcp\n```\n\n**Client configuration:**\n\n```json\n{\n \"mcpServers\": {\n \"mitreattack\": {\n \"command\": \"/absolute/path/to/.venv/bin/python\",\n \"args\": [\"-m\", \"mitre_mcp.mitre_mcp_server\"]\n }\n }\n}\n```\n\n**Note:** Use absolute paths. HTTP mode is recommended for most use cases.\n\n### Force Data Download\n\nForce a fresh download of MITRE ATT&CK data:\n\n```bash\nmitre-mcp --http --force-download\n```\n\n### Example Screenshots\n\n**VSCode Configuration:**\n\n![Configure](screenshot-01.png)\n\n**Tool Invocation:**\n\n![Tool call](screenshot-02.png)\n\n**Results:**\n\n![Result](screenshot-03.png)\n\n## Web Frontend\n\nA modern React-based web interface is available in the `frontend/` directory for interactive exploration of MITRE ATT&CK through a chat interface.\n\n**Features:**\n- Clean, minimal design with black/white/gray aesthetic\n- Interactive chatbox powered by LangGraphJS\n- Pre-built scenario playbooks for common security workflows\n- Real-time query processing with the MCP server\n\n**Quick Start:**\n\n```bash\ncd frontend\nnpm install\nnpm run dev\n```\n\nThen open `http://localhost:5173` in your browser.\n\n**Prerequisites:**\n- Node.js 18+ installed\n- MCP server running: `mitre-mcp --http --port 8000`\n\n**For more details**, see the [frontend/README.md](frontend/README.md) documentation.\n\n## Documentation\n\nWe provide three comprehensive guides tailored to different use cases:\n\n### 1. Beginner's Guide\n\n**[Beginner-Playbook.md](Beginner-Playbook.md)** - For those new to MITRE ATT&CK or cybersecurity\n\n**Ideal for:**\n- Non-technical users\n- Security awareness training\n- Basic threat intelligence\n- General cybersecurity education\n\n### 2. Advanced Playbook\n\n**[Playbook.md](Playbook.md)** - For security professionals using MCP clients\n\n**Ideal for:**\n- Security analysts\n- Threat hunters\n- Incident responders\n- Security engineers\n\nIncludes 10 ready-to-use scenarios:\n- Threat Intelligence\n- Detection Engineering\n- Threat Hunting\n- Red Teaming\n- Security Assessment\n- Incident Response\n- Security Operations\n- Security Training\n- Vendor Evaluation\n- Risk Management\n\n### 3. API Integration Guide\n\n**[API-INTEGRATION.md](API-INTEGRATION.md)** - For developers building automation and custom integrations\n\n**Ideal for:**\n- Backend developers\n- Automation engineers\n- Data pipeline developers\n- Custom tooling projects\n\nIncludes:\n- Complete Python and Node.js client implementations\n- Protocol requirements and examples\n- Testing and debugging tools\n- Common integration patterns\n\n## Configuration\n\n### Environment Variables\n\nSet before starting `mitre-mcp` to customize behavior:\n\n| Variable | Default | Purpose |\n| ----------------------------------------------------------- | ------------------------------ | --------------------------------------------------------------------------------------------- |\n| `MITRE_ENTERPRISE_URL`, `MITRE_MOBILE_URL`, `MITRE_ICS_URL` | Official MITRE CTI GitHub URLs | Override ATT&CK bundle locations or point to internal mirror |\n| `MITRE_DATA_DIR` | `mitre_mcp/data` | Store cached bundles in custom directory |\n| `MITRE_DOWNLOAD_TIMEOUT` | `30` | HTTP timeout in seconds for bundle downloads |\n| `MITRE_CACHE_EXPIRY_DAYS` | `1` | Maximum age before cached data is refreshed |\n| `MITRE_REQUIRED_SPACE_MB` | `200` | Disk space threshold checked before downloading |\n| `MITRE_DEFAULT_PAGE_SIZE` / `MITRE_MAX_PAGE_SIZE` | `20` / `1000` | Default and maximum records returned by list tools |\n| `MITRE_MAX_DESC_LENGTH` | `500` | Trimmed description length in responses |\n| `MITRE_LOG_LEVEL` | `INFO` | Logging verbosity (DEBUG, INFO, WARNING, etc.) |\n| `MITRE_CORS_ORIGINS` | `*` | CORS allowed origins for HTTP mode (`*` = all, or comma-separated list of domains) |\n\n### Data Caching\n\nThe server automatically caches MITRE ATT&CK data to improve performance:\n\n1. On first run, downloads and stores data in `data/` folder\n2. On subsequent runs, uses cached data if less than 1 day old\n3. Automatically refreshes data older than 1 day\n4. Use `--force-download` to force fresh download\n\n## Performance\n\n| Scenario | Improvement | Notes |\n| --------------------------- | ----------------- | --------------------------------------------------------------------- |\n| Enterprise technique lookup | **80-95% faster** | Pre-built O(1) indices for groups, mitigations, and techniques |\n| ATT&CK data downloads | **20-40% faster** | HTTP connection pooling with TLS session reuse |\n| Warm cache startup | **<2s** | Cached bundles reused for instant LLM queries |\n\nBenchmarks: macOS 14 / Apple M3 Pro with Python 3.11. Use `MITRE_LOG_LEVEL=DEBUG` for timing logs.\n\n## Programmatic API\n\nFor automation, custom integrations, and batch processing, see **[API-INTEGRATION.md](API-INTEGRATION.md)**.\n\n**Quick example (Python):**\n\n```python\nfrom clients.python.mini_mcp_client import MitreMCPClient\n\nasync def main():\n client = MitreMCPClient(host=\"localhost\", port=8000)\n\n # Get all tactics\n tactics = await client.call_tool(\"get_tactics\", {\"domain\": \"enterprise-attack\"})\n\n # Get techniques for a group\n techniques = await client.call_tool(\n \"get_techniques_used_by_group\",\n {\"group_name\": \"APT29\", \"domain\": \"enterprise-attack\"}\n )\n```\n\n**Available clients:**\n- **Python**: `clients/python/mini-mcp-client.py` with full CLI\n- **Node.js**: `clients/nodejs/mini-mcp-client.js` with full CLI\n\nSee [API-INTEGRATION.md](API-INTEGRATION.md) for complete documentation.\n\n## Development\n\n### Clone and Install\n\n```bash\ngit clone https://github.com/montimage/mitre-mcp.git\ncd mitre-mcp\npython -m venv .venv\nsource .venv/bin/activate\npip install -e \".[dev]\"\n```\n\n### Install Pre-commit Hooks\n\n```bash\npre-commit install\n```\n\nThis sets up automatic code quality checks before each commit.\n\n### Run Tests\n\n```bash\npytest # Full test suite with coverage\npre-commit run --all-files # All quality checks\n```\n\n### Code Quality Tools\n\n**Formatting:**\n- **black** - Python code formatter\n- **isort** - Import organizer\n- **prettier** - YAML/JSON/Markdown formatter\n\n**Linting & Type Checking:**\n- **flake8** - Python linter\n- **mypy** - Static type checker\n- **pydocstyle** - Docstring checker\n\n**Security:**\n- **bandit** - Security vulnerability scanner\n- **File validators** - YAML, JSON, TOML, private key detection\n\n**Testing:**\n- **pytest** - 114 tests before commit\n- **Installation test** - Package verification\n- **Import verification** - Module importability\n- **CLI test** - Entry point validation\n\n## Troubleshooting\n\n**Download fails with \"Insufficient disk space\"**\n- Free at least 200 MB in the data directory or set `MITRE_DATA_DIR=/path/to/storage`\n\n**Data never updates**\n- Cached bundles refresh automatically after 1 day\n- Force refresh: `mitre-mcp --force-download` or delete `data/` folder\n\n**Tool calls return errors**\n- Ensure technique IDs follow `T####` or `T####.###` format\n- Keep names/tactics under 100 characters\n\n**MCP client cannot discover server**\n- Verify client configuration points to correct Python path\n- Test manually: run `mitre-mcp` and verify server starts\n- For HTTP mode: ensure `url` field is set correctly\n\n**Module not found: mcp.server.fastmcp**\n- Install MCP SDK: `pip install \"mcp[cli]\"` in your virtual environment\n\n## FAQ\n\n**Does mitre-mcp work offline?**\n- Yes. Once bundles are cached, the server works offline until cache expires.\n\n**Which Python versions are supported?**\n- Python 3.10 through 3.14 (see `pyproject.toml`).\n\n**How often is data refreshed?**\n- By default every 24 hours. Adjust `MITRE_CACHE_EXPIRY_DAYS` or use `--force-download`.\n\n**Is HTTP mode safe for production?**\n- HTTP mode serves on localhost:8000 by default. Use firewall or reverse proxy if exposing externally.\n\n## License\n\nMIT License - See [LICENSE](LICENSE) file for details.\n\n## About Montimage\n\n`mitre-mcp` is developed and maintained by [Montimage](https://www.montimage.eu), a cybersecurity company specializing in network monitoring, security analysis, and AI-driven threat detection solutions. We develop innovative tools that help organizations protect their digital assets and ensure network security.\n\nFor questions or support: [luong.nguyen@montimage.eu](mailto:luong.nguyen@montimage.com)\n", "bytes": 16708, "sha": "38a6b4043cb1fe869ea6cb009279997b2481208752d79605928c690a995dbd35", "repo_slug": "montimage/mitre-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_luongnv89_mitre_mcp_ce9e527f/readme" }