RELATED 01
Security Detections MCP
Search and map Sigma, Splunk, Elastic, KQL and other detection rules against MITRE ATT&CK
524GitHub stars
1.0k/wknpm downloads
57popularity score
MITRE ATT&CK MCP
Query MITRE ATT&CK data and build Navigator layers for detection coverage and gap analysis
By Michael Haag (individual) TypeScript Local · stdio Security
28 popularity score ★ 18 ↓ 35/wk
Connect your client
Local (npm)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add mitre-att-ck -- npx -y mitre-attack-mcpClaude Desktopclaude_desktop_config.json
{
"mcpServers": {
"mitre-att-ck": {
"command": "npx",
"args": [
"-y",
"mitre-attack-mcp"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"mitre-att-ck": {
"command": "npx",
"args": [
"-y",
"mitre-attack-mcp"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"mitre-att-ck": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mitre-attack-mcp"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.mitre-att-ck]
command = "npx"
args = ["-y", "mitre-attack-mcp"]Gemini CLITerminal
gemini mcp add --scope user mitre-att-ck npx -- -y mitre-attack-mcpLocal (from source)
Add in one click
Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.
Or add it by command or config
FirstTerminal
git clone https://github.com/MHaggis/mitre-attack-mcp.git
cd mitre-attack-mcp
npm install
npm run buildClaude CodeTerminal
claude mcp add mitre-att-ck -- node '<ABSOLUTE_PATH_TO_CLONE>/dist/index.js'Claude Desktopclaude_desktop_config.json
{
"mcpServers": {
"mitre-att-ck": {
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/dist/index.js"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"mitre-att-ck": {
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/dist/index.js"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"mitre-att-ck": {
"type": "stdio",
"command": "node",
"args": [
"<ABSOLUTE_PATH_TO_CLONE>/dist/index.js"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.mitre-att-ck]
command = "node"
args = ["<ABSOLUTE_PATH_TO_CLONE>/dist/index.js"]Gemini CLITerminal
gemini mcp add --scope user mitre-att-ck node -- '<ABSOLUTE_PATH_TO_CLONE>/dist/index.js'Settings 2
ATTACK_DOMAIN |
Optional: ATT&CK domain to index: enterprise-attack (default), mobile-attack or ics-attack. |
|---|---|
CUSTOM_ATTACK_PATH |
Optional: Path to a local STIX JSON bundle to load instead of downloading from MITRE. |
What it does
MITRE ATT&CK MCP is a local server by Michael Haag that loads the MITRE ATT&CK knowledge base into a SQLite index on your machine and answers questions about it: techniques and sub-techniques, tactics, threat groups, malware and tools, mitigations and data sources. On first start it downloads the STIX bundle for the chosen domain (enterprise, mobile or ICS) from MITRE's attack-stix-data repository on GitHub, and reuses the cached copy for seven days before fetching again.
Beyond lookups, it is built for detection engineers measuring coverage. You pass in the technique IDs your detection rules cover, and it reports coverage per tactic, lists the techniques you miss against a given threat group, compares several groups at once, and produces ATT&CK Navigator layer JSON (coverage, group, gap or custom-scored layers) that you paste into the Navigator web app. Layers are returned as text; the server does not write them to disk.
The published 1.0.1 release registers 29 tools in src/index.ts, seven more than the README's tables list: list_groups, rebuild_index, get_technique_ids_by_tactic, get_technique_ids_by_platform, quick_coverage_check, batch_coverage_check and get_common_groups. The author pairs it with security-detections-mcp, which supplies the technique IDs from Sigma, Splunk and Elastic rules.
What it needs
| Runtime | Node.js 18+ |
|---|
Node.js 18 or newer (npx). Internet access to raw.githubusercontent.com on first run and after the seven-day cache expires, unless CUSTOM_ATTACK_PATH points at a local STIX JSON file. It depends on better-sqlite3, a native module that npm must be able to install or build for your platform. No account or key.
Limits
Covers one ATT&CK domain per running instance, set by ATTACK_DOMAIN (enterprise-attack by default); run a second instance for mobile or ICS. Search and list tools return 50 or 100 results by default (search_techniques, search_groups, search_software: 50; list tools: 100), raised with limit. It does not read your detection rules itself: you supply the covered technique IDs. The README's ATT&CK v19 notes (Defense Evasion split into Stealth and Defense Impairment, auto-rebuild of older indexes) describe main-branch code that is not in the npm release 1.0.1.
Who it suits
Suits detection engineers and threat-intel analysts who want an assistant to look up ATT&CK entries, score their rule coverage against a framework or a named group, and get Navigator layers without hand-editing JSON. It runs locally, needs no sign-in and only reads public MITRE data, so it fits locked-down machines once the data is cached or supplied with CUSTOM_ATTACK_PATH. If you need the newest ATT&CK v19 tactic names, note that the npm release predates that change. Pick something else if you want it to pull coverage from a SIEM directly; pair it with security-detections-mcp for rule data.
Tools 29 of 30
get_technique- Fetch one technique or sub-technique by ID, such as T1059.001
search_techniques- Full-text search over technique names and descriptions
list_techniques- Page through all techniques
list_techniques_by_tactic- Techniques belonging to one tactic
list_techniques_by_platform- Techniques that apply to a platform such as Windows or Linux
get_tactic- Details of one tactic
list_tactics- All tactics in matrix order
get_group- Details of a threat group by ID
search_groups- Find threat groups by name or alias
list_groups- Page through all threat groups
get_group_techniques- Technique IDs attributed to a group
get_software- Details of a malware family or tool
search_software- Find malware and tools by name
get_mitigations- Mitigations mapped to a technique
get_data_sources- Data sources useful for detecting a technique
generate_layer- Build a Navigator layer from techniques with optional scores
generate_coverage_layer- Build a layer marking covered and uncovered techniques
generate_group_layer- Build a layer highlighting one group's techniques
generate_gap_layer- Build a layer comparing your coverage to a target set
analyze_coverage- Coverage statistics per tactic plus a list of gaps
find_group_gaps- Techniques a group uses that your coverage misses
get_all_technique_ids- Every valid technique ID in the loaded domain
get_stats- Counts of techniques, groups, software and other objects
rebuild_index- Download the ATT&CK data again and re-index it
get_technique_ids_by_tactic- Only the technique IDs for a tactic, without full records
get_technique_ids_by_platform- Only the technique IDs for a platform, without full records
quick_coverage_check- Short coverage summary against one group
batch_coverage_check- Short coverage summaries against several groups at once
get_common_groups- The 20 groups with the most mapped techniques