Mitre Attack MCP Server
AI-Native Access to the World's Leading Threat Intelligence Framework Features • Installation • Quick Start • Tools • Examples • Roadmap. Its 40 documented tools cover technique, software, techniques, groups. It runs locally over stdio via the published package.
People connecting this server to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.
VERIFIED ACTIVE
LAST COMMIT 2025-12-22 · ★ 5 · #592 OF 848 MAINTAINED OTHER · VERIFIED 2026-08-25
Python servers · how we verify → /methodology
01 · Install Mitre Attack MCP Server
Claude Code
claude mcp add imouiche-complete-mitre-attack-mcp-serve -- npx -y @imouiche/mitre-attack-mcp-serverClaude Desktop / Cursor / VS Code - add to config
{
"mcpServers": {
"imouiche-complete-mitre-attack-mcp-serve": {
"command": "npx",
"args": [
"-y",
"@imouiche/mitre-attack-mcp-server"
]
}
}
}Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.
Using another client? Same JSON, different key
Claude Desktop · mcpServers
Cursor · mcpServers
VS Code · servers
Windsurf · mcpServers
Zed · context_servers
Cline · mcpServers
Roo Code · mcpServers
Continue · mcpServers
LibreChat · mcpServers
Gemini CLI · mcpServers
Codex CLI · mcp_servers
Full setup guides: every client.
02 · Evidence
Security posture
What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.
runs as local process (stdio) - runs on your machine with your user's permissions
license no standard license detected - usage rights unclear; check the repo before commercial use
npm package @imouiche/mitre-attack-mcp-server - published under the repo owner's npm scope (@imouiche)
registry namespace io.github.imouiche is GitHub-verified and matches the repo owner
03 · What Mitre Attack MCP Server can do
Prose above is summarized from the project's README and registry record - no invented capabilities.
What you can build
With this server connected, an agent can generate an ATT&CK Navigator layer (JSON output), get a technique by ATT&CK ID (e.g., T1055), search techniques by name or description, and retrieve all techniques.
Capability map
Tools grouped from the project's README - what Mitre Attack MCP Server lets an agent do.
Technique
9 tools - e.g. Get a technique by ATT&CK ID (e.g., T1055); Subtechniques of a parent; Parent of a subtechnique
get_technique_by_id · get_subtechniques_of_technique · get_parent_technique_of_subtechnique · get_technique_tactics · get_groups_using_technique · get_software_using_technique…
Techniques
7 tools - e.g. Search techniques by name or description; Retrieve all techniques; Parent techniques only
search_techniques · get_all_techniques · get_all_parent_techniques · get_techniques_by_tactic · get_techniques_by_platform · get_revoked_techniques…
read & search
6 tools - e.g. Show download status, file paths, sizes, and ATT&CK release version; Return Navigator layer metadata template; Find group by name or alias
get_data_stats · get_layer_metadata · get_group_by_name · get_all_tactics · get_all_datasources · get_all_assets
Software
6 tools - e.g. Get all software; Search software; Lookup software by alias
get_software · search_software · get_software_by_alias · get_software_used_by_group · get_software_used_by_campaign · get_campaigns_using_software
Groups
5 tools - e.g. Search groups; All ATT&CK groups; Lookup groups by alias
search_groups · get_all_groups · get_groups_by_alias · get_groups_using_software · get_groups_attributing_to_campaign
Campaigns
3 tools - e.g. Get all campaigns; Lookup campaigns by alias; Campaign attribution
get_all_campaigns · get_campaigns_by_alias · get_campaigns_attributed_to_group
Generate
1 tool - e.g. Generate an ATT&CK Navigator layer (JSON output)
generate_layer
Subtechniques
1 tool - e.g. All subtechniques
get_all_subtechniques
04 · Who maintains Mitre Attack MCP Server
mitre-attack-mcp-server is maintained by imouiche. It's the only MCP server we track from this author; the repo dates to Dec 2025.
05 · Facts
- category
- other - ranked #592 of 848 actively-maintained other servers as of 2026-08-25.
- registry
- io.github.imouiche/mitre-attack-mcp-server (active, first published 2025-12-13)
- packages
- npm:@imouiche/mitre-attack-mcp-server
06 · Mitre Attack MCP Server FAQ
Is Mitre Attack MCP Server still maintained?
Yes - as of 2026-08-25, its last commit was 2025-12-22. We re-verify nightly.
What can Mitre Attack MCP Server do?
With this server connected, an agent can generate an ATT&CK Navigator layer (JSON output), get a technique by ATT&CK ID (e.g., T1055), search techniques by name or description, and retrieve all techniques.
How do I install Mitre Attack MCP Server?
Run `npx -y @imouiche/mitre-attack-mcp-server`. You can also paste the ready-made client config above.
Does Mitre Attack MCP Server run locally?
Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.
07 · Alternatives to Mitre Attack MCP Server
Alternatives to Mitre Attack MCP Server
Maintained other servers if Mitre Attack MCP Server isn't the fit.
- Heyputer MCP Server Puter MCP enables AI tools to interact with Puter: manage files, websites, workers, and more ★ 43,204 · 2026-08-24
- Server Commands An MCP server to run arbitrary commands ★ 38,704 · 2026-08-05
- Zotero MCP (54yyyu) Search, read, annotate, and add to your Zotero research library, local or web. ★ 4,780 · 2026-08-25
- Firebase MCP Gives AI development tools Firebase-specific capabilities and expertise. ★ 4,460 · 2026-08-25
- Microsoft Fabric MCP Server MCP tools for interacting with Microsoft Fabric ★ 3,598 · 2026-08-21
- Ship Swift 40+ production-ready SwiftUI recipes for building full-stack iOS apps via MCP. ★ 2,968 · 2026-08-09
More MCP servers to compare · Cardano MCP · Inflow · IONOS CLOUD MCP Server · Scb MCP · Termada
More Python MCP servers · Memograph · InsideDCPulse World Model · Persome · Ip2location Io · Weather MCP Server · see all