What is MITRE ATT&CK MCP Server?

The MITRE ATT&CK MCP Server provides AI-native, machine-callable access to the comprehensive MITRE ATT&CK threat intelligence framework, transforming it into structured tools for LLMs and agentic systems.

Who can benefit from using this tool?

This tool is perfect for security teams, threat hunters, detection engineers, and AI researchers who need programmatic, high-performance access to ATT&CK data for intelligent security systems and automated workflows.

What kind of ATT&CK data can I query?

You can query over 65 entities including techniques, tactics, groups (threat actors), software (malware/tools), mitigations, campaigns, and data sources across Enterprise, Mobile, and ICS domains.

Does it support visualization of ATT&CK data?

Yes, a key feature is the native generation of ATT&CK Navigator layers. This allows users to easily visualize technique coverage, threat actor TTPs, or mitigation mappings by uploading the JSON output.

MITRE ATT&CK

Name: MITRE ATT&CK
Author: imouiche

•

Provides AI-native access to the MITRE ATT&CK threat intelligence framework with over 80 tools for querying techniques, tactics, groups, software, and mitigations across Enterprise, Mobile, and ICS domains.

About

The MITRE ATT&CK MCP Server transforms the world's leading adversary knowledge base into an AI-native interface, built for the Model Context Protocol. It enables LLMs and agentic systems to query over 200 techniques, 140+ groups, and 700+ software entries, reason over complex threat relationships, visualize coverage gaps with ATT&CK Navigator layers, and scale threat intelligence workflows with structured tools. This self-contained server provides machine-callable access to the official MITRE ATT&CK framework using STIX data, offering LLM-friendly structured outputs for security teams, threat hunters, detection engineers, and AI researchers.

Key Features

Over 65 MCP tools for all major ATT&CK entities and relationships across domains
Automatic STIX data download and caching for up-to-date threat intelligence
Native generation of ATT&CK Navigator layers for visualization
Designed for AI-native interfaces, LLMs, and agentic systems
In-memory caching and type-safe data models for high performance
0 GitHub stars

Use Cases

Empowering security teams and threat hunters with programmatic access to ATT&CK data
Assisting detection engineers in mapping and visualizing coverage gaps
Enabling AI researchers and agentic systems to reason over threat relationships