mitre-mcp
Advanced tools
Production-ready Model Context Protocol (MCP) server that exposes the MITRE ATT&CK framework to LLMs, MCP clients, and automation workflows using the mitreattack-python library and the official MCP Python SDK.
Montimage is a cybersecurity company specializing in network monitoring, security analysis, and AI-driven threat detection solutions. We develop innovative tools that help organizations protect their digital assets and ensure the security of their networks. The mitre-mcp server is part of our suite of security tools designed to enhance threat intelligence capabilities.
The MITRE ATT&CK® framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language for describing cyber adversary behavior and helps security professionals understand attack methodologies, improve defensive capabilities, and assess organizational risk.
Key components of the framework include:
The mitre-mcp server bridges the gap between the MITRE ATT&CK knowledge base and AI-driven workflows by providing a Model Context Protocol (MCP) interface. This enables Large Language Models (LLMs) and other AI systems to directly query and utilize MITRE ATT&CK data for threat intelligence, security analysis, and defensive planning.
Key objectives include:
mitre-mcp is designed for seamless integration with Model Context Protocol (MCP) compatible clients (e.g., Claude, Windsurf, Cursor) for real-time MITRE ATT&CK framework lookups in LLM workflows.
| Tool Name | Description |
|---|---|
get_techniques | Get all techniques from the MITRE ATT&CK framework. Supports filtering by domain and includes options for subtechniques and handling revoked/deprecated items. |
get_tactics | Get all tactics from the MITRE ATT&CK framework. Returns tactical categories that techniques are organized into. |
get_groups | Get all threat groups from the MITRE ATT&CK framework. These are known threat actors and APT groups. |
get_software | Get all software from the MITRE ATT&CK framework. Can filter by software type (malware, tool) and domain. |
get_techniques_by_tactic | Get techniques associated with a specific tactic (e.g., 'defense-evasion', 'persistence'). |
get_techniques_used_by_group | Get techniques used by a specific threat group (e.g., 'APT29', 'Lazarus Group'). |
get_mitigations | Get all mitigations from the MITRE ATT&CK framework. These are security measures to counter techniques. |
get_techniques_mitigated_by_mitigation | Get techniques that can be mitigated by a specific mitigation strategy. |
get_technique_by_id | Look up a specific technique by its MITRE ATT&CK ID (e.g., 'T1055' for Process Injection). |
Install from PyPI and bring the MCP server online in minutes:
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate.bat
pip install mitre-mcp
After installing mitre-mcp, you should be able to execute the following command:
mitre-mcp --help
Expected output
(.venv) root@5ded11443fe0:/test_mitre_mcp# mitre-mcp --help
MITRE ATT&CK MCP Server
Usage: mitre-mcp [options]
Options:
--http Run as HTTP server with streamable HTTP transport
--host HOST Host to bind to (default: localhost, only with --http)
--port PORT Port to bind to (default: 8000, only with --http)
--force-download Force download of MITRE ATT&CK data even if it's recent
-h, --help Show this help message and exit
mitre-mcp
Expected result
(.venv) root@5ded11443fe0:/test_mitre_mcp# mitre-mcp
2025-11-17 22:37:37,087 - mitre_mcp.mitre_mcp_server - INFO - Starting MITRE ATT&CK MCP Server (stdio mode)
2025-11-17 22:37:37,087 - mitre_mcp.mitre_mcp_server - INFO - Press Ctrl+C to stop the server
2025-11-17 22:37:37,091 - mitre_mcp.mitre_mcp_server - INFO - Using data directory: /test_mitre_mcp/.venv/lib/python3.10/site-packages/mitre_mcp/data
2025-11-17 22:37:37,091 - mitre_mcp.mitre_mcp_server - WARNING - Invalid or missing metadata file: [Errno 2] No such file or directory: '/test_mitre_mcp/.venv/lib/python3.10/site-packages/mitre_mcp/data/metadata.json'
2025-11-17 22:37:37,091 - mitre_mcp.mitre_mcp_server - INFO - Disk space check passed: 16458.0MB available (200MB required)
2025-11-17 22:37:37,091 - mitre_mcp.mitre_mcp_server - INFO - Downloading MITRE ATT&CK data in parallel...
2025-11-17 22:37:37,131 - mitre_mcp.mitre_mcp_server - INFO - Downloading Enterprise ATT&CK data...
2025-11-17 22:37:37,132 - mitre_mcp.mitre_mcp_server - INFO - Downloading Mobile ATT&CK data...
2025-11-17 22:37:37,132 - mitre_mcp.mitre_mcp_server - INFO - Downloading Ics ATT&CK data...
2025-11-17 22:37:37,272 - httpx - INFO - HTTP Request: GET https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json "HTTP/1.1 200 OK"
2025-11-17 22:37:37,279 - httpx - INFO - HTTP Request: GET https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json "HTTP/1.1 200 OK"
2025-11-17 22:37:37,281 - httpx - INFO - HTTP Request: GET https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json "HTTP/1.1 200 OK"
2025-11-17 22:37:37,348 - mitre_mcp.mitre_mcp_server - INFO - Validated ics STIX bundle: 1825 objects
2025-11-17 22:37:37,381 - mitre_mcp.mitre_mcp_server - INFO - Downloaded ics: 1825 objects
2025-11-17 22:37:37,401 - mitre_mcp.mitre_mcp_server - INFO - Validated mobile STIX bundle: 2535 objects
2025-11-17 22:37:37,447 - mitre_mcp.mitre_mcp_server - INFO - Downloaded mobile: 2535 objects
2025-11-17 22:37:37,853 - mitre_mcp.mitre_mcp_server - INFO - Validated enterprise STIX bundle: 24771 objects
2025-11-17 22:37:38,291 - mitre_mcp.mitre_mcp_server - INFO - Downloaded enterprise: 24771 objects
2025-11-17 22:37:38,302 - mitre_mcp.mitre_mcp_server - INFO - MITRE ATT&CK data downloaded successfully.
2025-11-17 22:37:38,302 - mitre_mcp.mitre_mcp_server - INFO - Initializing MITRE ATT&CK data...
2025-11-17 22:37:41,898 - mitre_mcp.mitre_mcp_server - INFO - MITRE ATT&CK data initialized successfully.
2025-11-17 22:37:41,898 - mitre_mcp.mitre_mcp_server - INFO - Building lookup indices...
2025-11-17 22:37:41,924 - mitre_mcp.mitre_mcp_server - INFO - Built group index: 580 entries for 187 groups
2025-11-17 22:37:41,949 - mitre_mcp.mitre_mcp_server - INFO - Built mitigation index: 268 entries for 268 mitigations
2025-11-17 22:37:41,975 - mitre_mcp.mitre_mcp_server - INFO - Built technique index: 835 entries for 835 techniques
2025-11-17 22:37:41,976 - mitre_mcp.mitre_mcp_server - INFO - Lookup indices built successfully.
2025-11-17 22:37:41,976 - mitre_mcp.mitre_mcp_server - INFO -
======================================================================
MITRE ATT&CK MCP Server is ready (stdio mode)
Add this to your MCP client configuration:
{
"mcpServers": {
"mitreattack": {
"command": "/test_mitre_mcp/.venv/bin/python3",
"args": [
"-m",
"mitre_mcp.mitre_mcp_server"
]
}
}
}
======================================================================
======================================================================
MITRE ATT&CK MCP Server is ready (stdio mode)
Add this to your MCP client configuration:
{
"mcpServers": {
"mitreattack": {
"command": "/test_mitre_mcp/.venv/bin/python3",
"args": [
"-m",
"mitre_mcp.mitre_mcp_server"
]
}
}
}
======================================================================
Add to a MCP Client
At the end of the log, you should see the real configuration, just copy - paste into your favorite mcp client. For example for the above server:
{
"mcpServers": {
"mitreattack": {
"command": "/test_mitre_mcp/.venv/bin/python3",
"args": ["-m", "mitre_mcp.mitre_mcp_server"]
}
}
}
mitre-mcp --http
Expected result
(.venv) root@5ded11443fe0:/test_mitre_mcp# mitre-mcp --http --host 0.0.0.0 --port 8088
2025-11-17 22:40:10,991 - mitre_mcp.mitre_mcp_server - INFO - Starting MITRE ATT&CK MCP Server (HTTP mode on 0.0.0.0:8088)
2025-11-17 22:40:10,991 - mitre_mcp.mitre_mcp_server - INFO - Press Ctrl+C to stop the server
======================================================================
MCP Client Configuration (Streamable HTTP Transport)
Server URL: http://0.0.0.0:8088
MCP Endpoint: http://0.0.0.0:8088/mcp
Add this to your MCP client configuration:
{
"mcpServers": {
"mitreattack": {
"url": "http://0.0.0.0:8088/mcp"
}
}
}
======================================================================
2025-11-17 22:40:10,992 - mitre_mcp.mitre_mcp_server - INFO - CORS middleware enabled for async notifications
INFO: Started server process [3172]
INFO: Waiting for application startup.
2025-11-17 22:40:11,005 - mcp.server.streamable_http_manager - INFO - StreamableHTTP session manager started
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8088 (Press CTRL+C to quit)
Add to a MCP Client
At the end of the log, you should see the real configuration, just copy - paste into your favorite mcp client. For example for the above server:
"mitreattack": {
"url": "http://0.0.0.0:8088/mcp"
}
Note that the address 0.0.0.0 should be the public address of the machine in which you start the server.
Screenshots of adding mitre-mcp in VSCode
Configure mcp server
Make a query and see the Github Copilot request to call tools from mitre-mcp
The LLM show the final result with the information collected from mitre-mcp
--force-download option to force a fresh download of MITRE ATT&CK data:mitre-mcp --force-download
We provide two playbooks to help you get started with mitre-mcp, tailored to different experience levels:
For those new to MITRE ATT&CK or cybersecurity, check out our Beginner's Guide. This guide uses simple language and practical examples to help you understand and use MITRE ATT&CK concepts.
Ideal for:
For security professionals and technical users, our Advanced Playbook provides in-depth examples and command-line usage for leveraging mitre-mcp's full capabilities.
Ideal for:
To run mitre-mcp as an MCP server for AI-driven clients (e.g., Claude, Windsurf, Cursor):
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate.bat
pip install mitre-mcp
{
"mcpServers": {
"mitreattack": {
"command": "/absolute/path/to/.venv/bin/python",
"args": ["-m", "mitre_mcp_server"]
}
}
}
Important:
C:\path\to\.venv\Scripts\python.exeThe mitre-mcp tools should now be available in your MCP client.
When running in HTTP mode with mitre-mcp --http, the server provides:
http://localhost:8000/mcp for streamable HTTP transport--host and --port flags to customize bindingStarting the HTTP server:
# Default (localhost:8000)
mitre-mcp --http
# Custom host and port
mitre-mcp --http --host 127.0.0.1 --port 8080
MCP Client Configuration:
{
"mcpServers": {
"mitreattack": {
"url": "http://localhost:8000/mcp"
}
}
}
HTTP mode is useful for:
The server automatically caches MITRE ATT&CK data in a data/ folder to improve performance and reduce unnecessary downloads. The caching behavior works as follows:
data/ folder--force-download option| Scenario | Observed Improvement | Notes |
|---|---|---|
| Enterprise technique lookup | 80–95% faster | Uses pre-built O(1) indices for groups, mitigations, and techniques during server startup. |
| ATT&CK data downloads | 20–40% faster | HTTP connection pooling reuses TLS sessions across requests; configurable timeout prevents hangs. |
| Warm cache startup | <2s cold start | Cached bundles younger than 24h are reused, so LLM prompts can query the framework almost instantly. |
Benchmarks were collected on macOS 14 / Apple M3 Pro with Python 3.11. Performance varies with disk speed and network conditions; rerun with MITRE_LOG_LEVEL=DEBUG to view timing logs.
Set any of the following environment variables before starting mitre-mcp to customize behavior (see mitre_mcp/config.py for validation logic):
| Variable | Default | Purpose |
|---|---|---|
MITRE_ENTERPRISE_URL, MITRE_MOBILE_URL, MITRE_ICS_URL | Official MITRE CTI GitHub URLs | Override ATT&CK bundle locations or point to an internal mirror. |
MITRE_DATA_DIR | mitre_mcp/data | Store cached bundles in a custom directory (useful for shared volumes or read-only installs). |
MITRE_DOWNLOAD_TIMEOUT | 30 | HTTP timeout in seconds for bundle downloads. |
MITRE_CACHE_EXPIRY_DAYS | 1 | Maximum age before cached data is refreshed. |
MITRE_REQUIRED_SPACE_MB | 200 | Disk space threshold checked before downloading data. |
MITRE_DEFAULT_PAGE_SIZE / MITRE_MAX_PAGE_SIZE | 20 / 1000 | Default and maximum number of records returned by list-style tools. |
MITRE_MAX_DESC_LENGTH | 500 | Trimmed description length in formatted responses. |
MITRE_LOG_LEVEL | INFO | Logging verbosity (DEBUG, INFO, WARNING, etc.). |
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate.bat
pip install mitre-mcp
from mcp.client.client import Client
from mcp.client.transports import StdioTransport
async with Client(transport=StdioTransport("mitre-mcp")) as client:
# Get all tactics
tactics = await client.call_tool("get_tactics", {
"domain": "enterprise-attack"
})
# Get techniques used by a specific group
group_techniques = await client.call_tool("get_techniques_used_by_group", {
"group_name": "APT29",
"domain": "enterprise-attack"
})
# Access a resource
server_info = await client.read_resource("mitre-attack://info")
The server provides the following resources:
mitre-attack://info
Get information about the MITRE ATT&CK MCP server, including available domains and tools.
You can add this MCP server to any MCP client by including it in the client's configuration:
{
"mcpServers": {
"mitreattack": {
"command": "/absolute/path/to/.venv/bin/python",
"args": ["-m", "mitre_mcp_server"]
}
}
}
Important:
C:\path\to\.venv\Scripts\python.exeTo integrate with Claude Desktop, add the server to your Claude Desktop configuration file located at:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude Desktop\config.json~/.config/Claude Desktop/config.jsonRun the helper script to provision a dedicated virtualenv and update the Claude config automatically:
python scripts/install_claude_mitre_mcp.py
What it does:
~/.mitre-mcp-claudemcp[cli]) so mcp.server.fastmcp is always availablemcpServers.mitreattack entry pointing at that interpreter in ~/Library/Application Support/Claude/claude_desktop_config.jsonOptional flags:
--venv /custom/path – override the virtualenv location--config /custom/config.json – override the Claude config pathAfter the script finishes, restart Claude Desktop and start the MCP server from that environment (~/.mitre-mcp-claude/bin/mitre-mcp --force-download the first time to warm the cache).
Clone the repository and install in development mode:
git clone https://github.com/montimage/mitre-mcp.git
cd mitre-mcp
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
Follow this workflow when you need to modify the codebase and validate the changes locally:
git clone https://github.com/montimage/mitre-mcp.git
cd mitre-mcp
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate.bat
pip install -e ".[dev]"
pre-commit install
mitre-mcp --force-download
mitre_mcp/ (or add tests in tests/), then rerun:
pytest # full test suite with coverage
pre-commit run --all-files # run all quality checks
-e). When satisfied, run pip install -e . again to ensure entry points are updated and commit your changes.The project uses pre-commit hooks for automated code quality checks:
Formatting:
Linting & Type Checking:
Security & Validation:
Testing:
Run quality checks manually:
pre-commit run --all-files # Run all hooks
pre-commit run pytest # Run only tests
black mitre_mcp/ # Format code
pytest tests/ # Run test suite
MITRE_REQUIRED_SPACE_MB (default 200 MB) in the data directory or move the cache by setting MITRE_DATA_DIR=/path/to/storage.MITRE_CACHE_EXPIRY_DAYS refresh automatically, but you can run mitre-mcp --force-download or delete the data/ folder to fetch a clean copy immediately.{"error": ...} – Ensure technique IDs follow the T#### or T####.### format and that names/tactics are under 100 characters; the validator sanitizes other inputs for safety.mitre-mcp manually and call read_resource("mitre-attack://info") to verify connectivity before re-enabling automations.ModuleNotFoundError: mcp.server.fastmcp – Run the helper script again or execute pip install "mcp[cli]" inside the environment referenced by Claude (e.g., ~/.mitre-mcp-claude/bin/python -m pip install "mcp[cli]") so the MCP SDK is available.pyproject.toml). Older versions are not tested and might miss async dependencies.MITRE_CACHE_EXPIRY_DAYS or manually refresh with --force-download.MIT
mitre-mcp is developed and maintained by Montimage, a company specializing in cybersecurity and network monitoring solutions. Montimage provides innovative security tools and services to help organizations protect their digital assets and ensure the security of their networks.
For questions or support, please contact us at luong.nguyen@montimage.eu.
FAQs
MCP server for MITRE ATT&CK framework
The pypi package mitre-mcp receives a total of 130 weekly downloads. As such, mitre-mcp popularity was classified as not popular.
We found that mitre-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.