MITRE ATT&CK

What it does

This server provides an AI agent with direct access to the MITRE ATT&CK framework. It enables security professionals to query techniques, tactics, and threat groups, and visually map detection coverage by generating ATT&CK Navigator layers.

Tools

• get_technique: Fetch details for a specific technique ID.
• search_techniques: Full-text search across techniques.
• list_techniques_by_tactic: Filter techniques by a specific tactic.
• get_group: Retrieve threat group details (e.g., APT29).
• generate_layer: Create a JSON layer for the ATT&CK Navigator.
• analyze_coverage: Calculate coverage percentages and identify gaps.
• find_group_gaps: Compare current coverage against a known threat group.

Installation

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": {
        "ATTACK_DOMAIN": "enterprise-attack"
      }
    }
  }
}

Supported hosts

Confirmed support for Claude Desktop and Cursor.