MITRE ATT&CK Mapper MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| query_techniqueB | Query ATT&CK technique by ID (Txxxx) or name Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features. Returns: JSON with structured assessment, regulation refs, and recommended actions. |
| list_tacticsA | All 14 enterprise tactics (TA0001-TA0040+) Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features. Returns: JSON with structured assessment, regulation refs, and recommended actions. |
| map_incidentA | Map incident IOCs/behaviors to ATT&CK techniques Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features. Returns: JSON with structured assessment, regulation refs, and recommended actions. |
| group_threat_actorC | Threat actor groups (G-codes) using a technique Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features. Returns: JSON with structured assessment, regulation refs, and recommended actions. |
| mitigation_lookupC | Mitigations (M-codes) for a technique Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features. Returns: JSON with structured assessment, regulation refs, and recommended actions. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool targets a distinct ATT&CK resource (tactics, techniques, groups, mitigations, incident mapping), but the generic return descriptions could cause an agent to misselect if relying solely on descriptions.
Tool names follow a verb_noun pattern in snake_case, but 'group_threat_actor' uses 'group' as an atypical verb, slightly deviating from the clearer verbs like list, map, lookup, query.
5 tools is a reasonable count for a focused ATT&CK mapper, covering key operations, though there is room for a few more (e.g., listing techniques, sub-techniques) without being overbearing.
Core workflows like technique lookup, tactic listing, and incident mapping are covered, but missing obvious operations like listing all techniques, threat groups independently, or software, leaving notable gaps.