Enables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.
MCP server for a compliance knowledge graph covering 686 frameworks, 21,696+ controls and 310K+ cross-framework mappings, with tools to map controls between two standards and run coverage analysis. Node and Python implementations over stdio, plus a hosted streamable HTTP endpoint.
A comprehensive implementation of Model Context Protocol servers enabling natural language interactions with security platforms including Splunk SIEM, CrowdStrike EDR, and Microsoft MISP for threat intelligence querying and analysis.
Enables an agent to map MITRE ATT&CK techniques and actors to mitigating NIST 800-53r5 controls and severity-ordered DISA STIG fix/check steps for target systems. It answers questions about STIG mitigations, technique attribution, and applicable benchmarks once its local knowledge base is installed.
Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.