cyber-mcp-tools
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ATTACK_STIX_DATA | No | Path to the local clone of mitre-attack/attack-stix-data. Used at build time to derive the ATT&CK data. Defaults to '../attack-stix-data'. | ../attack-stix-data |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| attack_searchB | Find MITRE ATT&CK techniques by text, platform or tactic. Returns compact summaries only. |
| attack_getA | Fetch a single technique by ATT&CK id such as T1055 or T1055.011. Ids are unique across domains. |
| attack_detectionA | Return the ATT&CK v19 detection strategy for a technique. With analytics, includes log sources and tunable fields. |
| attack_mitigationsA | Return mitigations for a technique, including how each one applies to that specific technique. |
| attack_relatedB | Page through what relates to a technique. Use usedBy for groups and software, which can be very large. |
| attack_actorB | Find a group, malware, tool or campaign by ATT&CK id or name. Spans all domains, since many actors operate in more than one. |
| attack_metaA | Return the dataset version and counts, plus the valid tactic slugs and platform names for filtering. |
| defend_countermeasuresA | Return MITRE D3FEND countermeasures that counter an ATT&CK technique. D3FEND maps mostly at sub-technique level, so a parent id reports which of its children are covered. Pass detail for the full artifact-level payload. Mobile techniques have no D3FEND coverage. |
| defend_searchA | List D3FEND countermeasures, optionally filtered by defensive tactic, or find which ATT&CK techniques a named countermeasure applies to. |
| defend_metaA | Return how much of ATT&CK the D3FEND mapping actually covers, including which domains have no coverage. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
The attack_* and defend_* prefixes cleanly separate the ATT&CK and D3FEND domains, and search/get/actor/related have clear targets. The only mild ambiguity is among attack_detection, attack_mitigations, and defend_countermeasures, since all three describe defensive response content, though each names a distinct framework or strategy type.
Names consistently use lowercase snake_case and the attack_/defend_ prefixes, which is a recognizable pattern. However, the second part mixes nouns (actor, meta, mitigations), verbs (get, search), and adjectives (related), so it does not follow a single verb_noun convention.
Ten tools is a well-scoped size for a MITRE ATT&CK/D3FEND knowledge server. Each tool covers a distinct retrieval need without feeling padded or redundant.
The surface covers technique lookup and search, actor lookup, relationship traversal, detections, mitigations, D3FEND countermeasures, and metadata for both datasets. This provides a comprehensive read-only workflow for threat-intel queries with no obvious dead ends.