Skip to main content
Glama

mitre-mcp: MITRE ATT&CK MCP Server

MCP Registry

PyPI version Python versions Test status License Code style: black Pre-commit

Production-ready Model Context Protocol (MCP) server that exposes the MITRE ATT&CK® framework to LLMs, AI assistants, and automation workflows. Built with the official MCP Python SDK and mitreattack-python library for secure, high-performance access to adversary tactics, techniques, groups, software, and mitigations.

Available in the MCP Registry (search for io.github.luongnv89/mitre-mcp).

Highlights

  • LLM-native experience – Seamless integration with Claude, Windsurf, Cursor, and any MCP-compatible client

  • Secure-by-default – Validated inputs, TLS verification, disk-space checks, and structured error handling

  • High performance – O(1) technique lookups using pre-built indices (80-95% faster than scanning)

  • Flexible deployment – stdio for local clients or HTTP server for web-based integrations

Related MCP server: MITRE ATT&CK MCP Server

Table of Contents

Features

  • Comprehensive MITRE ATT&CK Coverage - All techniques, tactics, groups, software, and mitigations

  • Multi-Domain Support - Enterprise, Mobile, and ICS ATT&CK domains

  • Intelligent Caching - Atomic, per-user caching with conditional refreshes, stale-serve with background refresh, and configurable expiry (default: 14 days)

  • Fast Startup - Enterprise loads eagerly; mobile and ICS domains lazy-load on first use

  • Performance Optimized - O(1) lookups using pre-built indices (80-95% faster)

  • Dual Transport Modes - stdio for local clients, HTTP for web integrations

  • CORS-Enabled HTTP Server - Async notifications and cross-origin request support

  • Comprehensive Testing - pytest suite with an enforced coverage gate

  • Pre-commit Quality Checks - Automated formatting, linting, type checking, and security scanning

  • Input Validation - Secure-by-default with validated inputs and sanitized responses

  • Programmatic API - Python and Node.js clients (see API-INTEGRATION.md)

Available MCP Tools

Tool Name

Description

get_techniques

List all techniques with filtering options

get_technique_by_id

Look up specific technique by ID (e.g., T1055)

get_techniques_by_tactic

Get techniques for a specific tactic (e.g., persistence)

get_tactics

List all tactical categories

get_groups

List all threat actor groups

get_techniques_used_by_group

Get techniques used by a specific group (e.g., APT29)

get_software

List malware and tools with filtering

get_mitigations

List all security mitigations

get_techniques_mitigated_by_mitigation

Get techniques addressed by a specific mitigation

All list and relationship tools accept limit/offset paging parameters (default page size 20, maximum 200 — see MITRE_DEFAULT_PAGE_SIZE and MITRE_MAX_PAGE_SIZE in CONTRIBUTING.md) and return a pagination block (total, offset, limit, has_more).

Quick Start

Installation

  1. Create and activate a virtual environment:

python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate.bat
  1. Install from PyPI:

pip install mitre-mcp
  1. Verify installation:

mitre-mcp --help

Start the server:

mitre-mcp --http

Expected output:

2025-11-17 22:40:10,991 - mitre_mcp.mitre_mcp_server - INFO - Starting MITRE ATT&CK MCP Server (HTTP mode on localhost:8000)
======================================================================
MITRE ATT&CK MCP Server is ready (Streamable HTTP mode)
Server URL: http://localhost:8000
MCP Endpoint: http://localhost:8000/mcp

Add this to your MCP client configuration:
{
  "mcpServers": {
    "mitreattack": {
      "url": "http://localhost:8000/mcp"
    }
  }
}
======================================================================

Configure your MCP client:

Add this JSON to your client's configuration file:

{
  "mcpServers": {
    "mitreattack": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

Configuration file locations:

  • macOS (Claude Desktop): ~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows (Claude Desktop): %APPDATA%\Claude\claude_desktop_config.json

  • Linux (Claude Desktop): ~/.config/Claude/claude_desktop_config.json

  • VSCode: Configure in your MCP extension settings

Custom host and port:

mitre-mcp --http --host 0.0.0.0 --port 8080

Then use http://your-server-ip:8080/mcp in your client configuration.

Security — a non-loopback bind is unauthenticated by default. Binding --host 0.0.0.0 (or any non-loopback address) exposes the MCP endpoint to the whole network: the data is public, but the endpoint is an open CPU and memory amplifier. Either set MITRE_HTTP_AUTH_TOKEN so every request must carry Authorization: Bearer <token>:

MITRE_HTTP_AUTH_TOKEN=$(openssl rand -hex 32) mitre-mcp --http --host 0.0.0.0 --port 8080

or place an authenticating reverse proxy in front of a loopback-only server — nginx example (TLS + basic auth → 127.0.0.1:8000):

server {
    listen 443 ssl;
    server_name mcp.example.com;
    ssl_certificate     /etc/nginx/certs/mcp.example.com.pem;
    ssl_certificate_key /etc/nginx/certs/mcp.example.com.key;

    location / {
        auth_basic           "mitre-mcp";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass           http://127.0.0.1:8000;
        proxy_set_header     Host $host;
    }
}

The server logs a warning at startup whenever it binds a non-loopback host without MITRE_HTTP_AUTH_TOKEN set.

Why HTTP mode?

  • Multiple clients can connect simultaneously

  • Better concurrency and async support

  • Easier debugging with HTTP tools

  • CORS support for web-based clients

  • No path configuration needed

stdio Mode (Alternative)

For local-only clients that require stdio transport:

mitre-mcp

Client configuration:

{
  "mcpServers": {
    "mitreattack": {
      "command": "/absolute/path/to/.venv/bin/python",
      "args": ["-m", "mitre_mcp.mitre_mcp_server"]
    }
  }
}

Note: Use absolute paths. HTTP mode is recommended for most use cases.

Force Data Download

Force a fresh download of MITRE ATT&CK data:

mitre-mcp --http --force-download

Example Screenshots

VSCode Configuration:

Configure

Tool Invocation:

Tool call

Results:

Result

Web Frontend

A React chat UI lives in frontend/. A hosted copy is at https://montimage.github.io/mitre-mcp/. That public HTTPS page can call cloud LLM providers (Gemini, OpenRouter). It cannot reach anything on this machine — mitre-mcp on localhost:8000, Ollama, LM Studio, or any other loopback endpoint. The browser blocks public sites from the loopback address space (net::ERR_SSL_PROTOCOL_ERROR if it upgrades the MCP URL to https://localhost:8000/mcp, CORS / private-network errors for http://localhost:…/v1/models).

Use the local UI whenever the MCP server or the LLM runs on your computer.

Local setup (MCP server + chat UI)

Two terminals, from a clone of this repository.

1. Install and start the MCP server (Python >= 3.11):

uv sync --locked --extra dev
source .venv/bin/activate
mitre-mcp --http

Wait for MCP Endpoint: http://localhost:8000/mcp. The first start downloads ATT&CK data into ~/.cache/mitre-mcp.

2. Start the chat UI (Node 24):

cd frontend
npm ci
npm run dev

Open http://localhost:5173/ — not the GitHub Pages URL.

3. Settings (gear in the chat header):

Setting

Local value

MCP host / port

localhost / 8000 (dev proxies /mcp to the server)

LLM provider

Ollama, Gemini, OpenRouter, or OpenAI-compatible

For a local OpenAI-compatible server (LM Studio, llama.cpp, vLLM, …):

  • Provider: OpenAI-compatible

  • Endpoint URL: http://localhost:<port>/v1 (example: http://localhost:20128/v1)

  • Model: an id the endpoint lists at /v1/models

  • API key: leave empty unless that server requires one

The endpoint must allow CORS from http://localhost:5173. If Ollama is not running, do not leave Ollama selected — the default probe hits localhost:11434 and Vite logs http proxy error: /api/tags.

For more details, see frontend/README.md.

Documentation

We provide three comprehensive guides tailored to different use cases:

1. Beginner's Guide

Beginner-Playbook.md - For those new to MITRE ATT&CK or cybersecurity

Ideal for:

  • Non-technical users

  • Security awareness training

  • Basic threat intelligence

  • General cybersecurity education

2. Advanced Playbook

Playbook.md - For security professionals using MCP clients

Ideal for:

  • Security analysts

  • Threat hunters

  • Incident responders

  • Security engineers

Includes 10 ready-to-use scenarios:

  • Threat Intelligence

  • Detection Engineering

  • Threat Hunting

  • Red Teaming

  • Security Assessment

  • Incident Response

  • Security Operations

  • Security Training

  • Vendor Evaluation

  • Risk Management

3. API Integration Guide

API-INTEGRATION.md - For developers building automation and custom integrations

Ideal for:

  • Backend developers

  • Automation engineers

  • Data pipeline developers

  • Custom tooling projects

Includes:

  • Complete Python and Node.js client implementations

  • Protocol requirements and examples

  • Testing and debugging tools

  • Common integration patterns

Configuration

Environment Variables

Set before starting mitre-mcp to customize behavior:

Variable

Default

Purpose

MITRE_ENTERPRISE_URL, MITRE_MOBILE_URL, MITRE_ICS_URL

Official MITRE CTI GitHub URLs

Override ATT&CK bundle locations or point to internal mirror

MITRE_DATA_DIR

~/.cache/mitre-mcp

Store cached bundles in custom directory

MITRE_DOWNLOAD_TIMEOUT

120

HTTP timeout in seconds for bundle downloads

MITRE_CACHE_EXPIRY_DAYS

14

Maximum age before cached data is refreshed

MITRE_REQUIRED_SPACE_MB

200

Disk space threshold checked before downloading

MITRE_DEFAULT_PAGE_SIZE / MITRE_MAX_PAGE_SIZE

20 / 200

Default and maximum records returned by list tools

MITRE_MAX_DESC_LENGTH

500

Trimmed description length in responses

MITRE_LOG_LEVEL

INFO

Logging verbosity (DEBUG, INFO, WARNING, etc.)

MITRE_CORS_ORIGINS

localhost origins

CORS allowed origins for HTTP mode (comma-separated list; * is an explicit opt-in)

MITRE_HTTP_AUTH_TOKEN

unset (no auth)

Bearer token required on every HTTP request when set; recommended for non-loopback binds

To let a hosted UI (e.g. the Netlify deployment) call the server cross-origin, set MITRE_CORS_ORIGINS to its origin, e.g. MITRE_CORS_ORIGINS="https://mitre-mcp.netlify.app,http://localhost:5173". Credentials are never allowed in any CORS configuration.

Data Caching

The server automatically caches MITRE ATT&CK data to improve performance:

  1. On first run, downloads and stores data in the per-user cache directory ($XDG_CACHE_HOME/mitre-mcp, or ~/.cache/mitre-mcp by default)

  2. On subsequent runs, uses cached data if less than 14 days old

  3. Automatically refreshes data older than 14 days, using conditional requests — a 304 Not Modified answer reuses the cached bundles. Expired-but-present data is served immediately while the refresh runs in the background; startup never blocks on it and a failed refresh keeps the existing cache.

  4. Cache files are written atomically (temp file + rename), so a failed download never corrupts a good cache

  5. Only the enterprise domain is parsed at startup; the mobile and ICS bundles are lazy-loaded on first use, so cold starts stay fast when they are never queried

  6. Use --force-download to force fresh download

Performance

Scenario

Improvement

Notes

Enterprise technique lookup

80-95% faster

Pre-built O(1) indices for groups, mitigations, and techniques

ATT&CK data downloads

20-40% faster

HTTP connection pooling with TLS session reuse

Warm cache startup

<2s

Cached bundles reused for instant LLM queries

Benchmarks: macOS 14 / Apple M3 Pro with Python 3.11. Use MITRE_LOG_LEVEL=DEBUG for timing logs.

Programmatic API

For automation, custom integrations, and batch processing, see API-INTEGRATION.md.

Quick example (Python):

from clients.python.mini_mcp_client import MitreMCPClient


async def main():
    client = MitreMCPClient(host="localhost", port=8000)

    # Get all tactics
    tactics = await client.call_tool("get_tactics", {"domain": "enterprise-attack"})

    # Get techniques for a group
    techniques = await client.call_tool(
        "get_techniques_used_by_group", {"group_name": "APT29", "domain": "enterprise-attack"}
    )

Available clients:

  • Python: clients/python/mini-mcp-client.py with full CLI

  • Node.js: clients/nodejs/mini-mcp-client.js with full CLI

See API-INTEGRATION.md for complete documentation.

Development

Clone and Install

git clone https://github.com/montimage/mitre-mcp.git
cd mitre-mcp
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

Install Pre-commit Hooks

pre-commit install

This sets up automatic code quality checks before each commit.

Run Tests

pytest                      # Full test suite with coverage
pre-commit run --all-files  # All quality checks

Code Quality Tools

Formatting:

  • black - Python code formatter

  • isort - Import organizer

  • prettier - YAML/JSON/Markdown formatter

Linting & Type Checking:

  • flake8 - Python linter

  • mypy - Static type checker

  • pydocstyle - Docstring checker

Security:

  • bandit - Security vulnerability scanner

  • File validators - YAML, JSON, TOML, private key detection

Testing:

  • pytest - test suite with coverage gate before commit

  • Installation test - Package verification

  • Import verification - Module importability

  • CLI test - Entry point validation

Troubleshooting

Download fails with "Insufficient disk space"

  • Free at least 200 MB in the data directory or set MITRE_DATA_DIR=/path/to/storage

Data never updates

  • Cached bundles refresh automatically after 14 days

  • Force refresh: mitre-mcp --force-download or delete ~/.cache/mitre-mcp

Tool calls return errors

  • Ensure technique IDs follow T#### or T####.### format

  • Keep names/tactics under 100 characters

MCP client cannot discover server

  • Verify client configuration points to correct Python path

  • Test manually: run mitre-mcp and verify server starts

  • For HTTP mode: ensure url field is set correctly

Chat UI: POST https://localhost:8000/mcp net::ERR_SSL_PROTOCOL_ERROR

  • The GitHub Pages UI is HTTPS, so it rewrites localhost to https://localhost:8000. mitre-mcp --http has no TLS. Open http://localhost:5173 instead (see Web Frontend).

Chat UI: CORS / “loopback address space” when calling a local LLM

  • Same cause: a public origin cannot fetch http://localhost:…. Run the frontend locally and point the OpenAI-compatible provider at http://localhost:<port>/v1.

Module not found: mcp.server.fastmcp

  • Reinstall the pinned MCP SDK: pip install "mcp>=1.28.1,<2" (or mcp[cli]>=1.28.1,<2 if you also want the CLI extra) in your virtual environment — the fastmcp distribution does not provide mcp.server.fastmcp; the package's declared pin does

FAQ

Does mitre-mcp work offline?

  • Yes. Once bundles are cached, the server works offline until cache expires.

Which Python versions are supported?

  • Python 3.11 through 3.14 (see pyproject.toml).

How often is data refreshed?

  • By default every 24 hours. Adjust MITRE_CACHE_EXPIRY_DAYS or use --force-download.

Is HTTP mode safe for production?

  • HTTP mode serves on localhost:8000 by default. Use firewall or reverse proxy if exposing externally.

License

MIT License - See LICENSE file for details.

About Montimage

mitre-mcp is developed and maintained by Montimage, a cybersecurity company specializing in network monitoring, security analysis, and AI-driven threat detection solutions. We develop innovative tools that help organizations protect their digital assets and ensure network security.

For questions or support: luong.nguyen@montimage.eu

Available Tools

9 tools
get_groupsGet GroupsA
Read-onlyIdempotent

Get groups from the MITRE ATT&CK framework with token-optimized responses.

Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of groups to return (default: 20) offset: Index to start from when returning groups (for pagination)

Returns: Dictionary containing a list of groups and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
groupsYes
paginationYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds context by noting 'token-optimized responses' and specifying that the return is a dictionary with a list of groups and pagination metadata, going beyond the annotation baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with its primary purpose and then uses a compact Args/Returns list. Every sentence contributes information, and there is no filler or redundant repetition of schema fields without added value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a straightforward retrieval operation with an output schema and clear annotations. The description covers all parameters, pagination behavior, and the return shape, so an agent has everything needed to call it correctly without further research.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. The Args section explains every schema parameter: domain enum values, remove_revoked_deprecated semantics, limit's default and purpose, and offset's pagination role, adding far more meaning than the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Get groups from the MITRE ATT&CK framework', specifying a precise verb and resource. The word 'groups' distinguishes it from sibling tools like get_techniques and get_tactics, and the added 'token-optimized responses' further clarifies its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for retrieving ATT&CK groups but never explicitly contrasts it with sibling tools or states when not to use it. There is no alternative routing such as 'for techniques, see get_techniques', so usage guidance is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_mitigationsGet MitigationsA
Read-onlyIdempotent

Get mitigations from the MITRE ATT&CK framework with token-optimized responses.

Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of mitigations to return (default: 20) offset: Index to start from when returning mitigations (for pagination)

Returns: Dictionary containing a list of mitigations and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
paginationYes
mitigationsYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds value by explaining pagination metadata, token-optimized responses, and the remove_revoked_deprecated behavior, which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise summary followed by clearly labeled Args and Returns sections. It front-loads the core purpose and avoids unnecessary fluff, though a slightly tighter format would be even better.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

All four parameters are explained, the return shape is described, and an output schema exists, so the agent has enough to call the tool correctly. The only notable gap is the absence of guidance distinguishing this from related mitigation-specific sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining every parameter: domain values, remove_revoked_deprecated meaning, limit, and offset for pagination. However, it states a default of 20 for limit while the schema default is null, creating a minor inconsistency.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'Get mitigations from the MITRE ATT&CK framework'. It is unmistakably distinct from sibling tools like get_techniques, get_tactics, and get_groups, which target different entities. The 'token-optimized responses' hint adds a useful precision cue.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes it obvious that this tool is for retrieving mitigation objects, but it offers no explicit guidance on when to choose this over the more specific sibling get_techniques_mitigated_by_mitigation. Usage context is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_softwareGet SoftwareA
Read-onlyIdempotent

Get software from the MITRE ATT&CK framework with token-optimized responses.

Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects software_types: Optional list of ATT&CK object types to include (e.g., ["malware"]) limit: Maximum number of software to return (default: 20) offset: Index to start from when returning software (for pagination)

Returns: Dictionary containing a list of software and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
software_typesNo
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
softwareYes
paginationYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds useful context by promising token-optimized responses and clarifying that the result is a dictionary with a software list plus pagination metadata, which goes beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized with a front-loaded purpose statement followed by Args and Returns sections. It is slightly redundant with the schema, particularly for domain enums and parameter names, but every section adds some operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all parameters, the return shape, pagination, and domain options, and an output schema exists, so completeness is strong. The main gaps are the lack of explicit alternative routing and the minor default inconsistency for limit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden and does provide a meaningful line for each parameter, including defaults and an example for software_types. It is strong, but the stated limit default of 20 conflicts with the schema's null default, preventing a perfect score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves software from the MITRE ATT&CK framework, with additional detail on filtering and pagination. It is easily distinguished from sibling tools like get_techniques and get_tactics because each targets a distinct ATT&CK resource type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies its use case by naming the resource type and listing parameters, so an agent can infer when to call it. However, it does not explicitly state when to prefer this tool over alternatives or mention situations where another sibling would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_tacticsGet TacticsB
Read-onlyIdempotent

Get tactics from the MITRE ATT&CK framework with token-optimized responses.

Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of tactics to return (default: 20) offset: Index to start from when returning tactics (for pagination)

Returns: Dictionary containing a list of tactics and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
tacticsYes
paginationYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds some context by mentioning token-optimized responses and pagination metadata, but it does not elaborate on how token optimization works or what pagination metadata is returned. This is acceptable but leaves room for more transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear one-line summary, a compact Args block, and a Returns line. It avoids fluff and front-loads the purpose. The inclusion of ctx as an argument that is not in the schema is slightly extraneous but quickly clarified as injected by the server.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list-retrieval tool with an output schema and rich annotations, the description covers the essential information: purpose, parameters, and return shape. It does not mention how to choose this tool over siblings, but given the simplicity and output schema, it is largely complete. The limit default inconsistency is the main gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description's Args section compensates by explaining domain, remove_revoked_deprecated, limit, and offset. It adds meaning beyond the schema (e.g., what 'remove revoked or deprecated' does, what 'offset' is for). However, there is a discrepancy: the description says the limit default is 20, while the schema states default null, which could confuse an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Get tactics') and a clear resource ('MITRE ATT&CK framework'), which is unambiguous. However, it does not explicitly distinguish itself from sibling tools like get_techniques or get_techniques_by_tactic, though the resource name is inherently informative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus its siblings. There is no mention of alternatives, exclusions, or preferred use cases beyond stating that it retrieves tactics. The sibling tool names are visible in context but not referenced in the description itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_technique_by_idGet Technique by IDA
Read-onlyIdempotent

Get a technique by its MITRE ATT&CK ID.

Args: ctx: FastMCP request context (injected by the server) technique_id: The MITRE ATT&CK ID of the technique (e.g., 'T1055') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)

Returns: Dictionary containing the technique

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNoenterprise-attack
technique_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
techniqueYes

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds no behavioral context beyond a generic 'Returns: Dictionary', offering no guidance on not-found behavior, error handling, or domain-specific effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is clear and front-loaded, but the docstring includes boilerplate about the injected ctx and a redundant 'Returns: Dictionary containing the technique' line that overlaps with the output schema. It is not bloated, yet not every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only fetch by ID, the description covers both parameters, the domain choice, and the return shape. With an output schema present and readOnly/idempotent annotations, nothing needed to invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it explains technique_id with a concrete example ('T1055') and lists the three valid domain values. This adds real meaning beyond the bare schema properties, though it does not elaborate on format edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states an exact verb ('Get'), the resource ('technique'), and the key selector ('MITRE ATT&CK ID'), e.g., 'T1055'. This clearly distinguishes it from sibling tools like get_techniques or get_techniques_by_tactic without needing to open the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the appropriate use case—call this when you already have a specific MITRE ATT&CK ID—but it never explicitly names alternatives or states when not to use it. No exclusions or comparison to sibling tools are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_techniquesGet TechniquesA
Read-onlyIdempotent

Get techniques from the MITRE ATT&CK framework with token-optimized responses.

Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) include_subtechniques: Include subtechniques in the result remove_revoked_deprecated: Remove revoked or deprecated objects include_descriptions: Whether to include technique descriptions (uses more tokens) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination)

Returns: Dictionary containing a list of techniques and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
include_descriptionsNo
include_subtechniquesNo
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
paginationYes
techniquesYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful behavioral context beyond that: responses are token-optimized, including descriptions consumes more tokens, and the return value contains pagination metadata. There is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead sentence is concise and the parameter bullets are compact and informative. It is longer than strictly necessary, and 'token-optimized responses' is somewhat vague, but each line earns its place by explaining a parameter or the return shape.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 6 parameters, annotations, and output schema, the description covers the invocation essentials: all arguments are explained, pagination is described, and the return is summarized. The main missing piece is explicit routing among the sibling tools, but that gap is also captured in usage_guidelines.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the whole burden and succeeds by explaining every parameter—domain values, default 20 limit, offset pagination, subtechnique inclusion, revoked/deprecated filtering, and the token cost of descriptions. This adds meaning beyond the bare names, types, and defaults in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation and resource: it retrieves techniques from the MITRE ATT&CK framework, and the parameter list clarifies scope by domain and subtechniques. However, it never states whether this is the unfiltered/general listing as opposed to the filtered sibling tools such as get_techniques_by_tactic, get_techniques_used_by_group, or get_technique_by_id, so it is clear but not fully differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is a general technique-fetching tool through its broad name and pagination/filtering parameters, but it gives no explicit when-to-use or when-not-to-use guidance and does not mention any sibling tools. An agent has to infer that get_techniques_by_tactic or get_technique_by_id would be better choices for narrower lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_techniques_by_tacticGet Techniques by TacticA
Read-onlyIdempotent

Get techniques by tactic.

Args: ctx: FastMCP request context (injected by the server) tactic_shortname: The shortname of the tactic (e.g., 'defense-evasion') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination)

Returns: Dictionary containing a list of techniques and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
tactic_shortnameYes
remove_revoked_deprecatedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
paginationYes
techniquesYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already communicate safe, idempotent, read-only behavior, so the description does not need to restate that. It adds useful context about pagination metadata and the default limit of 20, but does not go deeper into edge-case behavior like handling an unknown tactic shortname or empty results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact, well-organized docstring with Args and Returns sections. Each parameter gets a short, meaningful explanation, there is no filler, and the core purpose is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and the presence of an output schema, the description provides everything needed to invoke it correctly: all parameter semantics, the domain choices, pagination behavior, and the return shape. No critical invocation detail appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden of explaining all five parameters. It successfully does so: tactic_shortname is given example syntax, domain lists allowed values, remove_revoked_deprecated is explained, and limit/offset are defined as pagination controls with the default limit noted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening phrase 'Get techniques by tactic' names a specific verb, resource, and filtering dimension, and the parameter descriptions clarify exactly what tactic and domain mean. This cleanly distinguishes it from siblings like get_techniques, which returns techniques without a tactic filter, and get_technique_by_id, which targets a single technique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the name and description: use it when you want techniques filtered by a tactic shortname. However, it never explicitly contrasts with sibling tools like get_techniques or get_techniques_used_by_group, so an agent is left to infer when this tool is the right choice over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_techniques_mitigated_by_mitigationGet Techniques Mitigated by MitigationB
Read-onlyIdempotent

Get techniques mitigated by a mitigation.

Args: ctx: FastMCP request context (injected by the server) mitigation_name: The name of the mitigation domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination)

Returns: Dictionary containing the mitigation, a list of techniques and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
mitigation_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
mitigationYes
paginationYes
techniquesYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat those. It adds return-type context ('Dictionary containing the mitigation, a list of techniques and pagination metadata') and mentions pagination in the Args, which is useful. However, it doesn't disclose any additional behavioral traits such as rate limits, authentication, or what happens when no techniques are found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description opens with a crisp one-liner, then a structured Args list and Returns note. It is reasonably compact and well-organized. The Args section is at times tautological (e.g., 'mitigation_name: The name of the mitigation') but not excessively verbose, and the most important info is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 4 parameters, one required, an output schema, and safety annotations, the description covers the return format and pagination. However, it omits usage guidelines (when to choose this tool over siblings) and lacks any example or edge-case behavior. For a read-only query tool, it is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameter descriptions (coverage 0%), so the description must compensate. It provides some meaning for 'limit' and 'offset' (pagination semantics) and restates the enum values for 'domain', though the schema already lists them. 'mitigation_name' is merely described as 'The name of the mitigation,' adding little beyond the parameter name. Overall, partial compensation but could be more descriptive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get techniques mitigated by a mitigation,' which is a clear verb-resource pair and distinguishes this tool from siblings like get_techniques (all techniques) and get_techniques_by_tactic (by tactic). It is specific but doesn't explicitly contrast with alternatives; the title and one-liner are unambiguous enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus its siblings. The description does not mention prerequisites, filters, or scenarios where a different tool would be more appropriate. An agent must infer the use case from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_techniques_used_by_groupGet Techniques Used by GroupA
Read-onlyIdempotent

Get techniques used by a group.

Args: ctx: FastMCP request context (injected by the server) group_name: The name of the group domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination)

Returns: Dictionary containing the group, a list of techniques and pagination metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNoenterprise-attack
offsetNo
group_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
groupYes
paginationYes
techniquesYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is clear. The description adds mildly useful behavioral context by stating the return shape (group, list of techniques, pagination metadata) and describing pagination via limit/offset. It does not go deeper into edge cases such as unknown group names or empty results, but that gap is minor given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a well-organized docstring with an opening summary followed by concise Args and Returns sections. Every parameter earns its place and there is no redundant prose. The formatting is slightly heavier than necessary, but it remains readable and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup tool, the description covers the essential invocation details: required group_name, optional domain, and pagination controls. The output schema and annotations take care of return structure and safety behaviorgrave. The only material omission is usage guidance relative to sibling tools, which is handled by the tool name but not described explicitly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description compensates by explaining each parameter: group_name as the group to query, domain with its allowed values, limit as the maximum number of techniques, and offset as the pagination starting index. This adds meaning that is absent from the schema's bare properties. It could be improved by noting expected types, but the schema already provides types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb and resource: 'Get techniques used by a group.' This directly distinguishes the tool from siblings like get_techniques and get_techniques_by_tactic by specifying the grouping dimension. The title reinforces the purpose without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage is implied: use this tool when you need techniques associated with a specific group. However, it provides no explicit guidance on when not to use it or when to prefer a sibling tool such as get_techniques_by_tactic or get_techniques. The description defines what the tool does but does not give selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 9 tool updatesv0.4.0
    • Changedget_groups9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "GroupResult": {
        +    "description": "Single group entry in get_groups results.",
        +    "properties": {
        +      "aliases": {
        +        "items": {
        +          "type": "string"
        +        },
        +        "title": "Aliases",
        +        "type": "array"
        +      },
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name",
        +      "description",
        +      "aliases"
        +    ],
        +    "title": "GroupResult",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_groups result."
      • addedOutput schema / properties
        Added value: +{
        +  "groups": {
        +    "items": {
        +      "$ref": "#/$defs/GroupResult"
        +    },
        +    "title": "Groups",
        +    "type": "array"
        +  },
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "groups",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_groupsDictOutput"New value: +"GroupsResult"
    • Changedget_mitigations9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "MitigationResult": {
        +    "description": "Single mitigation entry in get_mitigations results.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name",
        +      "description"
        +    ],
        +    "title": "MitigationResult",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_mitigations result."
      • addedOutput schema / properties
        Added value: +{
        +  "mitigations": {
        +    "items": {
        +      "$ref": "#/$defs/MitigationResult"
        +    },
        +    "title": "Mitigations",
        +    "type": "array"
        +  },
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "mitigations",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_mitigationsDictOutput"New value: +"MitigationsResult"
    • Changedget_software9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  },
        +  "SoftwareResult": {
        +    "description": "Single software entry in get_software results.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name",
        +      "type",
        +      "description"
        +    ],
        +    "title": "SoftwareResult",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_software result."
      • addedOutput schema / properties
        Added value: +{
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "software": {
        +    "items": {
        +      "$ref": "#/$defs/SoftwareResult"
        +    },
        +    "title": "Software",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "software",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_softwareDictOutput"New value: +"SoftwareListResult"
    • Changedget_tactics9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  },
        +  "TacticResult": {
        +    "description": "Single tactic entry in get_tactics results.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "shortname": {
        +        "title": "Shortname",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name",
        +      "shortname",
        +      "description"
        +    ],
        +    "title": "TacticResult",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_tactics result."
      • addedOutput schema / properties
        Added value: +{
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "tactics": {
        +    "items": {
        +      "$ref": "#/$defs/TacticResult"
        +    },
        +    "title": "Tactics",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "tactics",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_tacticsDictOutput"New value: +"TacticsResult"
    • Changedget_technique_by_id7 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedOutput schema / $defs
        Added value: +{
        +  "FormattedTechnique": {
        +    "description": "Token-optimized technique object emitted by format_technique.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "mitre_id": {
        +        "title": "Mitre Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "title": "FormattedTechnique",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_technique_by_id result."
      • addedOutput schema / properties
        Added value: +{
        +  "technique": {
        +    "$ref": "#/$defs/FormattedTechnique"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "technique"
        +]
      • changedOutput schema / title
        Previous value: -"get_technique_by_idDictOutput"New value: +"TechniqueResult"
    • Changedget_techniques7 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedOutput schema / $defs
        Added value: +{
        +  "FormattedTechnique": {
        +    "description": "Token-optimized technique object emitted by format_technique.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "mitre_id": {
        +        "title": "Mitre Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "title": "FormattedTechnique",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_techniques result: paged technique list plus pagination metadata."
      • addedOutput schema / properties
        Added value: +{
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "techniques": {
        +    "items": {
        +      "$ref": "#/$defs/FormattedTechnique"
        +    },
        +    "title": "Techniques",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "techniques",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_techniquesDictOutput"New value: +"TechniquesPageResult"
    • Changedget_techniques_by_tactic9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "FormattedTechnique": {
        +    "description": "Token-optimized technique object emitted by format_technique.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "mitre_id": {
        +        "title": "Mitre Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "title": "FormattedTechnique",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"Result for tools returning a flat formatted technique list."
      • addedOutput schema / properties
        Added value: +{
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "techniques": {
        +    "items": {
        +      "$ref": "#/$defs/FormattedTechnique"
        +    },
        +    "title": "Techniques",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "techniques",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_techniques_by_tacticDictOutput"New value: +"TechniquesListResult"
    • Changedget_techniques_mitigated_by_mitigation9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "EntityRef": {
        +    "description": "Minimal id/name reference to a group or mitigation.",
        +    "properties": {
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name"
        +    ],
        +    "title": "EntityRef",
        +    "type": "object"
        +  },
        +  "FormattedTechnique": {
        +    "description": "Token-optimized technique object emitted by format_technique.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "mitre_id": {
        +        "title": "Mitre Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "title": "FormattedTechnique",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_techniques_mitigated_by_mitigation result."
      • addedOutput schema / properties
        Added value: +{
        +  "mitigation": {
        +    "$ref": "#/$defs/EntityRef"
        +  },
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "techniques": {
        +    "items": {
        +      "$ref": "#/$defs/FormattedTechnique"
        +    },
        +    "title": "Techniques",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "mitigation",
        +  "techniques",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_techniques_mitigated_by_mitigationDictOutput"New value: +"MitigationTechniquesResult"
    • Changedget_techniques_used_by_group9 fields changed
      • addedInput schema / properties / domain / enum
        Added value: +[
        +  "enterprise-attack",
        +  "mobile-attack",
        +  "ics-attack"
        +]
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Limit"
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "title": "Offset",
        +  "type": "integer"
        +}
      • addedOutput schema / $defs
        Added value: +{
        +  "EntityRef": {
        +    "description": "Minimal id/name reference to a group or mitigation.",
        +    "properties": {
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      }
        +    },
        +    "required": [
        +      "id",
        +      "name"
        +    ],
        +    "title": "EntityRef",
        +    "type": "object"
        +  },
        +  "FormattedTechnique": {
        +    "description": "Token-optimized technique object emitted by format_technique.",
        +    "properties": {
        +      "description": {
        +        "title": "Description",
        +        "type": "string"
        +      },
        +      "id": {
        +        "title": "Id",
        +        "type": "string"
        +      },
        +      "mitre_id": {
        +        "title": "Mitre Id",
        +        "type": "string"
        +      },
        +      "name": {
        +        "title": "Name",
        +        "type": "string"
        +      },
        +      "type": {
        +        "title": "Type",
        +        "type": "string"
        +      }
        +    },
        +    "title": "FormattedTechnique",
        +    "type": "object"
        +  },
        +  "Pagination": {
        +    "description": "Pagination metadata returned alongside paged list results.",
        +    "properties": {
        +      "has_more": {
        +        "title": "Has More",
        +        "type": "boolean"
        +      },
        +      "limit": {
        +        "title": "Limit",
        +        "type": "integer"
        +      },
        +      "offset": {
        +        "title": "Offset",
        +        "type": "integer"
        +      },
        +      "total": {
        +        "title": "Total",
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "total",
        +      "offset",
        +      "limit",
        +      "has_more"
        +    ],
        +    "title": "Pagination",
        +    "type": "object"
        +  }
        +}
      • removedOutput schema / additionalProperties
        Removed value: -true
      • addedOutput schema / description
        Added value: +"get_techniques_used_by_group result."
      • addedOutput schema / properties
        Added value: +{
        +  "group": {
        +    "$ref": "#/$defs/EntityRef"
        +  },
        +  "pagination": {
        +    "$ref": "#/$defs/Pagination"
        +  },
        +  "techniques": {
        +    "items": {
        +      "$ref": "#/$defs/FormattedTechnique"
        +    },
        +    "title": "Techniques",
        +    "type": "array"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "group",
        +  "techniques",
        +  "pagination"
        +]
      • changedOutput schema / title
        Previous value: -"get_techniques_used_by_groupDictOutput"New value: +"GroupTechniquesResult"
  2. 9 tool updatesv0.3.1
    • First observedget_groups
    • First observedget_mitigations
    • First observedget_software
    • First observedget_tactics
    • First observedget_technique_by_id
    • First observedget_techniques
    • First observedget_techniques_by_tactic
    • First observedget_techniques_mitigated_by_mitigation
    • First observedget_techniques_used_by_group

TDQS

A4/5.0

Scored across 9 tools

Disambiguation5/5

Each tool targets a distinct ATT&CK entity or relationship, and the three technique-related tools are clearly differentiated by their parameters (all techniques, by tactic, by ID, used by group, mitigated by mitigation). There is no meaningful overlap or ambiguity between tool purposes.

Naming Consistency5/5

All tools consistently use the get_ prefix with entity names, and relationship queries follow a predictable get_techniques_by/used_by/mitigated_by pattern. This makes the tool surface easy to scan and understand.

Tool Count5/5

Nine tools is well-scoped for a read-only MITRE ATT&CK interface: five entity listing tools, one ID lookup, and three relationship queries. Each tool earns its place and no redundant tools are present.

Completeness4/5

The core ATT&CK entities and key relationships are covered, including techniques, tactics, groups, software, and mitigations. However, by-ID lookups exist only for techniques, and direct software-to-technique or group-to-software relationship queries are missing, so some workflows require pagination or chaining.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables querying the MITRE ATT\&CK framework for adversarial tactics, techniques, mitigations, and detection methods through natural language, supporting both ID-based and fuzzy name-based searches.
    3
    -
  • F
    license
    B
    quality
    D
    maintenance
    Provides comprehensive access to the MITRE ATT\&CK knowledge base with 50+ tools for querying threat actors, malware, and techniques, including automatic ATT\&CK Navigator layer generation for threat analysis and visualization.
    55
    44
    -
  • A
    license
    A
    quality
    D
    maintenance
    Enables AI-native access to the MITRE ATT\&CK framework, allowing LLMs and agents to query techniques, threat groups, software, and generate ATT\&CK Navigator layers for threat intelligence and security workflows.
    65
    42 npm
    5
    Apache 2.0