mitre-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MITRE_ICS_URL | No | Override ATT&CK bundle locations or point to internal mirror for ICS domain | |
| MITRE_DATA_DIR | No | Store cached bundles in custom directory | mitre_mcp/data |
| MITRE_LOG_LEVEL | No | Logging verbosity (DEBUG, INFO, WARNING, etc.) | INFO |
| MITRE_MOBILE_URL | No | Override ATT&CK bundle locations or point to internal mirror for Mobile domain | |
| MITRE_CORS_ORIGINS | No | CORS allowed origins for HTTP mode (* = all, or comma-separated list of domains) | * |
| MITRE_MAX_PAGE_SIZE | No | Maximum records returned by list tools | 1000 |
| MITRE_ENTERPRISE_URL | No | Override ATT&CK bundle locations or point to internal mirror for Enterprise domain | |
| MITRE_MAX_DESC_LENGTH | No | Trimmed description length in responses | 500 |
| MITRE_DOWNLOAD_TIMEOUT | No | HTTP timeout in seconds for bundle downloads | 30 |
| MITRE_CACHE_EXPIRY_DAYS | No | Maximum age before cached data is refreshed | 1 |
| MITRE_DEFAULT_PAGE_SIZE | No | Default records returned by list tools | 20 |
| MITRE_REQUIRED_SPACE_MB | No | Disk space threshold checked before downloading | 200 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_techniquesA | Get techniques from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) include_subtechniques: Include subtechniques in the result remove_revoked_deprecated: Remove revoked or deprecated objects include_descriptions: Whether to include technique descriptions (uses more tokens) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing a list of techniques and pagination metadata |
| get_tacticsB | Get tactics from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of tactics to return (default: 20) offset: Index to start from when returning tactics (for pagination) Returns: Dictionary containing a list of tactics and pagination metadata |
| get_groupsA | Get groups from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of groups to return (default: 20) offset: Index to start from when returning groups (for pagination) Returns: Dictionary containing a list of groups and pagination metadata |
| get_softwareA | Get software from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects software_types: Optional list of ATT&CK object types to include (e.g., ["malware"]) limit: Maximum number of software to return (default: 20) offset: Index to start from when returning software (for pagination) Returns: Dictionary containing a list of software and pagination metadata |
| get_techniques_by_tacticA | Get techniques by tactic. Args: ctx: FastMCP request context (injected by the server) tactic_shortname: The shortname of the tactic (e.g., 'defense-evasion') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing a list of techniques and pagination metadata |
| get_techniques_used_by_groupA | Get techniques used by a group. Args: ctx: FastMCP request context (injected by the server) group_name: The name of the group domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing the group, a list of techniques and pagination metadata |
| get_mitigationsA | Get mitigations from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of mitigations to return (default: 20) offset: Index to start from when returning mitigations (for pagination) Returns: Dictionary containing a list of mitigations and pagination metadata |
| get_techniques_mitigated_by_mitigationB | Get techniques mitigated by a mitigation. Args: ctx: FastMCP request context (injected by the server) mitigation_name: The name of the mitigation domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing the mitigation, a list of techniques and pagination metadata |
| get_technique_by_idA | Get a technique by its MITRE ATT&CK ID. Args: ctx: FastMCP request context (injected by the server) technique_id: The MITRE ATT&CK ID of the technique (e.g., 'T1055') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) Returns: Dictionary containing the technique |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| get_server_info | Get information about the MITRE ATT&CK MCP server. |
TDQS
Scored across 9 tools
Each tool targets a distinct ATT&CK entity or relationship, and the three technique-related tools are clearly differentiated by their parameters (all techniques, by tactic, by ID, used by group, mitigated by mitigation). There is no meaningful overlap or ambiguity between tool purposes.
All tools consistently use the get_ prefix with entity names, and relationship queries follow a predictable get_techniques_by/used_by/mitigated_by pattern. This makes the tool surface easy to scan and understand.
Nine tools is well-scoped for a read-only MITRE ATT&CK interface: five entity listing tools, one ID lookup, and three relationship queries. Each tool earns its place and no redundant tools are present.
The core ATT&CK entities and key relationships are covered, including techniques, tactics, groups, software, and mitigations. However, by-ID lookups exist only for techniques, and direct software-to-technique or group-to-software relationship queries are missing, so some workflows require pagination or chaining.