A
licenseA
qualityC
maintenanceComprehensive MITRE ATT\&CK MCP server with SOC integration for technique lookup, alert mapping, and coverage analysis.
26
24 npm
4
MIT
MITRE ATT&CK Mapper MCP
by CSOAI-ORG
This server enables querying, mapping, and analyzing cybersecurity threats using the MITRE ATT&CK framework. Key capabilities include:
query_technique: Look up detailed information about a specific ATT&CK technique by ID (e.g., T1059) or name.list_tactics: Retrieve all 14 enterprise tactics (TA0001–TA0040+) from the ATT&CK matrix.map_incident: Analyze incident IOCs or observed behaviors and map them to corresponding ATT&CK techniques.group_threat_actor: Identify threat actor groups (G-codes) associated with a specific technique.mitigation_lookup: Retrieve recommended mitigations (M-codes) for a given ATT&CK technique.
An optional api_key parameter unlocks Pro+ tier features such as signed attestations and unlimited usage.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MITRE ATT&CK Mapper MCP What is technique T1055?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Mitre Attack MCP
mcp-name: io.github.CSOAI-ORG/mitre-attack-mcp
MITRE ATT&CK Mapper MCP
⚖️ Built by MEOK AI Labs / CSOAI. Need this applied to your system fast? Book a 30-min Founder Office Hour (£29) → https://meok.ai/work · Full governance platform → https://meok.ai
Buy Starter — £29/mo
Signed attestations + unlimited audits + email support. 👉 Subscribe at meok.ai — instant HMAC signing key + Stripe-managed billing.
Free tier remains MIT-licensed and zero-config. Upgrade only when you need signed compliance artefacts for audit.
MITRE ATT&CK matrix lookup + tactic/technique mapper MCP
MITRE ATT&CK matrix lookup + tactic/technique mapper MCP. MIT
Related MCP server: mitre-mcp
🚀 Quick Start
# Install via pip
pip install mitre_attack_mcp
# Or install via Smithery
npx -y @smithery/cli@latest install mitre-attack-mcp --client claude✨ Features
MCP protocol compliant
Easy installation
Well-documented API
Production-ready
Active maintenance
📖 Documentation
🛡️ Compliance
This MCP server is built with EU AI Act compliance built-in:
Free: 10 calls/day. No API key required.
Pro £79/mo: unlimited + signed attestations. Subscribe
Enterprise £1,499/mo: white-label + on-premise + SLA. hello@meok.ai
✅ Article 9 — Risk Management System
✅ Article 13 — Transparency & Instructions for Use
✅ Article 15 — Bias Detection & Testing
✅ Article 26 — FRIA Support (where applicable)
✅ Article 50 — AI Content Watermarking (where applicable)
Need help getting compliant? Book a free 15-min diagnostic →
🏢 Enterprise
Need custom development, SLA guarantees, or white-label deployment?
Pro: $99/mo — Full MCP suite + EU AI Act tracking
Enterprise: $499/mo — Custom dev + SLA + Dedicated support
View Pricing → | Contact Sales →
🤝 Part of the MEOK Ecosystem
This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.
Domain | Purpose |
EU AI Act compliance marketplace | |
AI safety & monitoring | |
Sovereign AI platform | |
Legacy modernization |
📜 License
MIT © CSOAI-ORG
💸 Try MEOK in 30 seconds — instant buy ladder
Tier | Price | What you get | Stripe |
Smoke test | £1 | Signed sample MCP-Hardening report + Article 50 PDF | |
Quick Kit | £9 | EU AI Act Article 50 implementation guide (C2PA + EU-Icon) | |
Founder Call | £29 | 30-min 1-on-1 with the founder |
Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.
Configuration
Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:
{
"mcpServers": {
"mitre-attack-mcp": {
"command": "uvx",
"args": ["mitre-attack-mcp"]
}
}
}Or: pip install mitre-attack-mcp then run the mitre-attack-mcp command (stdio transport).
Examples
Once configured, ask your assistant, for example:
"Use
query_techniqueto …""Use
list_tacticsto …""Use
map_incidentto …"
Available Tools
5 toolsgroup_threat_actorC
Threat actor groups (G-codes) using a technique
Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features.
Returns: JSON with structured assessment, regulation refs, and recommended actions.
Inputs: query, api_key. Returns: result
list_tacticsA
All 14 enterprise tactics (TA0001-TA0040+)
Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features.
Returns: JSON with structured assessment, regulation refs, and recommended actions.
Inputs: query, api_key. Returns: result
map_incidentA
Map incident IOCs/behaviors to ATT&CK techniques
Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features.
Returns: JSON with structured assessment, regulation refs, and recommended actions.
Inputs: query, api_key. Returns: result
mitigation_lookupC
Mitigations (M-codes) for a technique
Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features.
Returns: JSON with structured assessment, regulation refs, and recommended actions.
Inputs: query, api_key. Returns: result
query_techniqueB
Query ATT&CK technique by ID (Txxxx) or name
Args: query: Optional query parameter (regulation ref, identifier, or input data). api_key: Optional MEOK API key for Pro+ tier features.
Returns: JSON with structured assessment, regulation refs, and recommended actions.
Inputs: query, api_key. Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
B3/5.0
Scored across 5 tools
Disambiguation4/5
Each tool targets a distinct ATT&CK resource (tactics, techniques, groups, mitigations, incident mapping), but the generic return descriptions could cause an agent to misselect if relying solely on descriptions.
Naming Consistency4/5
Tool names follow a verb_noun pattern in snake_case, but 'group_threat_actor' uses 'group' as an atypical verb, slightly deviating from the clearer verbs like list, map, lookup, query.
Tool Count4/5
5 tools is a reasonable count for a focused ATT&CK mapper, covering key operations, though there is room for a few more (e.g., listing techniques, sub-techniques) without being overbearing.
Completeness3/5
Core workflows like technique lookup, tactic listing, and incident mapping are covered, but missing obvious operations like listing all techniques, threat groups independently, or software, leaving notable gaps.
Maintenance
ActivityInactive
ResponsivenessNo recent community issues
Related MCP Connectors
Query and retrieve information about various adversarial tactics and techniques used in cyber atta…
MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Free, read-only public-source threat intel over MCP. No account or API key.
Related MCP Servers
- AlicenseAqualityAmaintenanceExposes the MITRE ATT\&CK framework to LLMs and AI assistants via the Model Context Protocol, enabling querying of techniques, tactics, groups, software, and mitigations.915MIT
- AlicenseAqualityFmaintenanceEnables querying British cybersecurity data, including regulations, decisions, and requirements from the NCSC, directly from any MCP-compatible client.81Apache 2.0
- AlicenseAqualityFmaintenanceEnables querying Swiss cybersecurity regulations, guidance, advisories, and frameworks from NCSC.ch via any MCP-compatible client.6Apache 2.0