stig-mcp
Related Servers
Alternatives to stig-mcp
No user-submitted related servers found.
Related Servers
- AlicenseAqualityDmaintenanceEnables AI-native access to the MITRE ATT\&CK framework, allowing LLMs and agents to query techniques, threat groups, software, and generate ATT\&CK Navigator layers for threat intelligence and security workflows.6537 npm5Apache 2.0
- FlicenseNot gradedqualityFmaintenanceEnables querying the MITRE ATT\&CK framework for adversarial tactics, techniques, mitigations, and detection methods through natural language, supporting both ID-based and fuzzy name-based searches.3-
- AlicenseBqualityCmaintenanceEnables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.5MIT
- FlicenseNot gradedqualityBmaintenanceEnables searching and retrieving DISA STIG rules, listing benchmarks, and exporting STIG checklists.-
- FlicenseNot gradedqualityDmaintenanceProvides search, detail lookup, and gap listing tools for a security control inventory, enabling natural language queries about control status and gaps.-
- AlicenseNot gradedqualityBmaintenanceEnables querying MITRE ATT&CK STIX data, including adversary tactics, techniques, and procedures, via an MCP server connected to the Pipeworx gateway.11 npmMIT
TDQS
Scored across 9 tools
Most tools target distinct resources: resolve_system finds benchmarks, list_stigs enumerates them, finding_details and defense_details fetch text for specific ids, and install/check handle the knowledge base. The main overlap is between defenses_for_technique and techniques_for_actor, since the latter's include_defenses effectively re-runs the former's logic, and resolve_system vs list_stigs both deal with the benchmark catalog. The very detailed descriptions mitigate most of this, so an agent can usually pick correctly.
All names use snake_case consistently, with no casing chaos. The convention is only split between action-led names (resolve_system, list_stigs, search_techniques, check_sources, install_knowledge_base) and noun-phrase lookups (finding_details, defense_details, defenses_for_technique, techniques_for_actor), which reads a bit mixed but remains predictable and readable.
Nine tools is well within a healthy range and each appears to earn its place: a handful of query tools, two detail-fetch tools, and two knowledge-base lifecycle tools. Nothing feels redundant or thin.
The surface covers the full workflow: resolving systems, listing STIGs, fetching finding check/fix text, mapping techniques/actors to defenses and controls, fetching MITRE defense text, and installing/updating the knowledge base. A minor gap is a direct control-id lookup (controls are only reachable through technique/actor queries), but this is largely workable.