What can you do with this server?

The mitre-mcp server provides structured access to the MITRE ATT&CK knowledge base and integrates with SOC tools for real-time threat intelligence, detection coverage analysis, and cross-platform correlation. Core ATT&CK Lookups * Techniques: Look up by ID (e.g., T1059.001), keyword, tactic, platform, or data source * Tactics: List all tactics in kill-chain order or get details and associated techniques * Threat Groups: Search known APTs by name, keyword, or technique usage * Software & Malware: Look up tools/malware (e.g., Cobalt Strike) by name, technique, or type * Mitigations: Get mitigations for specific techniques or search by keyword * Data Sources: Get details on data sources and what techniques they detect * Campaigns: List, search, and get details including attributed groups and techniques Threat Analysis & Modeling * Alert Mapping: Map security alerts/observables to likely ATT&CK techniques with confidence scoring * Detection Coverage Analysis: Analyze detectable techniques based on your available data sources * Attack Path Generation: Generate possible kill-chain paths from a starting technique toward a target tactic * Technique Overlap / Attribution: Find technique overlap between threat groups to assist with attribution * Campaign Profiling: Match observed techniques against known groups, software, and campaigns Visualization & Export * Generate ATT&CK Navigator layer JSON for coverage heatmaps, group overlays, campaign views, custom highlighting, and group-vs-group diffs SOC Integration & Cross-Stack Correlation * Integrate with Wazuh, TheHive, Cortex, and MISP to map live alerts to techniques, enrich cases, run analyzers, and correlate indicators * Cross-correlate ATT&CK techniques simultaneously across Wazuh, TheHive, and MISP to find related activity across your entire SOC stack * Check connection status for all configured SOC integrations * Write-safe by default: state-changing operations use dry-run mode requiring explicit confirmation Data Management * Check the current ATT&CK data version, freshness, and object counts * Force a cache refresh to re-download the latest ATT&CK STIX bundle * Configure desired ATT&CK matrices (Enterprise, Mobile, ICS) and data update intervals

How do I use mitre-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mitre-mcp map these alerts to ATT&CK techniques" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mitre-mcp

by lidless-labs

Overview Schema Related Servers Score Discussions

TypeScript

Remote

The mitre-mcp server provides structured access to the MITRE ATT&CK knowledge base and integrates with SOC tools for real-time threat intelligence, detection coverage analysis, and cross-platform correlation.

Core ATT&CK Lookups

Techniques: Look up by ID (e.g., T1059.001), keyword, tactic, platform, or data source
Tactics: List all tactics in kill-chain order or get details and associated techniques
Threat Groups: Search known APTs by name, keyword, or technique usage
Software & Malware: Look up tools/malware (e.g., Cobalt Strike) by name, technique, or type
Mitigations: Get mitigations for specific techniques or search by keyword
Data Sources: Get details on data sources and what techniques they detect
Campaigns: List, search, and get details including attributed groups and techniques

Threat Analysis & Modeling

Alert Mapping: Map security alerts/observables to likely ATT&CK techniques with confidence scoring
Detection Coverage Analysis: Analyze detectable techniques based on your available data sources
Attack Path Generation: Generate possible kill-chain paths from a starting technique toward a target tactic
Technique Overlap / Attribution: Find technique overlap between threat groups to assist with attribution
Campaign Profiling: Match observed techniques against known groups, software, and campaigns

Visualization & Export

Generate ATT&CK Navigator layer JSON for coverage heatmaps, group overlays, campaign views, custom highlighting, and group-vs-group diffs

SOC Integration & Cross-Stack Correlation

Integrate with Wazuh, TheHive, Cortex, and MISP to map live alerts to techniques, enrich cases, run analyzers, and correlate indicators
Cross-correlate ATT&CK techniques simultaneously across Wazuh, TheHive, and MISP to find related activity across your entire SOC stack
Check connection status for all configured SOC integrations
Write-safe by default: state-changing operations use dry-run mode requiring explicit confirmation

Data Management

Check the current ATT&CK data version, freshness, and object counts
Force a cache refresh to re-download the latest ATT&CK STIX bundle
Configure desired ATT&CK matrices (Enterprise, Mobile, ICS) and data update intervals

mitre-mcp is an MCP server for the MITRE ATT&CK knowledge base. It exists because asking an LLM about adversary techniques from memory gives you stale, hallucinated technique IDs, while a SOC analyst needs the real, versioned ATT&CK data and the alerts in front of them. Unlike a plain ATT&CK lookup tool, mitre-mcp ships ATT&CK querying and live SOC integration (Wazuh, TheHive, Cortex, MISP) in the same server, so an agent can map a real alert to a technique and correlate it across your stack without leaving the chat.

What it does

mitre-mcp gives an AI client structured, offline-capable access to MITRE ATT&CK: techniques, tactics, threat groups, software, mitigations, data sources, and campaigns, sourced from the official MITRE STIX 2.1 bundles and cached locally. On top of that knowledge base it adds threat-modeling and SOC workflow tools: it maps security alerts to likely ATT&CK techniques, analyzes detection coverage against your available data sources, profiles campaigns and attributes them to groups, and exports ATT&CK Navigator layer JSON for heatmaps and group overlays.

It also connects to a running SOC stack. Optional integrations for Wazuh, TheHive, Cortex, and MISP let an agent map live Wazuh alerts to techniques, enrich and open TheHive cases with ATT&CK context, map Cortex analyzers to data sources, pull ATT&CK out of MISP galaxies, and cross-correlate one set of techniques across all of them at once. SOC integrations are entirely optional: with no credentials configured, mitre-mcp is a pure read-only ATT&CK server. Keywords for the curious: MITRE ATT&CK, MCP server, threat intelligence, threat modeling, detection coverage, ATT&CK Navigator, Wazuh, TheHive, Cortex, MISP, STIX 2.1, SOC.

Related MCP server: wrg-mcp-server

Quickstart

mitre-mcp is published on npm and runs with no install via npx. The fastest path is to register it with your MCP client.

Claude Code

claude mcp add mitre-attack --env MITRE_MATRICES=enterprise -- npx -y mitre-mcp

Add --scope user to make it available from any directory. Add --env flags for any SOC integrations you want to enable.

Claude Desktop

Add this to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows). This is the minimal, ATT&CK-only configuration:

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-mcp"],
      "env": {
        "MITRE_MATRICES": "enterprise"
      }
    }
  }
}

To enable the optional SOC integrations, add the relevant environment variables. Example hosts below use the RFC 5737 documentation address 192.0.2.10; replace them with your own:

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-mcp"],
      "env": {
        "MITRE_MATRICES": "enterprise",
        "WAZUH_URL": "https://192.0.2.10:55000",
        "WAZUH_USERNAME": "wazuh-wui",
        "WAZUH_PASSWORD": "your-password",
        "THEHIVE_URL": "http://192.0.2.10:9000",
        "THEHIVE_API_KEY": "your-api-key",
        "CORTEX_URL": "http://192.0.2.10:9001",
        "CORTEX_API_KEY": "your-api-key",
        "MISP_URL": "https://192.0.2.10",
        "MISP_API_KEY": "your-api-key"
      }
    }
  }
}

The first run downloads the ATT&CK STIX bundles and caches them under ~/.mitre-mcp/data; subsequent runs are offline until the next refresh.

From source

git clone https://github.com/lidless-labs/mitre-mcp.git
cd mitre-mcp
npm install
npm run build
npm test          # optional: run the test suite

Other clients (OpenClaw, Hermes, Codex CLI) are covered under Other MCP clients.

Tools

mitre-mcp registers 39 tools, 3 resources, and 4 prompts. The 19 core ATT&CK tools work with no configuration; the 18 SOC tools require the matching integration to be configured (the 2 cross-stack tools degrade gracefully to whatever is connected).

Core ATT&CK tools (19)

Tool	Description
`mitre_get_technique`	Get full details of a technique by ID (T1059, T1059.001)
`mitre_search_techniques`	Search techniques by keyword, tactic, platform, data source
`mitre_list_tactics`	List all tactics in kill-chain order
`mitre_get_tactic`	Get tactic details with all associated techniques
`mitre_get_group`	Get group details including techniques and software used
`mitre_search_groups`	Search groups by keyword or technique usage
`mitre_list_groups`	List all known threat groups
`mitre_get_software`	Get software details with techniques and associated groups
`mitre_search_software`	Search software by name, technique, or type (malware/tool)
`mitre_get_mitigation`	Get mitigation details with addressed techniques
`mitre_mitigations_for_technique`	Get all mitigations for a specific technique
`mitre_search_mitigations`	Search mitigations by keyword
`mitre_get_datasource`	Get data source details with detectable techniques
`mitre_detection_coverage`	Analyze detection coverage based on available data sources
`mitre_map_alert_to_technique`	Map security alerts to likely ATT&CK techniques
`mitre_technique_overlap`	Find technique overlap between groups for attribution
`mitre_attack_path`	Generate possible attack paths through the kill chain
`mitre_update_data`	Force update of the local ATT&CK data cache
`mitre_data_version`	Get current data version and object counts

Campaign tools (4)

Tool	Description
`mitre_campaign_profile`	Build a technique profile with group/software/campaign matching
`mitre_get_campaign`	Get campaign details with techniques, software, and groups
`mitre_list_campaigns`	List all known ATT&CK campaigns
`mitre_search_campaigns`	Search campaigns by keyword or technique

Navigator layer export (1)

Tool	Description
`mitre_navigator_layer`	Generate ATT&CK Navigator JSON layers (coverage, group, campaign, diff)

Wazuh integration (4)

Tool	Description
`mitre_wazuh_status`	Wazuh manager status, agents, and rule stats
`mitre_map_wazuh_alert`	Map Wazuh alerts to ATT&CK techniques by rule ID/description/groups
`mitre_wazuh_rule_coverage`	Analyze Wazuh rules mapped to ATT&CK techniques
`mitre_wazuh_alerts`	Fetch recent alerts enriched with ATT&CK context

TheHive integration (3)

Tool	Description
`mitre_thehive_enrich`	Enrich a TheHive case with ATT&CK techniques and mitigations
`mitre_thehive_create_case`	Create a case pre-populated with ATT&CK context (write-gated)
`mitre_thehive_list_cases`	List cases with ATT&CK technique filtering

Cortex integration (2)

Tool	Description
`mitre_cortex_analyzer_coverage`	Map Cortex analyzers to ATT&CK data sources
`mitre_cortex_run_analyzers`	Run analyzers on observables with ATT&CK context (write-gated)

MISP integration (4)

Tool	Description
`mitre_misp_event_to_attack`	Map MISP event attributes/galaxies to ATT&CK
`mitre_misp_search_indicators`	Search MISP IOCs by technique or group
`mitre_misp_create_event`	Create events pre-tagged with ATT&CK techniques (write-gated)
`mitre_misp_list_events`	List events with ATT&CK enrichment

Cross-stack correlation (2)

Tool	Description
`mitre_soc_status`	Connection status for all SOC integrations
`mitre_cross_correlate`	Search for techniques across Wazuh, TheHive, and MISP simultaneously

Resources

URI	Description
`mitre://matrix/enterprise`	Full Enterprise ATT&CK matrix (tactics x techniques)
`mitre://version`	Current data version and statistics
`mitre://tactics`	All tactics in kill-chain order

Prompts

Prompt	Description
`map-incident-to-attack`	Map incident observables to ATT&CK techniques
`threat-hunt-plan`	Generate a threat hunting plan
`gap-analysis`	Perform detection gap analysis
`attribution-analysis`	Assist with threat attribution

Configuration

Core settings

Variable	Default	Description
`MITRE_DATA_DIR`	`~/.mitre-mcp/data`	Local cache directory for STIX bundles
`MITRE_MATRICES`	`enterprise`	Comma-separated matrices: `enterprise`, `mobile`, `ics`
`MITRE_UPDATE_INTERVAL`	`86400`	Auto-update check interval in seconds (default 24h)

SOC integration (all optional)

Variable	Description
`WAZUH_URL`	Wazuh API URL (e.g. `https://192.0.2.10:55000`)
`WAZUH_USERNAME`	Wazuh API username (default: `wazuh-wui`)
`WAZUH_PASSWORD`	Wazuh API password
`WAZUH_VERIFY_SSL`	Verify SSL certs (default: `true`, set `false` for self-signed)
`THEHIVE_URL`	TheHive URL (e.g. `http://192.0.2.10:9000`)
`THEHIVE_API_KEY`	TheHive API key
`CORTEX_URL`	Cortex URL (e.g. `http://192.0.2.10:9001`)
`CORTEX_API_KEY`	Cortex API key
`MISP_URL`	MISP URL (e.g. `https://192.0.2.10`)
`MISP_API_KEY`	MISP API key (authkey)
`MISP_VERIFY_SSL`	Verify SSL certs (default: `true`, set `false` for self-signed)
`MITRE_SOC_ALLOW_WRITES`	Globally pre-authorize state-changing SOC tools (default: off). When unset, write tools run in dry-run mode unless the call passes `confirm: true`. Set to `true`/`1`/`yes` to allow writes without per-call confirmation.

SOC write safety

State-changing SOC tools (mitre_misp_create_event, mitre_thehive_create_case, and mitre_cortex_run_analyzers) default to a dry run: they return the action they would perform without touching the SOC platform. To actually execute, either:

pass confirm: true in the individual tool call, or
set MITRE_SOC_ALLOW_WRITES=true to pre-authorize all SOC writes for the session.

mitre_cortex_run_analyzers is the highest-impact tool (it submits live analyzer jobs, including sandbox detonation, against the supplied observable), so confirm it deliberately. mitre_thehive_enrich keeps its existing addTags flag (default false, read-only analysis) as its write guard.

When SSL verification is disabled (*_VERIFY_SSL=false), the relaxed TLS policy is scoped to each individual request and never disables certificate validation globally, so concurrent requests to other hosts remain protected. IDs supplied to SOC tools (event IDs, case IDs, agent IDs, data types) are validated against a strict allow-list and URL-encoded before being placed in API request paths.

CLI

The same package ships a read-only search tool, attack, for shells, cron, and CI. It shares the local ATT&CK data core with the MCP server, so what the agent can look up, you can look up from a terminal. It exposes only read/lookup operations; data refresh and SOC correlation stay in the MCP server.

npx mitre-mcp@latest stats
# or, installed globally:
attack technique T1059          # one technique by ATT&CK id
attack group APT29              # threat actor by id or name
attack tactics                  # list all tactics
attack search "powershell"      # search techniques (--type group|software|mitigation|campaign)
attack mitigations-for T1059    # mitigations mapped to a technique
attack software Cobalt Strike
attack stats                    # ATT&CK data counts + version
attack technique T1059 --json   # raw JSON for piping

Run attack help for the full command list. --json emits raw JSON instead of the concise summary. Exit codes: 0 success, 1 runtime error (data not loaded, or a lookup found nothing), 2 usage error (unknown command/flag or missing argument).

Starting the MCP server

attack mcp (or the back-compat mitre-mcp bin) starts the stdio MCP server. If a launcher referenced the file path dist/index.js directly, point it at dist/mcp-bin.js (or dist/cli.js mcp); launchers that use the mitre-mcp bin name need no change.

Examples

Ask your agent in natural language; it picks the tool. A few that work out of the box:

Look up T1059.001 and list the mitigations for it.

Generate an ATT&CK Navigator coverage layer for the data sources
Process, Network Traffic, and File so I can see my detection gaps.

Compare APT28 (G0007) and APT29 (G0016) as a Navigator diff layer.

With a SOC stack connected:

Map Wazuh rule 5710 with groups ["sshd", "authentication_failed"]
to ATT&CK techniques, then cross-correlate those techniques across
Wazuh, TheHive, and MISP.

Other MCP clients

OpenClaw

With the global npm install:

openclaw mcp set mitre-attack '{
  "command": "npx",
  "args": ["-y", "mitre-mcp"],
  "env": { "MITRE_MATRICES": "enterprise" }
}'

Or from a source checkout, point at the built dist/index.js:

openclaw mcp set mitre-attack '{
  "command": "node",
  "args": ["/absolute/path/to/mitre-mcp/dist/index.js"],
  "env": { "MITRE_MATRICES": "enterprise" }
}'

Then restart the gateway so the server is picked up:

systemctl --user restart openclaw-gateway
openclaw mcp list   # confirm "mitre-attack" is registered

Hermes Agent

Hermes Agent reads MCP config from ~/.hermes/config.yaml under the mcp_servers key:

mcp_servers:
  mitre-attack:
    command: "npx"
    args: ["-y", "mitre-mcp"]
    env:
      MITRE_MATRICES: "enterprise"

Then reload MCP from inside a Hermes session with /reload-mcp.

Codex CLI

Codex CLI registers MCP servers via codex mcp add:

codex mcp add mitre-attack --env MITRE_MATRICES=enterprise -- npx -y mitre-mcp

Codex writes the entry to ~/.codex/config.toml under [mcp_servers.mitre-attack]. Verify with codex mcp list.

Prerequisites

Node.js 20 or later
Internet access for the initial ATT&CK data download (cached locally after the first run)
(Optional) Wazuh, TheHive, Cortex, and/or MISP instances for SOC integration

Project structure

mitre-mcp/
  src/
    index.ts              # MCP server entry point
    config.ts             # Environment config (core + SOC)
    types.ts              # STIX/ATT&CK type definitions
    resources.ts          # MCP resources
    prompts.ts            # MCP prompts
    data/                 # STIX downloader, parser, and indexed store
    tools/                # Core ATT&CK tool registrations
    soc/                  # Wazuh, TheHive, Cortex, MISP clients + correlation
  tests/                  # Parser, query, mapping, and SOC security tests

Data sources

ATT&CK data is sourced from the official MITRE STIX 2.1 bundles:

Enterprise ATT&CK: Windows, Linux, macOS, Cloud, Network, Containers
Mobile ATT&CK: Android and iOS
ICS ATT&CK: Industrial control systems

Data is downloaded on first run and cached locally. Set MITRE_UPDATE_INTERVAL to control how often the server checks for updates.

Why not something else?

A plain "ask the LLM about ATT&CK" prompt gives you confident, made-up technique IDs and last year's data. mitre-mcp serves the real, versioned STIX bundles MITRE publishes, cached locally and refreshable, so the technique IDs and relationships are correct.
A generic ATT&CK API wrapper or the official mitreattack-python library is a great data layer, but it stops at the data. mitre-mcp speaks MCP so any agent can call it, and it carries the analysis tools (alert mapping, coverage analysis, Navigator export, attribution) and the SOC integrations on top.
Per-tool SOC plugins (a Wazuh MCP here, a MISP MCP there) leave you wiring four servers and four mental models. mitre-mcp puts Wazuh, TheHive, Cortex, and MISP behind one ATT&CK-centric server with one correlation tool that spans all of them.
A hosted threat-intel SaaS sends your alerts to someone else's cloud. mitre-mcp runs on your machine, talks only to the SOC hosts you configure, and ships nothing to a third party.

What mitre-mcp is not

It is not a SIEM or a replacement for Wazuh, TheHive, Cortex, or MISP. It reads from and writes to them through their APIs; it does not store or index your events.
It is not an autonomous responder. State-changing SOC tools dry-run by default and require explicit confirm: true or MITRE_SOC_ALLOW_WRITES=true before they touch a platform.
It is not a hosted service or a daemon. It is a stdio MCP server your client launches on demand.
It does not maintain the ATT&CK data itself. The knowledge base is MITRE's; mitre-mcp downloads, parses, caches, and serves it.
It is not a curated CTI feed. It serves what MITRE publishes plus what your own SOC platforms contain.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md for the contribution path and SECURITY.md to report a vulnerability privately. By participating you agree to the Code of Conduct.

License

MIT

Available Tools

26 tools

mitre_attack_pathC

Generate possible attack paths through the kill chain starting from a technique

ParametersJSON Schema

Name	Required	Description	Default
`targetTactic`	No	Target tactic to reach (e.g., exfiltration)
`startTechnique`	Yes	Starting technique ID

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description bears full burden. It only states the basic action without disclosing any behavioral traits (e.g., output format, limitations, side effects).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, concise. Uses jargon ('kill chain') without explanation, but still communicates core function efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description should clarify what a 'possible attack path' includes and how results are presented. Lacks completeness for a generative tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters. Description adds no additional meaning beyond what schema already provides. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States it generates possible attack paths through the kill chain starting from a technique. This is specific about verb and resource, but doesn't explicitly distinguish from siblings like 'mitre_technique_overlap'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No conditions, prerequisites, or exclusions mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_campaign_profileB

Build a technique profile from observed techniques for campaign analysis and attribution

ParametersJSON Schema

Name	Required	Description	Default
`techniques`	Yes	List of observed technique IDs (e.g., ['T1059.001', 'T1053.005'])

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose whether the tool is read-only, destructive, or requires specific permissions. The verb 'Build' could imply creation, but typical MITRE tools are query-based, leading to ambiguity. No side effects or rate limits are mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that immediately conveys the tool's purpose. It avoids unnecessary detail, but the brevity sacrifices usage guidance and behavioral context, which are needed for a complete understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should describe what a 'technique profile' includes (e.g., counts, related campaigns, attribution scores). It does not, leaving the agent uncertain about the output. Sibling tools are numerous, and the description does not help differentiate. The tool is simple, but the description is incomplete for effective selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the 'techniques' parameter including an example format. The description adds minimal value beyond the schema by repeating 'from observed techniques'. Baseline 3 is appropriate as the schema already documents the parameter adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Build' and the resource 'technique profile from observed techniques' with a specific purpose 'for campaign analysis and attribution'. It distinguishes itself from sibling tools like mitre_get_campaign and mitre_search_campaigns by focusing on building a profile from a list of techniques rather than retrieving individual campaign details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for campaign analysis but provides no explicit guidance on when to use this tool versus alternatives such as mitre_cross_correlate or mitre_technique_overlap. No exclusions or when-not-to-use scenarios are mentioned, leaving the agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_cross_correlateB

Cross-correlate ATT&CK techniques across Wazuh alerts, TheHive cases, and MISP events to find related activity

ParametersJSON Schema

Name	Required	Description	Default
`techniques`	Yes	ATT&CK technique IDs to search across all platforms

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden. It does not disclose whether the tool modifies data (read-only vs write), requires special permissions, or what constitutes 'related activity'. The output format is also not hinted at, leaving critical behavioral traits unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise and front-loaded, with no wasted words. However, it lacks a period at the end (minor). Structure is adequate for a straightforward tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a cross-platform correlation tool, the description is too minimal. No output schema exists, and the description does not explain what 'related activity' means or how results are presented. Agents need more context to interpret correlation outcomes correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and already describes the single parameter as 'ATT&CK technique IDs to search across all platforms'. The description adds no additional meaning beyond this, meeting the baseline expectation for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly specifies the verb 'cross-correlate' and the resource 'ATT&CK techniques' across three distinct platforms (Wazuh, TheHive, MISP), which distinguishes it from siblings like mitre_map_alert_to_technique (single-platform mapping) or mitre_technique_overlap (overlap analysis).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives. Does not mention prerequisites (e.g., existing data in those platforms), nor when not to use it. Siblings like mitre_map_alert_to_technique or mitre_search_techniques could be better suited for single-platform tasks, but this is not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_data_versionA

Get current ATT&CK data version, freshness, and object counts

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It clearly states it returns version, freshness, and object counts, implying a read-only operation. No contradictions, and it adds value beyond the empty schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that is concise and front-loaded with the key purpose. Every word adds value, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description is complete. It explains what the tool does and what it returns. For a simple status tool, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so baseline is 4. The description adds meaning by specifying the type of data returned (version, freshness, object counts), which is useful for an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool gets current ATT&CK data version, freshness, and object counts. It is specific and distinguishes itself from siblings which focus on attack paths, campaigns, techniques, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when or when not to use this tool versus alternatives. However, as a parameterless version/info tool, its usage is implied for checking data freshness before other MITRE operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_detection_coverageB

Analyze detection coverage based on available data sources in your environment

ParametersJSON Schema

Name	Required	Description	Default
`availableDataSources`	Yes	List of data source names you collect (e.g., ['Process', 'Network Traffic', 'File'])

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description does not mention whether the tool is read-only, destructive, or any side effects. The behavioral profile is undefined, leaving the agent uncertain about consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no unnecessary words. Efficiently conveys purpose without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and description omits what the analysis returns (e.g., list of techniques, coverage scores). Lacks sufficient context for the agent to understand the tool's full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already describes the single parameter with 100% coverage. Description adds minor context ('in your environment', 'you collect') but does not significantly enhance meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool analyzes detection coverage based on data sources. It distinguishes itself from sibling tools like mitre_soc_status or mitre_technique_overlap by focusing on data source inputs, though it does not explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implied usage when a user wants detection coverage analysis from specific data sources, but no explicit guidance on when to use this tool versus alternatives like mitre_technique_overlap or mitre_soc_status.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_campaignB

Get details on a known ATT&CK campaign including techniques, software, and attributed groups

ParametersJSON Schema

Name	Required	Description	Default
`name`	No	Campaign name
`campaignId`	No	Campaign ID (e.g., "C0001")

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behavior. It states what is included but does not specify read-only nature, error handling, authentication needs, or rate limits. Minimal behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no unnecessary words. However, it could be more structured (e.g., listing details in bullet points). Efficient but lacks formatting.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with no output schema, the description provides enough context about returned content (techniques, software, groups). Lacks details on error conditions or required permissions, making it adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters described. Description adds no additional meaning beyond the schema; it only lists the type of details returned. Baseline 3 is appropriate as the schema already documents parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it retrieves details for an ATT&CK campaign including techniques, software, and attributed groups. This distinguishes it from sibling tools like mitre_list_campaigns (list all) and mitre_search_campaigns (search/filter).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like mitre_campaign_profile or mitre_search_campaigns. Does not mention prerequisites or when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_datasourceC

Get details on a data source and its components with detectable techniques

ParametersJSON Schema

Name	Required	Description	Default
`name`	No	Data source name (e.g., "Process")
`dataSourceId`	No	Data source ID (e.g., "DS0009")

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full responsibility for behavioral disclosure. It only implies a read operation ('Get details') but does not mention limitations, side effects, or what exactly is returned. Minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at one sentence with no waste. However, it could benefit from slightly more detail without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should clarify return values. 'Details on a data source and its components' is vague and does not cover what fields are returned. Insufficient for a complex MITRE entity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters described. The description adds no additional meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves details on a data source and its components, specifying the resource and scope. It distinguishes from siblings like mitre_get_technique by focusing on data sources, but lacks explicit differentiation from other 'get' tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not specify when to use this tool versus alternatives like mitre_get_technique or mitre_get_tactic, nor does it mention any prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_groupA

Get details on a known threat group/APT including techniques and software used

ParametersJSON Schema

Name	Required	Description	Default
`name`	No	Group name or alias (e.g., "APT28")
`groupId`	No	Group ID (e.g., "G0016")

TDQS

A3.5/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only states a read operation ('get details') without mentioning permissions, rate limits, or whether data is cached/historical. Minimal behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, front-loaded sentence with no wasted words. Efficiently conveys the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with no output schema, the description indicates output includes techniques and software, but lacks detail on required parameters (at least one needed) and full output scope (e.g., references, aliases). Adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with parameters already described. The description adds context about the output (techniques and software) but does not enhance parameter meanings beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get details on a known threat group/APT including techniques and software used', specifying both the action and the resource, and distinguishes it from siblings like mitre_get_campaign or mitre_get_software.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives like mitre_search_groups or mitre_list_groups. Usage is implied but not clarified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_mitigationB

Get details on a mitigation and all techniques it addresses

ParametersJSON Schema

Name	Required	Description	Default
`mitigationId`	Yes	Mitigation ID (e.g., "M1036")

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It only states the tool gets details and techniques, but does not disclose what 'details' includes, any authentication needs, rate limits, or side effects. Minimal behavioral info.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that conveys the core purpose without any unnecessary words. It is front-loaded and concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple lookup tool with one parameter and no output schema, the description is minimally adequate. It mentions the output includes techniques, but lacks details on the full return structure. Could be improved but is not severely incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with the parameter 'mitigationId' documented. The description does not add additional meaning beyond the schema. Baseline 3 is appropriate since it adds no extra value for parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (Get), the resource (mitigation), and the scope (details and all techniques it addresses). It distinguishes from siblings like mitre_mitigations_for_technique which does the reverse, and mitre_search_mitigations which searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like mitre_mitigations_for_technique or mitre_search_mitigations. No when-to-use or when-not-to-use information is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_softwareA

Get details on a known software, malware, or tool including techniques and associated groups

ParametersJSON Schema

Name	Required	Description	Default
`name`	No	Software name (e.g., "Cobalt Strike")
`softwareId`	No	Software ID (e.g., "S0154")

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description indicates a read operation but lacks details on side effects (none expected), prerequisites, or rate limits. Adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 12 words, front-loaded with action and resource. No redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description hints at return value contents (techniques, groups). Sufficient for a simple query tool among siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with examples. Description adds context that output includes techniques and groups, supplementing schema. Baseline 3 + extra value = 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'Get details on' and resource 'known software, malware, or tool', specifying exact information (techniques, associated groups). It distinguishes from siblings like mitre_get_group or mitre_get_technique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternatives. Implied for retrieving software details, but no guidance on when to use mitre_search_software instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_tacticB

Get details and all techniques under a specific tactic

ParametersJSON Schema

Name	Required	Description	Default
`tacticId`	Yes	Tactic ID (e.g., "TA0001") or short name (e.g., "initial-access")

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It implies a read operation ('get') but does not explicitly state read-only or disclose any behavioral traits like whether it returns aggregated data. Adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, concise sentence with verb first. No wasted words. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description adequately covers what the tool does. It could mention the return format (e.g., tactic object with techniques list) but is not essential.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the parameter description in the schema already explains the input. The description does not add extra meaning beyond 'get details and all techniques', which is already implied by the tool name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'tactic' with the specific scope of including 'details and all techniques under'. It distinguishes from siblings like mitre_get_technique but could be more explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like mitre_get_technique or mitre_list_tactics. It does not provide context for when to choose this over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_get_techniqueA

Get full details of a specific ATT&CK technique by its ID (e.g., T1059, T1059.001)

ParametersJSON Schema

Name	Required	Description	Default
`techniqueId`	Yes	ATT&CK technique ID (e.g., T1059, T1059.001)

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose side effects. It describes a read operation but does not explicitly state it is non-destructive or what 'full details' entails. Adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with action, no unnecessary words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given simplicity (1 param, no output schema), description is sufficient for basic use. Could mention return format, but not required for overall completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% description coverage for the single parameter. Description repeats the example but adds no additional semantic context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb (Get), resource (full details of ATT&CK technique), and method (by ID). Includes examples of IDs, distinguishing from sibling search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage when technique ID is known. Sibling tools like mitre_search_techniques suggest alternatives, but no explicit when-not or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_list_campaignsA

List all known ATT&CK campaigns with names, dates, and brief descriptions

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description states the tool lists 'all known' campaigns but does not disclose any behavioral traits such as whether it is read-only, if there are pagination limits, or data freshness. Since there are no annotations, the description carries the full burden; a 3 is adequate given the simplicity of a list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that immediately states the purpose and output. Every word is necessary, and it is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema, and no annotations, the description is fairly complete for a straightforward list tool. It covers what the tool returns, though it could mention any ordering or the source of the data.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the baseline is 4. The description adds value by summarizing the output contents (names, dates, descriptions), which is beyond what the empty schema conveys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool lists all ATT&CK campaigns and includes the returned fields (names, dates, brief descriptions). It distinguishes from sibling tools that list other entities like groups or tactics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like mitre_search_campaigns or mitre_get_campaign. An agent would benefit from knowing this is for a broad overview while search is for filtering.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_list_groupsA

List all known threat groups with names, aliases, and brief descriptions

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full behavioral burden. It only states it lists groups but lacks detail on return limits, ordering, or whether it's static. Simple but insufficient for complex decisions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence of 10 words, no fluff. Effectively communicates purpose and output without wasted content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter listing tool with no output schema, description adequately covers what the tool produces. Lacks mention of ordering or possible limits, but is reasonably complete for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters (schema coverage 100%), so baseline is 4. Description adds value by specifying what fields are returned (names, aliases, descriptions) beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'List all known threat groups with names, aliases, and brief descriptions', specifying verb, resource, and included fields, distinguishing it from sibling tools like mitre_get_group and mitre_search_groups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. Siblings include mitre_get_group (single group) and mitre_search_groups (search), but the description does not mention these or provide exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_list_tacticsB

List all ATT&CK tactics in kill-chain order

ParametersJSON Schema

Name	Required	Description	Default
`matrix`	No	ATT&CK matrix to list tactics for (default: enterprise)

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden but only states the listing behavior. It does not disclose that it is a read-only operation, nor any other traits (e.g., rate limits, idempotency).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence (7 words) that efficiently conveys the core purpose. However, it could be slightly expanded to improve completeness without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does not indicate the return format (e.g., list of tactic names or objects). It adequately covers the operation but lacks details about what is returned. Complexity is low, so this is acceptable but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter 'matrix'. The description adds no extra meaning beyond the schema, as the only additional context is the kill-chain ordering, which is unrelated to parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List', the resource 'all ATT&CK tactics', and the ordering 'in kill-chain order'. This distinguishes it from siblings that retrieve a single tactic or list other resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool vs alternatives like mitre_get_tactic or mitre_list_groups. No explicit when/when-not or context is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_map_alert_to_techniqueA

Map a security alert or observable to likely ATT&CK techniques with confidence scoring

ParametersJSON Schema

Name	Required	Description
`platform`	No	Target platform (e.g., Windows, Linux)
`alertType`	Yes	Description of the alert (e.g., "PowerShell encoded command execution")
`indicators`	No	Associated indicators (IPs, domains, file hashes, process names)

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions 'confidence scoring' indicating output includes scores, but does not disclose if the operation is read-only, destructive, or any other behavioral traits like rate limits or authentication needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that directly conveys the tool's purpose with no redundant information. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and only three parameters, the description should explain the return format (e.g., list of techniques with scores). It merely states 'with confidence scoring' without details. The mapping process and how parameters are used are not elaborated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters have descriptions in the input schema (100% coverage), so the description adds no additional meaning beyond what schema already provides. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (map) and target (security alert/observable) and outcome (likely ATT&CK techniques with confidence scoring), distinguishing it from siblings like mitre_search_techniques or mitre_get_technique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose is clear but no explicit guidance on when to use this tool versus alternatives such as mitre_technique_overlap or mitre_search_techniques. Usage is implied but not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_mitigations_for_techniqueB

Get all mitigations applicable to a specific technique

ParametersJSON Schema

Name	Required	Description	Default
`techniqueId`	Yes	ATT&CK technique ID (e.g., T1059.001)

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It implies a read operation but does not disclose return format, pagination, or any side effects. The description is too sparse for an agent to infer behavioral traits beyond a simple read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no fluff, front-loaded with the action. Every word is necessary. Very concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should explain what is returned. It only says 'mitigations' without specifying structure (e.g., list of IDs, full objects). For an agent to use the result correctly, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already describes techniqueId as 'ATT&CK technique ID (e.g., T1059.001)'. The description adds no additional meaning beyond that. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'mitigations', and the scope 'applicable to a specific technique'. It effectively distinguishes from siblings like 'mitre_get_mitigation' (single mitigation) and 'mitre_search_mitigations' (search across all).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. It does not mention exclusions or provide context like 'Use this when you need mitigations for a known technique; for searching across techniques, use mitre_search_mitigations instead.' The description is minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_navigator_layerB

Generate an ATT&CK Navigator layer JSON for visualization. Supports coverage heatmaps, group technique overlays, campaign views, and custom technique highlighting.

ParametersJSON Schema

Name	Required	Description
`mode`	Yes	Layer type: coverage (data source coverage), group (group techniques), campaign (observed techniques), techniques (custom list), diff (compare two groups)
`name`	No	Layer name
`color`	No	Highlight color (default: #ff6666)
`groupId`	No	For group mode: group ID or name
`techniques`	No	For techniques/campaign mode: technique IDs
`dataSources`	No	For coverage mode: available data source names
`compareGroupIds`	No	For diff mode: two group IDs to compare
`showSubtechniques`	No	Show sub-techniques (default: true)

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions only the output (JSON for visualization) but does not disclose behavioral traits like side effects, authentication needs, error behavior, or performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a list, concise and front-loaded. However, it could be more structured (e.g., listing modes with brief explanations) without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters and no output schema, the description is too brief. It does not explain the JSON output format, how diff mode works with compareGroupIds, or other usage details. Missing crucial context for effective tool use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the baseline is 3. The description adds minimal context beyond the schema (e.g., explaining mode purposes), but the schema already provides detailed parameter descriptions, so the value added is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates an ATT&CK Navigator layer JSON for visualization, listing specific use cases (coverage heatmaps, group overlays, campaign views, custom highlighting) which distinguishes it from siblings like mitre_attack_path or mitre_detection_coverage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists modes that imply usage contexts, but lacks explicit guidance on when to choose this tool over siblings, when not to use it, or any prerequisites. The information is implicit rather than direct.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_search_campaignsB

Search campaigns by keyword or by technique usage

ParametersJSON Schema

Name	Required	Description	Default
`query`	No	Keyword search across campaign name, aliases, description
`technique`	No	Find campaigns using a specific technique ID

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It only states what it does, but omits any behavioral traits such as return format, pagination, authentication requirements, or rate limits. This is insufficient for a search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. It is front-loaded with the core purpose. However, it could benefit from slight structuring (e.g., bullet points) for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool lacks an output schema, so the description should explain what the result contains (e.g., list of campaigns with basic info). It does not. Additionally, it does not differentiate from similar sibling search tools beyond the resource name. The description is incomplete for a search tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter having a detailed description in the schema. The tool description adds little beyond restating the two modes. It does not provide additional context like typical values or constraints, so it does not improve upon the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'search' and the resource 'campaigns', specifying two modes: by keyword or by technique usage. This distinguishes it from sibling tools like mitre_get_campaign (get specific campaign) and mitre_list_campaigns (list all).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use each parameter (keyword vs. technique), but does not explicitly provide when-not-to-use or alternatives. For example, it could mention that for a specific campaign ID, use mitre_get_campaign. The guidance is adequate but not thorough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_search_groupsB

Search threat groups by keyword or by technique usage

ParametersJSON Schema

Name	Required	Description	Default
`query`	No	Keyword search across group name, aliases, description
`technique`	No	Find groups using a specific technique ID

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only states what the tool does (search) without mentioning any behaviors like return format, pagination, authentication requirements, or what happens when both parameters are provided. This is insufficient for an AI agent to understand the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that efficiently communicates the core purpose. It is front-loaded with the key action and resource. While it could benefit from a bit more structure (e.g., listing modes), it is not verbose and earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has two parameters and no output schema, the description should explain what the tool returns (e.g., list of group names vs. full profiles) and any important usage constraints. It does neither, leaving the AI agent without enough context to fully leverage the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with good descriptions for each parameter. The description adds the context of 'by keyword or by technique usage', which clarifies that the two parameters are alternatives. However, it does not add significant new meaning beyond the schema, so it meets the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches threat groups, using either a keyword or a technique ID. The verb 'Search' and resource 'threat groups' are specific, and it distinguishes from sibling tools like mitre_get_group (retrieve a single group) and mitre_list_groups (list all groups).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies two modes of searching (keyword or technique), but it does not provide explicit guidance on when to use this tool versus alternatives such as mitre_get_group or mitre_list_groups. It lacks when-not-to-use or alternative recommendations, which is a gap given the number of sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_search_mitigationsC

Search mitigations by keyword

ParametersJSON Schema

Name	Required	Description	Default
`query`	Yes	Keyword search for mitigations

TDQS

C2.8/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description only states a simple search action with no behavioral context. It does not disclose whether the tool is read-only, returns a list or single item, supports pagination, or requires any special permissions. Since no annotations exist, the description carries the full burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at 5 words, but it lacks structure and reads as a phrase rather than a full sentence. While there is no wasteful content, the brevity sacrifices completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having only one required parameter and no output schema, the description is too minimal. It does not explain what the search returns (e.g., mitigation names, IDs), how to format the keyword, or any limitations. For a MITRE tool, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'query' is fully described in the schema as 'Keyword search for mitigations'. The description adds no additional meaning beyond the schema. Schema coverage is 100%, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Search mitigations by keyword' clearly conveys that the tool performs a keyword search for mitigations. However, it does not distinguish from sibling search tools like mitre_search_techniques or mitre_get_mitigation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. The description offers no guidance on when to use this tool versus alternatives such as mitre_get_mitigation or mitre_mitigations_for_technique.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_search_softwareB

Search software/malware by name, keyword, technique, or type

ParametersJSON Schema

Name	Required	Description
`type`	No	Filter by software type
`query`	No	Keyword search across software name and description
`technique`	No	Find software using a specific technique ID

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It only states the search action but does not mention pagination, result limits, or any side effects (e.g., no mutations implied). The minimal description lacks transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise single sentence that communicates the core functionality. Every word is useful, and the key search dimensions are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description is insufficient. A search tool should clarify return format, pagination, or typical result structure. The current description is too minimal for a tool with three optional parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description summarizes the search dimensions (name, keyword, technique, type) but does not add meaning beyond the schema's own parameter descriptions. No extra value provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches software/malware by name, keyword, technique, or type, using specific verbs and resources. It distinguishes itself from siblings like mitre_get_software (which retrieves a specific software) and other search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like mitre_search_campaigns or mitre_search_techniques. The description does not provide context for selecting this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_search_techniquesB

Search ATT&CK techniques by keyword, tactic, platform, or data source

ParametersJSON Schema

Name	Required	Description
`query`	No	Keyword search across technique name and description
`tactic`	No	Filter by tactic (e.g., initial-access, execution, persistence)
`platform`	No	Filter by platform (e.g., Windows, Linux, macOS, Cloud)
`dataSource`	No	Filter by data source
`isSubtechnique`	No	Filter parent techniques vs sub-techniques

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It does not mention pagination, result limits, error handling, or authorization needs. The description is minimal and adds little beyond the obvious search functionality.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the main action. There is no waste, but it could be slightly expanded to improve completeness without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and 5 parameters, the description does not explain return values, behavior when no results are found, or how filters combine. This is insufficient for an agent to fully understand the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with each parameter described adequately. The tool description simply restates the filter categories without adding new semantic detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches ATT&CK techniques and lists the filtering criteria (keyword, tactic, platform, data source). It distinguishes from sibling search tools targeting different entities (campaigns, groups, etc.). However, it could be more specific about the scope of keyword search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives is provided. For a search tool, usage is fairly self-evident, but the description lacks any context about prerequisites or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_soc_statusA

Get connection status for all configured SOC integrations (Wazuh, TheHive, Cortex, MISP)

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided. The description describes a safe read operation but lacks details on authentication requirements, potential errors if integrations are missing, or whether output structure is predictable. Adequate for a simple get-status tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the action (get connection status) and scope (all configured SOC integrations). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is sufficient. It could optionally mention that status is returned for each listed integration, but not necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, and schema coverage is 100%. The description adds value by listing the integrations covered, compensating for the lack of parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool gets connection status for SOC integrations, listing specific tools (Wazuh, TheHive, Cortex, MISP). It distinguishes from sibling tools which deal with MITRE data like attack paths, campaigns, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While it does not provide explicit when-to-use or when-not-to-use guidance, the tool's specific purpose (status check) and zero parameters make its usage obvious. No sibling tool has a similar function, so differentiation is implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_technique_overlapC

Find technique overlap between threat groups for attribution assistance

ParametersJSON Schema

Name	Required	Description	Default
`groupIds`	No	Group IDs to compare
`techniques`	No	Technique IDs to find groups sharing these techniques

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description does not disclose behavioral traits such as read-only nature, performance, or side effects. Only states high-level purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise single sentence that conveys the core purpose. However, it may be too brief for adequate context, earning a slight deduction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no description of return values. The tool's behavior regarding overlap computation and output format is unspecified, making it incomplete for an AI agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters. The tool's description adds no additional meaning beyond the schema, so baseline score applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool finds technique overlap between threat groups for attribution assistance. It uses a specific verb and resource, but does not differentiate from sibling tools like mitre_cross_correlate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Lacks context about prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_update_dataA

Force an update of the local ATT&CK data cache by re-downloading STIX bundles

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must disclose behavioral traits. It indicates a mutating operation but does not mention potential side effects like network dependency, time consumption, or overwriting existing cache.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with zero parameters and no output schema, the description is adequate but lacks mention of preconditions (e.g., network access) or consequences (e.g., impact on other tools).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so schema coverage is 100%. The description does not need to add parameter info. Baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('force an update'), the resource ('local ATT&CK data cache'), and the method ('re-downloading STIX bundles'). It distinguishes from sibling tools which are query-oriented.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for refreshing the cache, but does not specify when to use (e.g., after updates) or when not to use (e.g., network unavailable). No mention of alternatives like waiting for automatic updates.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

26 tool updatesv2.0.1Jun 30, 2026
- First observedmitre_attack_path
- First observedmitre_campaign_profile
- First observedmitre_cross_correlate
- First observedmitre_data_version
- First observedmitre_detection_coverage
- First observedmitre_get_campaign
- First observedmitre_get_datasource
- First observedmitre_get_group
- First observedmitre_get_mitigation
- First observedmitre_get_software
- First observedmitre_get_tactic
- First observedmitre_get_technique
- First observedmitre_list_campaigns
- First observedmitre_list_groups
- First observedmitre_list_tactics
- First observedmitre_map_alert_to_technique
- First observedmitre_mitigations_for_technique
- First observedmitre_navigator_layer
- First observedmitre_search_campaigns
- First observedmitre_search_groups
- First observedmitre_search_mitigations
- First observedmitre_search_software
- First observedmitre_search_techniques
- First observedmitre_soc_status
- First observedmitre_technique_overlap
- First observedmitre_update_data

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.7/5.0

Disambiguation5/5

Each tool has a clear and distinct purpose, such as getting details for a specific entity, listing all entities, or searching. There is no overlap; even similar tools like get, list, and search for the same entity type serve different intents (by ID, all, or keyword).

Naming Consistency5/5

All tools follow a consistent 'mitre_verb_noun' pattern (e.g., mitre_get_technique, mitre_search_groups, mitre_list_tactics). No mixing of naming conventions or styles.

Tool Count4/5

26 tools is slightly above the typical 15-25 range for comprehensive servers, but each tool contributes distinct functionality for a complex domain like MITRE ATT&CK, covering search, retrieval, analysis, and integration with other SOC tools.

Completeness5/5

The tool surface covers all major MITRE ATT&CK entities (techniques, tactics, groups, software, mitigations, campaigns, data sources) with search, list, get, and specialized analysis tools, including navigator layers, detection coverage, and cross-correlation. No significant gaps for the intended use case.

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

meok-mcp-hardening-mcp
io.github.CSOAI-ORG
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Penetration Testing Security
1
Crimson Crawler
com.crimsoncrawler
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security Search Research & Data
1
mcp-server
com.pentest-tools
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Penetration Testing Security
23
sentrysurface
io.github.sentrysurface
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
Security Penetration Testing
2

Related MCP Servers

Huntress-MCP-Server
Security Monitoring Developer Tools
DynamicEndpoints
A
license
Not graded
quality
Not graded
maintenance
MCP server for Huntress API integration
Updated a year ago (2025-07-16 05:30 UTC)
1
MIT
wrg-mcp-server
Security Penetration Testing Code Analysis
WRG-11
A
license
Not graded
quality
A
maintenance
An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
Updated 3 months ago (2026-06-10 18:22 UTC)
1
MIT
MITRE ATT&CK Mapper MCP
Security Penetration Testing Documentation Access
CSOAI-ORG
A
license
B
quality
C
maintenance
Enables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.
Updated 2 months ago (2026-06-26 05:37 UTC)
5
MIT
Threat Hunting MCP Server
Security Research & Data
THORCollective
F
license
Not graded
quality
D
maintenance
A behavioral threat hunting MCP server that focuses on adversary TTPs rather than atomic indicators, with MITRE ATT\&CK integration, advanced cognitive capabilities, and community hunt hypotheses.
Updated 4 months ago (2026-04-26 03:48 UTC)
19
-

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/lidless-labs/mitre-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server