Skip to main content
Glama
stoyky

MITRE ATT&CK MCP Server

by stoyky
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to MITRE ATT&CK MCP Server

No user-submitted related servers found.

    Related Servers

    • MITRE ATT&CK MCP Server

      imouiche
      A
      license
      A
      quality
      D
      maintenance
      Enables AI-native access to the MITRE ATT\&CK framework, allowing LLMs and agents to query techniques, threat groups, software, and generate ATT\&CK Navigator layers for threat intelligence and security workflows.
      65
      42 npm
      5
      Apache 2.0

    • ATT&CK MCP Server

      alex-llm
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables querying the MITRE ATT\&CK framework for adversarial tactics, techniques, mitigations, and detection methods through natural language, supporting both ID-based and fuzzy name-based searches.
      3
      -

    • Threat Intel MCP Server

      iceage2114
      F
      license
      Not graded
      quality
      D
      maintenance
      Provides threat intelligence and vulnerability research tools by integrating with NVD, VirusTotal, AbuseIPDB, Shodan, and MITRE ATT\&CK. It enables users to perform CVE lookups, analyze IP reputation, and retrieve detailed MITRE ATT\&CK technique information.
      1
      -

    • mitre-mcp

      Montimage
      A
      license
      A
      quality
      A
      maintenance
      Exposes the MITRE ATT\&CK framework to LLMs and AI assistants via the Model Context Protocol, enabling querying of techniques, tactics, groups, software, and mitigations.
      9
      15
      MIT

    • cyber-mcp-tools

      FlemingJohn
      F
      license
      A
      quality
      B
      maintenance
      Enables querying MITRE ATT&CK and D3FEND data efficiently, providing techniques, detections, mitigations, actors, and countermeasures with token-aware summaries and paginated graph traversal.
      10
      -
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.3/5.0

    Scored across 55 tools

    Disambiguation4/5

    Most tools have distinct purposes targeting specific ATT&CK objects and relationships, with clear naming like 'get_techniques_used_by_group' versus 'get_groups_using_technique'. However, some tools like 'get_objects_by_name' and 'get_objects_by_content' could be confused due to overlapping search functionality, and 'get_layer_metadata' is a special-case tool that might be misapplied.

    Naming Consistency5/5

    Tool names follow a highly consistent snake_case pattern with a clear 'verb_noun' or 'verb_noun_preposition_noun' structure throughout. All tools start with 'generate_' or 'get_', and relationship tools consistently use prepositions like 'by', 'for', 'using', or 'targeting' to indicate connections between entities.

    Tool Count2/5

    With 55 tools, this is an extremely large set that feels overwhelming for the ATT&CK framework domain. While ATT&CK has many entities and relationships, this many tools will likely cause analysis paralysis and difficulty in tool selection, exceeding the typical well-scoped range of 3-15 tools.

    Completeness5/5

    The toolset provides comprehensive coverage of the MITRE ATT&CK domain, including retrieval of all entity types (groups, techniques, software, etc.), relationship queries between entities, search capabilities by various attributes, and specialized functions like layer generation and timestamp filtering. No obvious gaps exist for querying the framework's data model.

    Maintenance

    ActivityInactive
    ResponsivenessNo issues

    Resources