<h1 align="center">
  <br>
  MITRE ATT&CK MCP Server
  <br>
</h1>

<h4 align="center">A Model-Context Protocol server for the MITRE ATT&CK knowledge base</h4>

<p align="center">
  <a href="#key-features">Key Features</a> •
  <a href="#installation">Installation</a> •
  <a href="#how-to-use">How To Use</a> •
  <a href="#use-cases">Use Cases</a> •
  <a href="#credits">Credits</a>
</p>

## Key Features

* 50+ Tools for MITRE ATT&CK Querying
  * Comprehensive access to the MITRE ATT&CK knowledge base through structured API tools
* Automatic ATT&CK Navigator Layer Generation
  * Generate visual representations of techniques used by threat actors
* Threat Actor and Malware Attribution
  * Query relationships between malware, threat actors, and techniques
* Technique Overlap Analysis
  * Compare techniques used by different threat actors or malware families

## Installation

To clone and run this server, you'll need [Git](https://git-scm.com), [Python](https://www.python.org/), and [PipX](https://github.com/pypa/pipx) installed on your computer.

1. Ensure Git, Python, and PipX have been installed using their official respective installation instructions for Windows/Mac/Linux
2. Install the MCP Server using PipX
   
```bash
pipx install git+https://github.com/stoyky/mitre-attack-mcp
```

## How To Use

### Configure with Claude AI Desktop

1. Open Claude's MCP server configuration file.

#### Windows

```
C:\Users\[YourUsername]\AppData\Roaming\Claude\claude_desktop_config.json
# or
C:\Users\[YourUsername]\AppData\Local\AnthropicClaude\claude_desktop_config.json
```

#### Linux / Mac

```bash
~/.config/Claude/claude_desktop_config.json
```

2. Add the following to that file if it doesn't already exist. If it already exists, merge the two JSON structures accordingly.

```json
{
  "mcpServers": {
    "mitre-attack": {
      "command": "mitre-attack-mcp",
      "args": [
      ]
    }
  }
}
```

**Note**: By default the MCP server stores the mitre-related data in the current users default cache directory. You can specify a custom data directory to use with the following config:

```json
{
  "mcpServers": {
    "mitre-attack": {
      "command": "mitre-attack-mcp",
      "args": [
        "--data-dir",
        "<path-to-data-dir>"
      ]
    }
  }
}
```

## Changelog

* v1.0.2 - Now installable via PipX on Windows, Mac, and Linux. "data directory" argument is now optional and will use the default cache directory if omitted.
* v1.0.0 - Initial release
* V1.0.1 - Improved robustness of layer metadata generation and error handling in layer generation function

## Use Cases

* Query for detailed information about specific malware, tactics, or techniques
* Discover relationships between threat actors and their tools
* Generate visual ATT&CK Navigator layers for threat analysis
* Find campaign overlaps between different threat actors
* Identify common techniques used by multiple malware families

Please see my [blog](https://www.remyjaspers.com/blog/mitre_attack_mcp_server/) for more information and examples.

## Credits

* [MITRE ATT&CK](https://attack.mitre.org/) - Knowledge base of adversary tactics and techniques
* [MITRE ATT&CK Python](https://github.com/mitre-attack/mitreattack-python) - Python library to interact with the knowledge base
* [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator) - Tool for visualizing ATT&CK matrices
* [Anthropic](https://www.anthropic.com/) - Developers of the Model-Context Protocol

---

> Created by [Remy Jaspers](https://github.com/stoyky)