Attack MCP Server
An ATT&CK knowledge base query service based on the MCP protocol, providing functions for retrieving attack techniques and tactics, querying mitigation measures, and detection methods.
rating : 2.5 points
downloads : 29
What is the ATT&CK MCP Server?
This is a server based on the Model Context Protocol (MCP), specifically designed to query information about attack techniques and tactics in the MITRE ATT&CK framework. It can help security analysts quickly obtain detailed information, mitigation measures, and detection methods for attack techniques.How to use the ATT&CK MCP Server?
You can connect to this server through an MCP client and then use the provided tools to query ATT&CK technique information. Two connection modes are supported: local stdio mode and HTTP/SSE mode.Use cases
Suitable for scenarios such as security analysis, threat intelligence research, security product development, and red - blue confrontation exercises. Particularly suitable for automated security analysis systems that need to integrate the ATT&CK knowledge base.Main features
Query attack techniquesQuery detailed information about ATT&CK techniques by technique ID or name, supporting fuzzy search by name.
Query mitigation measuresGet defense and mitigation suggestions for specific attack techniques.
Query detection methodsGet detection methods and suggestions for specific attack techniques.
List all tacticsGet a list of all tactical classifications in the ATT&CK framework.
Advantages and limitations
Advantages
Provides a standardized MCP interface, easy to integrate into existing security toolchains
Supports multiple connection modes to adapt to different usage scenarios
Comprehensive query functions, covering ATT&CK techniques, tactics, mitigation measures, and detection methods
Supports fuzzy search by technique name, facilitating user searches
Limitations
Requires MCP client support to use
The HTTP/SSE mode may require additional network access configuration
Depends on the official ATT&CK data updates
How to use
Install dependencies
Ensure that Python and the necessary dependency libraries are installed.
Select a connection mode
Select the local stdio mode or HTTP/SSE mode according to your usage scenario.
Start the server
Run the main program to start the MCP server.
Configure the client
Configure the server connection information in the MCP client.
Usage examples
Query a specific attack techniqueA security analyst needs to understand how PowerShell is used in attacks
Find defense measuresA defense team needs to develop a defense plan for technique T1059.001
Build detection rulesAn SOC team needs to create detection rules for a specific attack technique
Frequently Asked Questions
What is the MCP protocol?
How to obtain the latest ATT&CK data?
Does it support the enterprise version of ATT&CK?
How to debug connection issues?
Related resources
MITRE ATT&CK official website
Official resources for the MITRE ATT&CK framework
MCP protocol specification
Official specification document for the Model Context Protocol
Project GitHub repository
Source code and issue tracking for this project
ATT&CK data download
Official data repository for MITRE ATT&CK
Featured MCP Services

Duckduckgo MCP Server
Certified
The DuckDuckGo Search MCP Server provides web search and content scraping services for LLMs such as Claude.
Python
837
4.3 points

Notion Api MCP
Certified
A Python-based MCP Server that provides advanced to-do list management and content organization functions through the Notion API, enabling seamless integration between AI models and Notion.
Python
149
4.5 points

Markdownify MCP
Markdownify is a multi-functional file conversion service that supports converting multiple formats such as PDFs, images, audio, and web page content into Markdown format.
TypeScript
1.7K
5 points

Gitlab MCP Server
Certified
The GitLab MCP server is a project based on the Model Context Protocol that provides a comprehensive toolset for interacting with GitLab accounts, including code review, merge request management, CI/CD configuration, and other functions.
TypeScript
97
4.3 points

Unity
Certified
UnityMCP is a Unity editor plugin that implements the Model Context Protocol (MCP), providing seamless integration between Unity and AI assistants, including real - time state monitoring, remote command execution, and log functions.
C#
572
5 points

Figma Context MCP
Framelink Figma MCP Server is a server that provides access to Figma design data for AI programming tools (such as Cursor). By simplifying the Figma API response, it helps AI more accurately achieve one - click conversion from design to code.
TypeScript
6.7K
4.5 points

Minimax MCP Server
The MiniMax Model Context Protocol (MCP) is an official server that supports interaction with powerful text-to-speech, video/image generation APIs, and is suitable for various client tools such as Claude Desktop and Cursor.
Python
760
4.8 points

Context7
Context7 MCP is a service that provides real-time, version-specific documentation and code examples for AI programming assistants. It is directly integrated into prompts through the Model Context Protocol to solve the problem of LLMs using outdated information.
TypeScript
5.2K
4.7 points