A

Attack MCP Server

An ATT&CK knowledge base query service based on the MCP protocol, providing functions for retrieving attack techniques and tactics, querying mitigation measures, and detection methods.
2.5 points
29

What is the ATT&CK MCP Server?

This is a server based on the Model Context Protocol (MCP), specifically designed to query information about attack techniques and tactics in the MITRE ATT&CK framework. It can help security analysts quickly obtain detailed information, mitigation measures, and detection methods for attack techniques.

How to use the ATT&CK MCP Server?

You can connect to this server through an MCP client and then use the provided tools to query ATT&CK technique information. Two connection modes are supported: local stdio mode and HTTP/SSE mode.

Use cases

Suitable for scenarios such as security analysis, threat intelligence research, security product development, and red - blue confrontation exercises. Particularly suitable for automated security analysis systems that need to integrate the ATT&CK knowledge base.

Main features

Query attack techniquesQuery detailed information about ATT&CK techniques by technique ID or name, supporting fuzzy search by name.
Query mitigation measuresGet defense and mitigation suggestions for specific attack techniques.
Query detection methodsGet detection methods and suggestions for specific attack techniques.
List all tacticsGet a list of all tactical classifications in the ATT&CK framework.

Advantages and limitations

Advantages
Provides a standardized MCP interface, easy to integrate into existing security toolchains
Supports multiple connection modes to adapt to different usage scenarios
Comprehensive query functions, covering ATT&CK techniques, tactics, mitigation measures, and detection methods
Supports fuzzy search by technique name, facilitating user searches
Limitations
Requires MCP client support to use
The HTTP/SSE mode may require additional network access configuration
Depends on the official ATT&CK data updates

How to use

Install dependencies
Ensure that Python and the necessary dependency libraries are installed.
Select a connection mode
Select the local stdio mode or HTTP/SSE mode according to your usage scenario.
Start the server
Run the main program to start the MCP server.
Configure the client
Configure the server connection information in the MCP client.

Usage examples

Query a specific attack techniqueA security analyst needs to understand how PowerShell is used in attacks
Find defense measuresA defense team needs to develop a defense plan for technique T1059.001
Build detection rulesAn SOC team needs to create detection rules for a specific attack technique

Frequently Asked Questions

What is the MCP protocol?
How to obtain the latest ATT&CK data?
Does it support the enterprise version of ATT&CK?
How to debug connection issues?

Related resources

MITRE ATT&CK official website
Official resources for the MITRE ATT&CK framework
MCP protocol specification
Official specification document for the Model Context Protocol
Project GitHub repository
Source code and issue tracking for this project
ATT&CK data download
Official data repository for MITRE ATT&CK
Installation
Copy the following command to your Client for configuration
Note: Your key is sensitive information, do not share it with anyone.
S
Search1api
The Search1API MCP Server is a server based on the Model Context Protocol (MCP), providing search and crawling functions, and supporting multiple search services and tools.
TypeScript
347
4 points
D
Duckduckgo MCP Server
Certified
The DuckDuckGo Search MCP Server provides web search and content scraping services for LLMs such as Claude.
Python
837
4.3 points
M
MCP Alchemy
Certified
MCP Alchemy is a tool that connects Claude Desktop to multiple databases, supporting SQL queries, database structure analysis, and data report generation.
Python
331
4.2 points
P
Postgresql MCP
A PostgreSQL database MCP service based on the FastMCP library, providing CRUD operations, schema inspection, and custom SQL query functions for specified tables.
Python
115
4 points
M
MCP Scan
MCP-Scan is a security scanning tool for MCP servers, used to detect common security vulnerabilities such as prompt injection, tool poisoning, and cross-domain escalation.
Python
624
5 points
A
Agentic Radar
Agentic Radar is a security scanning tool for analyzing and assessing agentic systems, helping developers, researchers, and security experts understand the workflows of agentic systems and identify potential vulnerabilities.
Python
561
5 points
C
Cloudflare
Changesets is a build tool for managing versions and releases in multi - package or single - package repositories.
TypeScript
1.5K
5 points
E
Edgeone Pages MCP Server
EdgeOne Pages MCP is a service that quickly deploys HTML content to EdgeOne Pages via the MCP protocol and obtains a public URL
TypeScript
258
4.8 points
Featured MCP Services
D
Duckduckgo MCP Server
Certified
The DuckDuckGo Search MCP Server provides web search and content scraping services for LLMs such as Claude.
Python
837
4.3 points
N
Notion Api MCP
Certified
A Python-based MCP Server that provides advanced to-do list management and content organization functions through the Notion API, enabling seamless integration between AI models and Notion.
Python
149
4.5 points
M
Markdownify MCP
Markdownify is a multi-functional file conversion service that supports converting multiple formats such as PDFs, images, audio, and web page content into Markdown format.
TypeScript
1.7K
5 points
G
Gitlab MCP Server
Certified
The GitLab MCP server is a project based on the Model Context Protocol that provides a comprehensive toolset for interacting with GitLab accounts, including code review, merge request management, CI/CD configuration, and other functions.
TypeScript
97
4.3 points
U
Unity
Certified
UnityMCP is a Unity editor plugin that implements the Model Context Protocol (MCP), providing seamless integration between Unity and AI assistants, including real - time state monitoring, remote command execution, and log functions.
C#
572
5 points
F
Figma Context MCP
Framelink Figma MCP Server is a server that provides access to Figma design data for AI programming tools (such as Cursor). By simplifying the Figma API response, it helps AI more accurately achieve one - click conversion from design to code.
TypeScript
6.7K
4.5 points
M
Minimax MCP Server
The MiniMax Model Context Protocol (MCP) is an official server that supports interaction with powerful text-to-speech, video/image generation APIs, and is suitable for various client tools such as Claude Desktop and Cursor.
Python
760
4.8 points
C
Context7
Context7 MCP is a service that provides real-time, version-specific documentation and code examples for AI programming assistants. It is directly integrated into prompts through the Model Context Protocol to solve the problem of LLMs using outdated information.
TypeScript
5.2K
4.7 points
AIbase
Zhiqi Future, Your AI Solution Think Tank
© 2025AIbase