Attack MCP Server

🚀 attAck-mcp-server

This project is an MCP (Model Context Protocol) server for querying ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) techniques and tactics. It provides a way to access and retrieve information on various cyber attack techniques and tactics.

🚀 Quick Start

✨ Features

The server offers the following tools:

• query_technique: This tool allows you to query ATT&CK techniques by ID or name.
  • Parameters:
    • technique_id (string, optional): The ID of the technique to query.
    • tech_name (string, optional): The name (or partial name) of the technique to query. Supports fuzzy name search.
  • Examples:
    • Query by ID:

{
  "technique_id": "T1059.001"
}

    - Fuzzy search by name:

{
  "tech_name": "phishing"
}

• query_mitigations: Query mitigation measures for a technique.
  • Parameters:
    • technique_id (string, required): The ID of the technique to query.
  • Examples:

{
  "technique_id": "T1059.001"
}

• query_detections: Query detection methods for a technique.
  • Parameters:
    • technique_id (string, required): The ID of the technique to query.
  • Examples:

{
  "technique_id": "T1059.001"
}

• list_tactics: This tool allows you to obtain all ATT&CK tactic classifications.
  • Parameters: None
  • Examples: No parameters are required. Just call the interface directly.

📦 Installation

Local Run Mode

1. Install dependencies (it is recommended to do this in a virtual environment):

pip install -r requirements.txt

2. Ensure that the enterprise-attack.json dataset is located in the project root directory.
3. Start the service:

python main.py

4. The service listens on http://127.0.0.1:8001 by default.

Recommended for Production Environment (Docker or Uvicorn)

Docker

1. Build the image:

docker build -t attack-mcp-server .

2. Run the container:

docker run -p 8001:8001 attack-mcp-server

Uvicorn Command Line

uvicorn main:app --host 0.0.0.0 --port 8001

📚 Documentation

API Documentation

• /query_technique: Query details of attack techniques by ID or name (supports fuzzy name search).
• /query_mitigations: Query mitigation measures for a specified technique.
• /query_detections: Query detection methods for a specified technique.
• /list_tactics: Obtain all ATT&CK tactic classifications.

If you have any questions, please contact the maintainer.